Architecture

Cloudflare account
├── API Worker      Hono: public API, admin API, Better Auth, forms, cache, rate limits, cron
├── Admin Worker    React/Vite dashboard (Workers Static Assets, no server code)
├── D1              structured data
└── R2              media files and form attachments

Your website (separate project)  ──HTTP──▶  API Worker

Single site per deployment

Each deployment backs exactly one website and has its own Cloudflare resources. Kenresoft does not operate a shared multi-tenant backend, and holds no credential into your deployment. Another client gets another deployment of the same code.

Two Workers

The Admin Worker is static assets only. Its browser code calls the API Worker over HTTPS, using the API URL baked into its build (VITE_API_URL). The two Workers deploy and roll back independently. With a custom domain you can also place both behind one hostname; that is not the default install.

CMS and website are separate

Website ──▶ @kenresoft-cms/astro ──▶ Public API ──▶ API Worker ──▶ D1 / R2

• Updating the CMS does not update your website.
• Updating @kenresoft-cms/astro does not update the CMS.
• Your website never connects to D1 or R2 directly.
• The CMS is frontend-agnostic. Astro is the first-class integration; anything that can call HTTP can use the public API.

Cloudflare features actually used

• Workers (API and Admin), D1, R2.
• Rate Limiting bindings for auth, recovery, forms, public reads and admin email. See Rate limiting.
• Cache API for public responses, invalidated when content changes. There is no Workers KV in the deployment: KV as a secondary cache tier is described in the design documents but not implemented.
• Cron Trigger every 5 minutes for scheduled publishing (entries and pages), webhook delivery retries and cache-purge work.
• Email through either Cloudflare Email Sending or Resend, both optional. See Email.
• Paystack, only if you use Commerce payments.

Packages

Package	Role
@kenresoft-cms/create	CLI: scaffold a CMS, scaffold an Astro starter, connect an existing Astro project
@kenresoft-cms/astro	Runtime client and same-origin proxy for your website
@kenresoft-cms/contracts	Shared Zod schemas for the API contract (published to npm)

The CMS repository also contains internal packages for the database schema, the plugin SDK (@kenresoft-cms/plugin-sdk), and the bundled plugins (plugin-ecommerce, plugin-hello).

Security posture

• Admin routes require a CMS-role session, an allowed Origin, and block all writes from viewer.
• Authorization is enforced at the API, not only in the UI.
• CORS is an explicit allow-list (CORS_ORIGINS), never *.
• Public form input is sanitized; uploads are verified by their bytes.
• Security headers are set on API responses and generated for the Admin Worker.
• Sensitive administrative actions are written to an audit log.