deployment.jsonc

1{
2  // Cloudflare account that owns every Worker and provisioned resource.
3  // Find it: https://developers.cloudflare.com/fundamentals/account/find-account-and-zone-ids/
4  "accountId": "<CLOUDFLARE_ACCOUNT_ID>",
5
6  // The deployment's public origin, used for PUBLIC_BASE_URL and to scope Context data.
7  // null derives it from workers.router.route.customDomain.
8  // Required when the router uses workersDev: the account's workers.dev subdomain is not
9  // knowable from this file. Write it as a bare origin, no path and no trailing slash --
10  // "https://<router-name>.<subdomain>.workers.dev".
11  "publicBaseUrl": null,
12
13  // Worker names are permanent service identities. Keep them unique within the account.
14  // Reference: docs/customization.md#workers-and-routing
15  "workers": {
16    // Owns the public URL and serves the frontend. Proxies /api and /blueprint-screenshot to the
17    // Workshop, and /gatekeeper/<name> to the matching Gatekeeper.
18    "router": {
19      "name": "<ROUTER_WORKER_NAME>",
20
21      // Production: use a hostname in an active Cloudflare zone. Wrangler creates DNS and TLS.
22      // Evaluation: replace this with "route": { "workersDev": true } and set publicBaseUrl above.
23      // https://developers.cloudflare.com/workers/configuration/routing/custom-domains/
24      "route": { "customDomain": "os.example.com" }
25    },
26
27    // The Workshop backend. No public route: the router reaches it over a service binding.
28    "workshop": { "name": "<WORKSHOP_WORKER_NAME>" },
29    "context": { "name": "<CONTEXT_WORKER_NAME>" },
30
31    // The Scheduler Gatekeeper, which gives agents scheduled and recurring work. Ambient like
32    // the Context Gatekeeper
33    "scheduler": { "name": "<SCHEDULER_WORKER_NAME>" },
34
35    // Upstream MCP connector, deployed by default. Users connect endpoints through the OS;
36    // availability is controlled in admin -> Gatekeepers. No external storage or secrets required.
37    "mcp": { "name": "<MCP_WORKER_NAME>" },
38
39    "errorReporter": { "name": "<ERROR_REPORTER_WORKER_NAME>" }
40  },
41
42  // This starter deploys Cloudflare Access mode. Cloudflare OS also supports built-in password
43  // accounts and auth Gatekeeper sign-in; see the reference below before switching. The audience
44  // comes from the self-hosted Access application protecting the public hostname.
45  // "admins" gates /admin in every sign-in method.
46  // Reference: docs/customization.md#sign-in-methods
47  "access": {
48    "issuer": "https://<TEAM_NAME>.cloudflareaccess.com",
49    "audience": "<ACCESS_AUDIENCE>",
50    "admins": ["<ADMIN_EMAIL>"]
51  },
52
53  // Public core integration. Enable only in deployment.local.jsonc after review.
54  // See docs/core-integration.md for Access path policies and event subscription setup.
55  "core": {
56    "enabled": false,
57    "workerName": "<CORE_WORKER_NAME>",
58    "hostname": "<CORE_HOSTNAME>",
59    "mcpPath": "/mcp",
60    "project": "<PROJECT_SLUG>",
61    "artifactsNamespace": "<ARTIFACTS_NAMESPACE>",
62    "oauthKvNamespaceId": null,
63    "pushQueue": "<PUSH_QUEUE_NAME>",
64    // Owner resolves this Queue name to its ID before provisioning the event-only token.
65    "pushQueueId": "<PUSH_QUEUE_ID>",
66    // Optional first-deploy JSON containing OWNER_API_TOKEN_HASH and CF_EVENTS_API_TOKEN.
67    // Set an ignored owner file path locally, e.g. packages/forkhorse-core/.wrangler/deploy-secrets.json.
68    // null uses secrets already installed on the Worker. --check never reads this file.
69    "secretsFile": null,
70    "deadLetterQueue": "<DEAD_LETTER_QUEUE_NAME>",
71    "access": {
72      "issuer": "https://<TEAM_NAME>.cloudflareaccess.com",
73      "audience": "<CORE_ACCESS_AUDIENCE>",
74      "owners": ["<OWNER_EMAIL>"]
75    }
76  },
77
78  // Private GATEKEEPER_FORKHORSE replaces the starter sample in deployment and admin discovery.
79  // Wiring grants no accounts or Git access; each user must connect an enrolled agent.
80  // Set enabled false to omit this vendor entirely. Owner values stay in the local file.
81  "forkhorseGatekeeper": {
82    "enabled": true,
83    "workerName": "<FORKHORSE_GATEKEEPER_WORKER_NAME>"
84  },
85
86  // Model catalog served through Cloudflare AI Gateway. Enabled by default: the Workshop reaches
87  // the gateway over its WORKERS_AI binding, which is pre-authenticated inside your own account,
88  // so no API token is needed.
89  // Reference: docs/customization.md#ai-models
90  "aiGateway": {
91    "enabled": true,
92
93    // Your account's AI Gateway. "default" is the one Cloudflare creates for the account.
94    // Migrating from the hosted deploy? Use the gateway that flow created: "<instance>-ai"
95    // (e.g. "cloudflareos-ai"), named after your instance. See docs/migrate-from-hosted.md.
96    "name": "default",
97
98    // null reuses the top-level accountId. Set only if the gateway lives in another account --
99    // that requires CF_AI_GATEWAY_API_TOKEN, since the binding cannot reach across accounts.
100    "accountId": null,
101
102    // "cloudflare" is Workers AI, which needs no key of your own. anthropic/openai need keys
103    // stored on the gateway; "google" additionally requires CF_AI_GATEWAY_API_TOKEN.
104    "providers": ["cloudflare"]
105  },
106
107  "context": {
108    // Isolates Context data shared by this Workshop deployment.
109    // null scopes it to the public origin
110    "sharingDomain": null,
111
112    // null: Wrangler provisions and remembers a KV namespace on first deploy.
113    // string: bind an existing namespace by ID.
114    "kvNamespaceId": null
115
116    // Optional Git-compatible storage for Context collections. To enable it, add a comma after
117    // kvNamespaceId and uncomment this object. Requires Artifacts account access.
118    // "artifacts": {
119    //   "enabled": true,
120    //   // Optional override; defaults to "gatekeeper-context-collections".
121    //   "namespace": "custom-context-collections"
122    // }
123  },
124
125  // Explicit backend issue reports go to a private Worker that emits structured console errors.
126  // Set release to a commit/version when your deployment pipeline has one.
127  // Reference: docs/observability.md#quick-start
128  "errorReporting": {
129    "enabled": true,
130    "environment": "production",
131    "release": null
132  },
133
134  // null values use Wrangler automatic provisioning. Set IDs/names to reuse owned resources.
135  // https://developers.cloudflare.com/workers/wrangler/configuration/#automatic-provisioning
136  "resources": {
137    "blueprintsKvNamespaceId": null,
138    "avatarsKvNamespaceId": null,
139    "blueprintContentBucket": null
140  },
141
142  // Structured custom logs stay enabled. Invocation logs and traces are separate volume controls.
143  // https://developers.cloudflare.com/workers/observability/logs/workers-logs/
144  "observability": {
145    "enabled": true,
146    "headSamplingRate": 1,
147    "logs": { "invocationLogs": false },
148    "traces": { "enabled": false, "headSamplingRate": 0.1 }
149  }
150}
151