A backend & platform engineer's tour of monzim.com — the runtime, the bindings, the build pipeline, the cron jobs, and the small set of opinions that make it cheap to run, fast to ship, and boring to operate.
The whole app — SSR, file-based routes, server functions, the small API surface, OAuth, MCP, the analytics writers, and the cron handlers — runs inside a single Cloudflare Worker. There is no separate Node origin and no edge / origin split.
runtimeTanStack Start + Router handle SSR, server functions, and file-based routes inside the Worker.
dataD1 (SQLite) is the source of truth. R2 stores media. KV holds the hot path counters and ops cache.
obsPageviews and Web Vitals stream into Workers Analytics Engine; ad-hoc events to OpenPanel.
§ 02 · Request lifecycle
From byte to body.
Each request crosses Cloudflare's edge into the Worker, which TanStack Start drives through routing, loaders, SSR, and a security-header pass before the response leaves the colo.
lifecycle.svg
Request → response timeline
0 msClient emits
Browser opens HTTPS to the apex; H2 + H3 negotiated at Cloudflare's nearest colo.
~5 msCache lookup
Cloudflare consults its cache by URL. Static asset → served from the colo. SSR route → forwarded to the Worker.
Vite 7 + @cloudflare/vite-pluginbundler · dev server
MDX 3post compilation
remark-gfm · rehype-pretty-code · rehype-slug
Wrangler 4deploy + types
wrangler deploy · cf-typegen
GitHub ActionsCI · admin-triggered rebuilds
§ 04 · Content pipeline
Database authored. Build-time baked.
D1 is the source of truth for blogs, projects, the resume, gallery, talks, and uses-list. Pages are not queried at request time — a build step queries D1, compiles MDX, and emits a static registry the routes import directly.
content-pipeline.svg
D1 → bake → static registry
authorEdits flow through the admin UI (GitHub-OAuth + sessions in D1) or the MCP server at /api/mcp.
triggerA successful write fires triggerDeploy(), which dispatches a GitHub Actions workflow.
bakeprebuild = generate:github + generate:content. The latter reads D1 via the Cloudflare REST API and writes src/content/*.mdx + the .tsx registries.
shipwrangler deploy uploads the new Worker. The bake output is gitignored — D1 is authoritative.
§ 05 · Storage layer
Three datastores, one budget.
Each store is picked for a single property. D1 for relational truth. R2 for cheap binary blobs with a CDN in front. KV for low-latency, last-write-wins counters and short-lived caches.
D1 — portfolio-cms
Relational source of truth
SQLite at the edge; schema in db/schema.sql, incremental migrations under db/migrations/.
Also stores: media metadata, OAuth sessions, multi-version resumes, gallery items, view counts.
remote:true — local dev reads/writes prod. Mutations during `npm run dev` are real.
R2 — prod-portfolio-…
Object store for media
Public reads via storage-portfolio.monzim.com with long-lived Cache-Control.
Uploads go through the admin/MCP write path → R2 binding inside the same Worker.
Zero egress on R2; bandwidth is whatever Cloudflare's CDN serves.
KV — VIEW_COUNTER · OPS_CACHE
Hot-path counters + caches
vc:counts:* hold running totals, vc:dedup:{session,type,slug} dedup within a 30-min sliding window.
Every view → 2 KV reads + 2 KV writes under ctx.waitUntil. User response is never blocked.
Cron flushes counts into D1.view_counts every 15 minutes; daily snapshot rolls into view_counts_daily.
OPS_CACHE backs the admin /ops console (OpenPanel insights with TTL).
§ 06 · Scheduled jobs
Two cron triggers. Both idempotent.
Cloudflare cron dispatches into src/worker-entry.ts → scheduled(). The controller.cron string picks the job. Failures log but don't rethrow — a flaky run shouldn't poison the next.
cron.svg
24 h of triggers (UTC)
*/15 * * * *flushViewCounters()
Walks the vc:counts:* KV keys and upserts the cumulative {unique, total} into D1.view_counts. Each KV key is deleted after a successful flush; failures stay in KV for the next tick.
5 0 * * *snapshotDailyViewCounts()
Five minutes past midnight UTC, snapshots view_counts into view_counts_daily for yesterday. Idempotent on (date, asset_type, slug) via INSERT … ON CONFLICT.
§ 07 · Edge & security
Headers at the response seam.
Security headers are stamped inside the Worker, not at the Cloudflare dashboard. That keeps the policy in version control next to the code it protects.
Forces HTTPS for a year, covers storage-portfolio.monzim.com and admin, eligible for the HSTS preload list.
X-Content-Type-Options
nosniff
Disables MIME sniffing so a stray HTML response in an MDX bake can't be reinterpreted.
X-Frame-Options
DENY
Hard block on framing — there's no embed surface to negotiate.
Permissions-Policy
camera=(), microphone=(), geolocation=()
Closes powerful APIs the portfolio never needs, even if a future dep tries to call them.
Referrer-Policy
strict-origin-when-cross-origin
Send a useful Origin to peers without leaking the full URL on cross-site nav.
CSP is intentionally not stamped here — it needs an inventory of allowed origins (analytics beacons, image CDNs, font providers) authored alongside the report-uri. Tracked as a follow-up.
§ 08 · Observability
Aggregate. Anonymous. Cheap.
Workers Analytics Engine is the primary sink — it's a write-only column store you query later with SQL over HTTP. No per-visitor profiles, no third-party JS on critical paths.
primary sink · binding ANALYTICS
Workers Analytics Engine
Every pageview lands here as a row in monzim_site_analytics. Session IDs are a HMAC of (IP, UA, day) salted by ANALYTICS_SESSION_SALT — anonymous but stable enough to dedup. Queried later with SQL over HTTP for the /ops console.
LCP · INP · CLS · FCP · TTFB
web-vitals
Google's library fires each metric once per page lifecycle. The values pipe into OpenPanel as custom events so they can be charted next to the rest of the analytics without standing up a new pipeline.
2× KV read · 2× KV write per view
View counters
Per-asset counters live in KV behind a 30-min dedup window. ctx.waitUntil keeps the writes off the response critical path. The flush cron periodically reconciles into D1 for the admin dashboard.
§ 09 · References
Read the source.
Everything claimed above is in the repo. Each path below maps to a section on this page.