worker-deployment

name	worker-deployment
description	Use when deploying or updating the worker on Cloudflare and validating production health and auth behavior

Deploying the Pigeon Worker

When To Use

Use this skill when releasing worker changes or validating production deploy safety.

Prereqs

• Repo: ~/projects/pigeon
• Package: packages/worker
• Cloudflare token in env (CLOUDFLARE_API_TOKEN)

On devbox, prefer:

export CLOUDFLARE_API_TOKEN="$(cat /run/secrets/cloudflare_api_token)"

Deploy

cd ~/projects/pigeon
npm run --workspace @pigeon/worker deploy

R2 Bucket

The worker requires an R2 bucket named pigeon-media for media relay. This is a one-time setup:

npx wrangler r2 bucket create pigeon-media

The binding is configured in wrangler.toml:

[[r2_buckets]]
binding = "MEDIA"
bucket_name = "pigeon-media"

If the bucket doesn't exist, deploy will succeed but media upload/download will fail at runtime.

D1 Database

The worker uses D1 (Cloudflare's serverless SQLite) for state. The database pigeon-router is configured in wrangler.toml.

Schema is at packages/worker/src/d1-schema.sql. To apply schema changes:

npx wrangler d1 execute pigeon-router --remote --file=packages/worker/src/d1-schema.sql

To inspect production data:

npx wrangler d1 execute pigeon-router --remote --command "SELECT * FROM machines"

Validate Deployment

curl -s https://ccr-router.jonathan-mohrbacher.workers.dev/health

Expected: ok

Secret-driven Auth Checks

curl -s -H "Authorization: Bearer $(cat /run/secrets/ccr_api_key)" \
  "https://ccr-router.jonathan-mohrbacher.workers.dev/sessions"

Telegram Webhook Check

Note: TELEGRAM_WEBHOOK_SECRET is a worker-only Cloudflare secret, not in sops. Set it manually: export TELEGRAM_WEBHOOK_SECRET="<value>" before running.

curl -s -o /tmp/webhook-auth-check.txt -w "%{http_code}" \
  -X POST \
  -H "Content-Type: application/json" \
  -H "X-Telegram-Bot-Api-Secret-Token: $TELEGRAM_WEBHOOK_SECRET" \
  "https://ccr-router.jonathan-mohrbacher.workers.dev/webhook/telegram/parity" \
  --data '{"update_id":999999001}'

Expected: HTTP 200.

Verify

Run these in order:

curl -s https://ccr-router.jonathan-mohrbacher.workers.dev/health
curl -s -o /tmp/deploy_sessions.json -w "%{http_code}" -H "Authorization: Bearer $(cat /run/secrets/ccr_api_key)" "https://ccr-router.jonathan-mohrbacher.workers.dev/sessions"

Expected:

• health returns ok
• authenticated /sessions returns HTTP 200

Also verify the cron trigger is active (visible in deploy output as schedule: 0 * * * *). This runs hourly R2 media cleanup.