Rotimi Best
d5b07d356e
New features: - HLS video encoding/streaming (hls routes, hls-encoder) and a media transcripts pipeline (transcripts route + media-transcript queries) - AI assistant chat vs. run model: agent-course-generation worker/queue, run-monitor pane, chat-changes card, content ask-ai bar - Per-theme course-page previews across org landing-page themes (bold, classic, corporate, editorial, etc.) with a shared course token/component set - View-as-student mode and login-link / link-invite invite flows Refactor: - Extract packages/core consolidating config (env, storage, dashboard-url), services and utils previously duplicated under apps/api/src/config - Remove legacy agent service modules (chat-tools, chat-context, context-window, document, fetch-url, lesson-content) - Relax Cross-Origin-Resource-Policy to allow cross-origin media embedding - Add format script to tenant-router so turbo run format covers it
65 lines
3.1 KiB
Markdown
65 lines
3.1 KiB
Markdown
# @cio/tenant-router
|
|
|
|
Cloudflare Worker that fronts every browser-facing ClassroomIO host:
|
|
|
|
- `*.myclassroomio.com/*` — free-tier tenant sites
|
|
- `myclassroomio.com/*` — apex (301 → `classroomio.com`)
|
|
- `app.classroomio.com/*` — admin dashboard
|
|
- BYOD customer domains via Approximated (their proxy forwards to `cio-api.onrender.com` directly, not through this Worker)
|
|
|
|
The Worker forwards each request to one of two Render services based on path:
|
|
|
|
| Path | Upstream |
|
|
| ------------- | ------------------------------------------------------------ |
|
|
| `/proxy/*` | API service (`/proxy` prefix stripped, rest forwarded as-is) |
|
|
| anything else | Dashboard service |
|
|
|
|
The `/proxy` prefix is the same-origin escape hatch the dashboard's
|
|
browser code uses so its auth cookies stay host-only while still reaching
|
|
the API. Example: a browser request to
|
|
`https://app.classroomio.com/proxy/api/auth/sign-in/email` becomes
|
|
`/api/auth/sign-in/email` on the API service (where Better Auth lives).
|
|
|
|
It preserves the original host as `X-Forwarded-Host` so:
|
|
|
|
- The dashboard's SvelteKit adapter-node reads it via `HOST_HEADER=x-forwarded-host` and `event.url.host` becomes the tenant/admin/BYOD host.
|
|
- Better Auth on the API emits session cookies without a `Domain` attribute (see `packages/db/src/auth.ts` — `crossSubDomainCookies: { enabled: false }`), so the browser scopes each session to the exact host it called. Tenants on `acme.myclassroomio.com`, the admin app on `app.classroomio.com`, and BYOD `learn.acme.com` each get host-only sessions.
|
|
|
|
## Deploy
|
|
|
|
```bash
|
|
pnpm --filter @cio/tenant-router deploy
|
|
```
|
|
|
|
Live tail:
|
|
|
|
```bash
|
|
pnpm --filter @cio/tenant-router tail
|
|
```
|
|
|
|
## Env vars (wrangler.toml `[vars]`)
|
|
|
|
| Var | Value |
|
|
| ------------------------- | ------------------------------------------------------------------------------- |
|
|
| `DASHBOARD_UPSTREAM_HOST` | `.onrender.com` host of the dashboard service (no scheme) |
|
|
| `API_UPSTREAM_HOST` | `.onrender.com` host of the API service |
|
|
| `APEX_REDIRECT_TARGET` | URL to redirect `myclassroomio.com` apex to (default `https://classroomio.com`) |
|
|
|
|
Update the values in `wrangler.toml` after looking them up in the Render dashboard.
|
|
|
|
## Cloudflare DNS expected setup
|
|
|
|
`myclassroomio.com` zone:
|
|
|
|
- `*` CNAME → any valid target, **Proxied**
|
|
- `@` CNAME → any valid target, **Proxied** (Worker serves the 301)
|
|
|
|
`classroomio.com` zone:
|
|
|
|
- `app` CNAME → **Proxied** so the route binds
|
|
- `api` CNAME → **DNS only** (server-to-server callers and webhooks bypass the Worker)
|
|
|
|
## BYOD custom domains
|
|
|
|
Handled by [Approximated](https://approximated.app/), not this Worker. Cloudflare for SaaS can't front a Render origin (Render itself runs on Cloudflare), so we use Approximated's dedicated edge cluster instead. See `apps/api/src/services/org/domain.ts` for the integration. Customers point an A record at the IP Approximated returns; the proxy forwards directly to `cio-api.onrender.com`.
|