Content,
decentralized
by design.

Install Cloudflare's Workers CLI globally, confirm it is available, then sign in to your Cloudflare account.

$ npm install -g wrangler
$ wrangler --version
$ wrangler login

Grab the source from LionRockJS/worker-cms, then install.

$ git clone https://github.com/LionRockJS/worker-cms.git
$ cd worker-cms
$ npm install

Two isolated stores: cms for private admin data, cms-published for live content only. Copy the printed database_id values into wrangler.toml.

$ npx wrangler d1 create cms
$ npx wrangler d1 create cms-published

Run the first pair locally, then repeat with --remote for production. Locally, npm run db:migrate applies both.

$ npx wrangler d1 migrations apply cms
$ npx wrangler d1 migrations apply cms-published
$ npx wrangler d1 migrations apply cms --remote
$ npx wrangler d1 migrations apply cms-published --remote

The bucket stays private; the Worker serves objects at /media/<key>. The MEDIA_BUCKET binding ships in wrangler.toml.

$ npx wrangler r2 bucket create worker-cms-media
$ npx wrangler queues create cms-admin-jobs

⚠️ The JWT secret must be at least 32 characters — the Worker refuses to serve in production with a weaker key. Create .dev.vars for local dev.

# random 32-byte signing key
$ openssl rand -hex 32 | npx wrangler secret put JWT_SECRET

Pick your gateways in wrangler.toml, then register an OAuth app with each provider to obtain a client ID + client secret. Every provider redirects back to the same callback — your OAUTH_REDIRECT_URI:

# production — must match wrangler.toml exactly
https://<your-domain>/auth/callback
# local dev (.dev.vars)
http://localhost:8787/auth/callback

List the gateways you registered and drop each client ID into wrangler.toml. Set CANONICAL_ORIGIN to your own domain too — the Worker enforces the canonical host and otherwise redirects to its default origin:

[vars]
ENABLED_PROVIDERS = "eventuai,github,google"
GITHUB_CLIENT_ID     = "<github-client-id>"
GOOGLE_CLIENT_ID     = "<google-client-id>"
OAUTH_REDIRECT_URI   = "https://<your-domain>/auth/callback"
CANONICAL_ORIGIN     = "https://<your-domain>"

Then push the matching client secrets as encrypted secrets (never commit them). Run each command and paste the value at the prompt:

$ npx wrangler secret put GITHUB_CLIENT_SECRET
$ npx wrangler secret put GOOGLE_CLIENT_SECRET

Enter secret values only at Wrangler's interactive prompt or from a protected file; do not put them directly in a shell command, wrangler.toml, or source control. Account, database, route, and OAuth client IDs are identifiers rather than bearer secrets.

Your account only exists after you log in. With the app running — locally or on the edge — open /auth/login and sign in once through any provider to create your user row, then promote it. Roles are a comma-separated list.

# production DB — after you signed in on the deployed site
$ npx wrangler d1 execute cms --remote \
    --command "UPDATE users SET role='admin' WHERE email='[email protected]'"

Testing on localhost:8787? Drop --remote to hit the local DB, then sign out and back in so the new role lands in your token.

$ npx wrangler d1 execute cms \
    --command "UPDATE users SET role='admin' WHERE email='[email protected]'"

Publishing defaults to the d1 target. Add r2 for static JSON snapshots in a bucket:

$ npx wrangler r2 bucket create worker-cms-published

# wrangler.toml — bind the bucket, then enable the target
[[r2_buckets]]
binding = "PUBLISH_BUCKET"
bucket_name = "worker-cms-published"

[vars]
PUBLISH_TARGETS = "d1,r2"

For everything else, publish targets are plugin Workers. Two are ready to deploy — plugin-publish-ipfs (pins pages to IPFS via Pinata) and plugin-publish-webhook (HMAC-signed webhooks for search indexers, rebuilds, deploy hooks) — or write your own: any Worker whose manifest declares publishTarget: true.

# 1 · deploy the plugin Worker and note its URL
$ git clone https://github.com/zeroxcms/plugin-publish-ipfs && cd plugin-publish-ipfs
$ npm install && npx wrangler deploy

Then in the CMS admin open /admin/plugins-manage → Register plugin and paste the Worker's URL. No CMS redeploy, no service bindings — the manifest (with publishTarget: true) is auto-discovered over HTTPS. The CMS mints a dedicated secret for that plugin; copy it from Plugins → Edit onto the plugin Worker, then redeploy:

# 2 · paste the per-plugin secret shown in Admin → Plugins → Edit
$ npx wrangler secret put PLUGIN_SECRET
$ npx wrangler deploy

Plugins are trusted application code. Proxied plugin pages and explicitly approved JavaScript run on the CMS origin, so review a plugin's source, grant only required page-type scopes, and rotate its dedicated secret if compromised.