Configuration

Config has three layers (highest wins in practice for production):

1. Cloudflare Worker bindings / vars / secrets
2. wrangler.toml [vars] and [[d1_databases]] / [[r2_buckets]]
3. Nuxt runtimeConfig / local .env (local fallback)

Cloud resources you must create

Resource	Binding	Purpose
D1	DB	Metadata, users, sessions, settings
R2	BUCKET	File blobs

Without both, the app boots but upload/admin APIs return 503.

wrangler.toml vars

Var	Meaning
R2_PUBLIC_BASE_URL	R2 public root URL, no trailing slash
MAX_UPLOAD_BYTES	Max size for images and other files, default 20971520 (20MB)
MAX_VIDEO_UPLOAD_BYTES	Max video size, default 52428800 (50MB)
STORAGE_QUOTA_BYTES	Storage quota for the status usage %. Default 10737418240 (10GB, R2 free tier); 0 hides the percentage

Optional secrets / vars (see code comments):

Var	Meaning
BOOTSTRAP_ADMIN_USER / BOOTSTRAP_ADMIN_PASS	Optional env-assisted first admin
RESET_KEY	Reserved ops hook if implemented
CLOUDFLARE_API_TOKEN	Local/CI CLI only — do not put in production Worker vars or Git

Nuxt runtimeConfig

See root nuxt.config.ts:

Key	Meaning
r2PublicBaseUrl	Local fallback public base
maxUploadBytes	Local fallback size limit for images and other files
maxVideoUploadBytes	Local fallback video size limit
storageQuotaBytes	Local fallback storage quota (default 10GB)
corsOrigins	Comma-separated; empty echoes request Origin (handy for PicGo)
public.siteName	Site name
public.maxUploadMb	Client-facing limit in MB for images and other files
public.maxVideoUploadMb	Client-facing video limit in MB

Local .env overrides example:

# .env — local only; do not commit
NUXT_R2_PUBLIC_BASE_URL=https://pub-xxxx.r2.dev
NUXT_MAX_UPLOAD_BYTES=20971520

.env vs production

Scenario	Need .env?
pnpm dev	Optional
Manual Cloudflare deploy	No
GitHub Actions Worker deploy	Use Secrets, not a committed .env

Always treat Dashboard / wrangler.toml as source of truth in production.

CORS

Upload endpoints support CORS. Empty corsOrigins echoes Origin; tighten to an allowlist in production. Credentialed cross-origin clients must also handle cookies correctly.