Deploy Safest Resolve in your Cloudflare account

01

Starting point

You want the report service, workflow runtime, records, files, credentials and operating logs under your Cloudflare account. Safest Resolve provides a project generator and reviewed deployment scripts for that boundary.

02

What must hold

• Deploying before confirming account entitlements and resource limits.
• Using the wrong Cloudflare Access audience or owner allowlist during bootstrap.
• Treating public liveness as proof that migrations, queues and workflow capabilities are ready.

03

Step by step

1. Install Node.js 20 or newer, authenticate Wrangler, prepare an HTTPS hostname, list every browser origin and create the Cloudflare Access application for the infrastructure path.
2. Run npx create-safest-tools safest-resolve with your installation name, public URL, application origin, owner email and Access audience. The generator writes a project and prints a read-only plan.
3. Review reports.config.json, wrangler.jsonc and npm run setup:plan. Confirm the exact Worker, D1 database, four R2 buckets, three Queues and every declared binding.
4. Run npm run secrets:init, then supply the required API, signing, encryption, portal and rate-limit secrets in the protected local secrets file.
5. Run npm run setup:plan again, then npm run setup. Confirm the exact installation ID when the deploy script asks for it.
6. Open the Access-protected bootstrap route, create the first Safest owner, invite an administrator and analyst, and confirm an unlisted identity cannot bootstrap ownership.
7. Check /health, verify database, workflow_runtime, workers_ai, object_storage and queues from setup, then require authenticated /ready to return 200.

05

Data exchange

The generated Worker declares Static Assets, D1, four private R2 buckets, Queues with a dead-letter queue, Dynamic Workflows, Worker Loaders, a SQLite-backed Durable Object, Workers AI, Cron Triggers, Workers Logs and Worker secrets. Turnstile protects public intake when configured; Access protects owner bootstrap; Email Service can be added for outbound updates.

06

Verification

The installation has a local receipt, applied migrations, uploaded secrets, deployed bindings, named owners and successful capability checks. /health proves liveness; authenticated /ready proves the installation can operate.

07

Implementation questions