Host the Crunu server on Cloudflare Workers and D1

What Crunu does on Cloudflare

Crunu runs in the cloud at app.crunu.com, so you don't need to deploy anything to start. If you want your own server without managing a machine, the Crunu server has a build for Cloudflare Workers that stores its data in D1.

The server is blind on Workers as everywhere else: D1 holds ciphertext, public keys, signed documents and metadata, never a key that decrypts a value.

Deploy

You need Node.js 24, wrangler with wrangler login done, and a .env file created by server-init. The commands run from the Crunu server's directory, where the deploy scripts live.

node scripts/server-init.mjs --origin https://vault.company.example
sh deploy/cloudflare/deploy.sh --name vault-company --location weur

The script checks .env with the same code the server uses at startup, builds the Worker, creates the D1 database vault-company-db if it doesn't exist, and deploys the Worker together with its secrets as one version. Code and keys change at the same moment, and if the deploy fails, nothing on the Worker changes. Schema migrations run on the first request.

To build and inspect what would be deployed without deploying it, add --build-only. The script prints the build fingerprint and the names of the secrets it would send, then stops. The build is reproducible, so running the same command without the flag deploys exactly what you inspected.

Attach your own domain to the Worker in the Cloudflare dashboard and use it as the server's PUBLIC_ORIGIN. Cleanup of expired sessions and audit log trimming runs on a cron trigger every 5 minutes.

Choose the right plan

Settings to check after deploying

• Compression on API responses. The Worker answers /v2/* uncompressed, so response sizes give nothing away. Run doctor against your domain. If it reports compression, add a Compression Rule that disables compression for paths starting with /v2/.
• Preview URLs. Every uploaded Worker version can have its own workers.dev address that works with the same database and secrets. Crunu's template turns preview URLs off, and the deploy script turns them off for the Worker's older versions too. Don't turn them back on.
• Pseudo IPv4. For network restrictions, keep the zone's Pseudo IPv4 setting off or set to Add header. In Overwrite headers mode, IPv6 clients appear under substitute addresses and won't match IPv6 rules.

node scripts/doctor.mjs https://vault.company.example

Cloudflare Tunnel for your own machine

If you'd rather run the server on your own machine, Cloudflare Tunnel publishes it without open ports. That setup is part of the Docker integration.

Cloudflare secrets for your own apps

Crunu has no built-in sync into Cloudflare secrets. If a Worker of yours keeps its values in Cloudflare, a pipeline can push them with Cloudflare's own CLI running under crunu run, using a production token bound to main and the production deployment environment with OIDC. Each run appears in Crunu's audit log. The Vercel page shows the pattern with a concrete command.

Related

• Self-hosting
• Cloudflare Workers in the docs
• Move between platforms
• GitHub Actions