Rotimi Best
367ddcddd7
Serve widgets from short public URLs via tenant-router with R2-backed assets and runtime API_URL injection, so copy-paste snippets hide infra paths. Update widget payloads, CSP, upload purge URLs, and dev-only API inject; document format/stage workflow in AGENTS.md and fix ui-prefix-check YAML syntax.
45 lines
1.8 KiB
TOML
45 lines
1.8 KiB
TOML
name = "cio-tenant-router"
|
|
main = "src/index.ts"
|
|
compatibility_date = "2026-05-01"
|
|
|
|
# Production routes — bind the Worker to every browser-facing host.
|
|
# Tenant subdomains and the apex live on the `myclassroomio.com` zone.
|
|
# The admin app `app.classroomio.com` is routed through the Worker so
|
|
# it can use same-origin `/api/*` paths with host-only auth cookies.
|
|
routes = [
|
|
{ pattern = "*.myclassroomio.com/*", zone_name = "myclassroomio.com" },
|
|
{ pattern = "myclassroomio.com/*", zone_name = "myclassroomio.com" },
|
|
{ pattern = "app.classroomio.com/*", zone_name = "classroomio.com" },
|
|
{ pattern = "embed.classroomio.com/*", zone_name = "classroomio.com" }
|
|
]
|
|
|
|
# Override per environment. Both values are the `.onrender.com` hostnames
|
|
# of the dashboard and API services (no scheme, no path).
|
|
[vars]
|
|
# Despite the name, `cio-api.onrender.com` is the **dashboard** service
|
|
# (apps/dashboard). The actual API service is `cio-api-vymh.onrender.com`.
|
|
DASHBOARD_UPSTREAM_HOST = "cio-api.onrender.com"
|
|
API_UPSTREAM_HOST = "cio-api-vymh.onrender.com"
|
|
APEX_REDIRECT_TARGET = "https://classroomio.com"
|
|
EMBED_HOST = "embed.classroomio.com"
|
|
API_URL = "https://api.classroomio.com"
|
|
|
|
# R2 bucket binding so /hls/* can stream segments directly from Cloudflare,
|
|
# bypassing Render. The bucket name matches the storage config in
|
|
# packages/agent-runtime/src/config/storage.ts (BUCKET_DEFAULTS.VIDEOS).
|
|
[[r2_buckets]]
|
|
binding = "VIDEOS_BUCKET"
|
|
bucket_name = "videos"
|
|
|
|
# Public embed scripts (course-widget, question-type-picker) uploaded by apps/embeds.
|
|
[[r2_buckets]]
|
|
binding = "ASSETS_BUCKET"
|
|
bucket_name = "assets"
|
|
|
|
# HLS_SIGNING_SECRET is set via `wrangler secret put HLS_SIGNING_SECRET` —
|
|
# never commit it. The same value must be set as HLS_SIGNING_SECRET on the
|
|
# API (Render env) so the cookie minted by the API verifies on the Worker.
|
|
|
|
[observability]
|
|
enabled = true
|