Set the Worker name, account, bindings, upload limits, and domain.
The deployment configuration is apps/api/wrangler.jsonc. Commands using pnpm --filter @nobg/api run in that directory and use this file.
| Setting | Default | Purpose |
|---|---|---|
name | nobg-api | Identifies the API Worker in your account |
account_id | Not set | Pin the target account if your login has access to several |
main | src/index.ts | Hono Worker entrypoint |
compatibility_flags | nodejs_compat | Enables the Node.js IP address validator |
workers_dev | true | Publishes a workers.dev endpoint |
routes | api.nobg.akshit.io | Project deployment hostname; remove or replace it when self-hosting |
images.binding | IMAGES | Gives the handler access to Cloudflare Images |
vars.ALLOWED_ORIGINS | The two nobg website origins | Comma-separated exact origins allowed to read browser upload responses; use an empty string to disable CORS |
vars.MAX_UPLOAD_BYTES | 10485760 | File size cap, 10 MiB |
vars.IP_REQUESTS_PER_MINUTE | 5 | Requests per IP per UTC calendar minute |
vars.IP_IMAGES_PER_DAY | 20 | Validated image attempts per IP per UTC day |
vars.IMAGES_PER_MONTH | 10000 | Image attempts across the service per UTC calendar month |
durable_objects.bindings | QUOTAS / QuotaCounter | Persistent quota counters |
migrations | v1 / new_sqlite_classes | Creates SQLite-backed quota storage |
observability.head_sampling_rate | 0.1 | Worker observability sampling rate |
Keep the IMAGES and QUOTAS binding names and the QuotaCounter class migration. Wrangler provisions the storage when you deploy. No API key or account registration is required for callers.
The Images binding accepts uploaded bytes without a public image URL. See Cloudflare’s Images binding setup.
MAX_UPLOAD_BYTES must be an integer from 1 through 20971520, the upper limit enforced by nobg. The default is 10 MiB. Request bodies have an additional 64 KiB allowance for multipart headers.
Decoded images are limited to 25 megapixels. That limit lives in packages/contracts/src/index.ts and requires a code change and deployment to adjust.
All three quota variables must be positive safe integers. Limits use fixed UTC calendar windows. Minute limits count all upload requests with a valid Cloudflare client IP, including malformed uploads. Daily and monthly limits count attempts after image validation, before transformation. Processing failures still consume allowances.
The daily allowance is reserved before the monthly budget. If the monthly budget is exhausted, that request still consumes a daily slot. Counter reservations are not refunded after failures or disconnected requests, so the monthly setting is an upper bound on processing attempts.
Every 429 includes a Retry-After value in seconds. Daily counters reset at midnight UTC; the shared budget resets on the first day of each month. Redeploying code retains counters. Changing a limit applies to the existing count without resetting it.
Counters live in SQLite-backed Durable Objects, with one object per hashed IP and one for the shared image budget. Updates are atomic across concurrent requests and Cloudflare locations. Alarms remove expired counter records. The budget controls image attempts, not total Cloudflare charges. Workers and Durable Objects usage is separate.
The Worker uses Cloudflare’s CF-Connecting-IP header and ignores X-Forwarded-For. Missing or invalid client IPs are rejected. Route public traffic directly through Cloudflare to this Worker. People behind the same NAT or proxy share an allowance. Different IPs receive separate allowances, but all requests use the same monthly budget.
IP hashes are identifiers, not anonymization. nobg does not store raw IPs or images in quota records. Cloudflare may retain request metadata through its platform logs.
The supplied routes entry points to api.nobg.akshit.io, the project’s API hostname. Remove it to use only your own workers.dev URL. To use a custom hostname, replace it with a hostname in your active Cloudflare zone:
{
"routes": [
{ "pattern": "api.example.com", "custom_domain": true }
]
}Replace the existing routes field with this configuration and change api.example.com to your hostname. Redeploy, then update NOBG_URL and your backend configuration. Cloudflare provisions DNS and a certificate for the Worker custom domain.
The existing workers.dev endpoint remains enabled while workers_dev is true.
After editing bindings, regenerate types and check the Worker:
pnpm --filter @nobg/api types
pnpm --filter @nobg/api typecheck
pnpm --filter @nobg/api test
pnpm --filter @nobg/api build
pnpm --filter @nobg/api run deployKeep your account-specific configuration in your checkout. Review changes to it when upgrading.