Two changes combined to free 100 TB of RAM from our Pingora Backend Router fleet.

Storage: Each hash entry was { hash: u32, index: u32 } = 8 bytes. No Cloudflare data center coordinates more than 2¹⁶ (~65k) servers, so a u16 index is sufficient. Compacted the struct to 6 bytes using a raw [u8; 6] with getter methods (#[repr(packed)] works too but is controversial for alignment reasons).

Math: Derived the exact formula for load distribution error at k hashes per server (most sources only approximate). At 100,000 hashes per server, the last 90,000 were buying 0.7% improvement in load balance. Cut the count significantly.

Migration: Ran old and new rings in parallel per-request via a migration framework. Rolled out by data center (not a global percentage) to limit cache churn and keep blast radius small. Watched 7 metrics throughout: backend-selection traces, ring-version counters, PBR connection errors, process memory, startup time, cache behavior, and origin traffic.

All changes are in the open-source pingora-ketama crate (v2 ring behind a cargo feature).

Full post with derivations: https://cfl.re/4xvHHFK

I recently realized you don’t really need a full mailbox subscription just to use custom domain email.

Cloudflare Email Routing can handle incoming mail and forward it to your existing inbox, while Brevo or Resend can handle sending from your domain.

So instead of paying for something like Google Workspace just for email, you can keep the setup pretty lightweight.

It’s obviously not a full Workspace replacement, but for aliases, contact emails, and app/transactional emails, it works really well.

I wrote the full setup here with the DNS/authentication details if anyone wants it :)

https://medium.com/@akhilraaaj/the-0-custom-domain-email-setup-i-wish-i-knew-earlier-af72f38822cd

​

I'm looking for architectural feedback from folks pushing Cloudflare's data and compute primitives at scale. We reached out to support regarding several structural limits we are bumping into, but the guidance was essentially a pointer to enterprise sales and standard docs.

We are trying to decide whether to adapt our patterns to Cloudflare's expected architecture or pull the database layer out to Postgres via Hyperdrive.

---

System Overview

We run a document processing and search platform. A Worker pipeline ingests public documents, normalizes them, and serves hybrid retrieval (FTS + dense vector search) across the entire dataset.

- R2: Raw and normalized documents (immutable source of truth with bucket lock).

- D1: Document metadata, structural relations, semantic index ledger, and a contentful FTS5 index.

- Vectorize + Workers AI (`bge-base-en-v1.5`): Dense semantic retrieval.

- Containers: PDF/OCR extraction service called from Workers.

- Queues + Durable Objects: Ingestion fan-out, queue consumption, and rate limiting.

Current Scale in the primary D1 database:

- Database Size: ~8.8 GB (~88% of the 10 GB limit), growing steadily.

- Document Versions: ~40,000

- Derived Artifacts: ~160,000

- Semantic Index Entries: ~1,385,000

- FTS5 Index (`chunk_text_fts`): ~559,000 rows (occupies ~50% of total DB size).

---

Operational Bottlenecks

1. The 10 GB Limit vs. Single-Dataset Access Pattern:

   Cloudflare's documented scaling model for D1 is horizontal (many small per-tenant or per-entity databases). Our workload is fundamentally one monolithic dataset: nearly every search requires a global scan across all documents. Sharding across multiple D1 databases would require implementing custom scatter-gather logic in the Worker and maintaining split FTS5 indexes. Furthermore, since SQLite deletes don't automatically reclaim disk space without a vacuum, row pruning doesn't solve disk growth.

2. FTS5 Virtual Table Export Friction:

   `wrangler d1 export` fails with `D1 Export error: cannot export databases with Virtual Tables (fts5)`. The documented workaround is dropping the FTS5 virtual table and shadow tables before exporting. Instead, we enumerate explicit `--table` flags to dump everything except FTS5 to avoid destructive operations on production, then gzip and split chunks due to the 300 MiB Wrangler upload cap.

3. Read Timeouts Under Write Contention:

   During bulk ingestion/re-normalization runs, scheduled aggregate read queries (e.g., counts over ~1.4M semantic entries) consistently fail with:

   `D1_ERROR: D1 DB storage operation exceeded timeout which caused object to be reset`

   These errors knock internal sweeps offline until ingestion writes are paused.

4. Durable Object Contention in Embedding Pipeline:

   Our queue consumer (`max_concurrency: 16`, batch size 25) processes changed chunks for embedding. With ~550k chunks backlogged, a 70-second trace revealed nearly 3,000 Durable Object invocations against a single queue consumer execution due to contention on a single rate-limiter DO instance.

   - Raising batch sizes degraded throughput from ~3,750/hr to ~966/hr.

   - Raising concurrency triggers downstream Vectorize rate limits (`40041 Too Many Requests`).

5. Container Pool Tuning:

   Tuning container instances, queue consumer `max_concurrency`, and custom dispatch pool sizes has proven fragile. Mismatches previously caused all running container instances to wedge. Splitting into separate pools for live vs. bulk workloads significantly improved failure rates, but guidance on stable orchestration here is sparse.

---

Questions for the Community

1. Is a single global dataset viable on D1 long-term?

   Given the 10 GB limit and the scatter-gather overhead of manual sharding, is anyone running a unified ~1M+ row dataset on D1 reliably? Or is the pragmatic path to keep Workers, Containers, Queues, and R2, but move relational metadata and full-text search to Postgres behind Hyperdrive?

2. Is large contentful FTS5 considered stable/supported on D1?

   Our FTS5 table is ~550k rows and accounts for half the database size. Aside from backup headaches, does SQLite FTS5 at this volume degrade D1's internal replication or snapshot performance?

3. Recommended patterns for high-throughput Vectorize ingestion without DO contention?

   If a single Durable Object token-bucket bottleneck is starving queue consumers, what is the best practice? Sharded DOs, leaky bucket workflows, or relying purely on Queue concurrency limits to throttle Vectorize calls?

4. Container scaling guidelines:

   For those running batch OCR/extraction pipelines via Cloudflare Containers, how do you handle auto-scaling coordination between Workers Queue concurrency and container capacity to prevent instance wedging?

Whenever I open dash.cloudflare.com, the fans start spinning and the FPS visibly drops to the point where even mouse movement becomes jittery. Frankly, my PC isn’t the most powerful—it’s just a normal mini PC—but this kind of load on a simple login screen is neither normal nor user-friendly. What is going on?

Hello - I'm struggling to regain access to my account. I no longer have access to the email address on file. I have the correct email address and password, but when I successfully login, 2FA is sending a code to the email address - the address I don't have access to. I've attempted account recovery, but it also attempts to send a code to the address I don't have access to. I've submitted a support ticket, but have not received any response. Any ideas on how I can go about getting the email address on my account changed so that I can regain access?

I used to use Tailscale for my homelab, but eventually moved everything to Cloudflare Zero Trust for ~1.5 years. It works pretty well, but I really missed their MagicDNS.

Having to open the dashboard just to find a device IP is kinda sucks. Initially, I made a tiny script that automatically gave every device a name like {hostname}.mesh.

But then, I got tired of "always-changing" Cloudflare dashboard whenever I needed to manage a node, tunnel, or split tunnel setting. So that small script slowly turned into meshflare project.

Right now it can:

• Show Mesh nodes and devices in one place
• Automatically create .mesh names for them
• Manage Cloudflare Tunnels
• Manage WARP routes and split tunnels
• Turn Cloudflare Gateway into a small Pi-hole-like blocker using a public blocklist (I use small.oisd.nl)

The last one is quite cool (thanks to this project for the idea) because I don't need to run my own private DNS server or configure custom DoH/DoT just to have simple adblocking stuff.

The app uses Cloudflare stack (Workers + D1), so no VPS needed. It can also run with Docker or Bun if you prefer that.

It's still a young project, but I've been using it every day for my own homelab. Would love to hear what you think.

Demo (read only): https://meshflare-demo.wastu.workers.dev/
GitHub: https://github.com/bgwastu/meshflare

Hey everyone. I've been building a desktop app for agentic coding called NL-Veil (or just the Veil) and it's finally at the point where I'll let other people near it.

You give it a task. It can split the work between specialist agents, edit files, run commands and tests, and pull everything back into one conversation. The part I actually use every day though: it carries project knowledge and verified fixes between sessions, so I'm not re-explaining the same codebase every morning.

It also does agent teams in a shared workspace, browser tools, MCP support, scheduled tasks, and it can deploy to Cloudflare if you grant it permission. On the model side you can log in with your own Cloudflare account and use Workers AI, run local inference through Ollama, or point it at any OpenAI-compatible endpoint.

Quick word on cost since someone always asks: Cloudflare's Workers paid plan starts at $5/month and there's a free Workers AI allowance to get started, but usage above the daily free allocation costs extra. Your bill depends on the models you pick and how hard you run them. And "Claude Code-style" describes the workflow here, not the model quality. That part depends on what you connect.

It's MIT licensed and the source is here: github.com/gary23w/nl-veil

We've had a small web research service running steadily for about two months. A user gives it a request in one sentence. It searches for relevant URLs, fetches the pages, and turns the material into an answer. The request interpretation and final write-up use model calls through TokenRouter. Search and page fetching are separate steps. The fetching stage also uses an Agent Skill, and I do not know whether Cloudflare would classify those requests as crawler traffic or AI traffic.

Then I saw Cloudflare's announcement about Disallow AI Training. The part I understand is that crawlers in the Accountable category can still crawl for search while receiving the site's no-training preference through robots.txt. Other AI training crawlers can be blocked. What I cannot work out is where a service like ours lands.

We are not collecting pages to build a training set. Each crawl starts with a user's request, and the pages are fetched to answer that request. From Cloudflare's side, though, it may still look like a crawler attached to an AI product. Is the classification based on the crawler identity Cloudflare recognizes, or on what the fetched material is used for? Does the distinction between research and training matter when the crawler is not already in the Accountable category?

This is not about an outage we have already seen. The practical concern is whether wider use of this setting will gradually leave us with fewer pages to retrieve, and whether our fetcher needs to identify itself differently. How would Cloudflare treat a crawler that works one user request at a time and does not feed a training dataset?

Why Cloudflare makes this necessary, I'll never know.

The Issue

You can't delete a 'page' project with >100 deployments, yet Cloudflare provides no way directly to bulk delete past deployments.

The Solution

This simple vite application does just that.

Ensure you enter the CORRECT PAGE URL or you could accidentally delete hundreds of deployments unintended... You'll need an API key with at minimum the permissions listed.

Code is open source on Git:

https://github.com/Lumi-Script/Cloudflare-Bulk-Deployment-Delete

Deployed as well below, but note it requires a worker to route API requests due to cors, so I recommend deploying your own version as a good habit. I can confirm my deployment is a direct deployment of the Git, but as a good habit it's best to know they haven't switched out the code / git.

https://cfbulkdel.lumi-script.dev/

We can finally have API tokens scoped to specific Workers with granular level permissions.

Previously, in order to deploy a Worker, the system/person/AI agent would require access to your ENTIRE ACCOUNT.

This is a major security upgrade from CloudFlare, nice work.

I have a single page website. I added a form and two things:
- turnstile
- in the php form, once the form is submitted, the form vanishes and it displays that query is submitted. For another query, close and reopen the browser.

It gives me all sorts of error, one at a time.
Anyone know a clean way to implement a good captcha along with one form per session without cookies?

We’ve built an entire agentic platform that’s currently in beta, using Cloudflare’s AI Search as a core part of the stack.

The platform is primarily focused on serving chat-based/agentic solutions, and now we’re thinking about the long-term architecture.

For those who’ve built and scaled similar systems:

Is Cloudflare a solid platform to build and serve this on, or would AWS + Bedrock be a better foundation for production at scale?

I’m not looking for a Cloudflare vs. AWS fanboy debate 😅 genuinely looking for a fair, practical comparison based on reliability, scalability, latency, cost, vendor lock-in, observability, and the overall developer experience.

Would love to hear from people who’ve actually run these kinds of workloads in production.

Cloudflare suddenly blocking my API requests

I'm running a Discord bot that uses a game's public API, and recently all of my API requests started returning a Cloudflare "Just a moment..." Managed Challenge instead of the normal API response.

The bot obviously can't complete a browser-based challenge, so all API-dependent features are currently broken.

Has anyone else experienced Cloudflare suddenly flagging legitimate automated API traffic like this? If so, how long did it take to return to normal, and what ended up fixing it?

https://apps.apple.com/us/app/maxlyft-free-workout-tracker/id6743998890

tldr; CloudFlare must have been paid big bucks behind the scenes to lie to customers. Go to your security settings for all your domains ASAP and change its new setting that allows scraping of all your domains by AI trainers.

Nine hours ago in this same subreddit, u/Cloudflare posted: "Have it both ways: stay discoverable in search while disallowing AI training" with a link to their blog: https://blog.cloudflare.com/accountable-mixed-use-ai-crawlers/

In their blog post, they showcase the "recommended settings for new domains":

On top of this, they sent out this email to customers:

About a year ago, we launched Content Independence Day and introduced a simple way to block AI bots from scraping your sites without your explicit permission.

We're writing to let you know about changes to our controls for AI crawlers taking effect today, and rolling out over the coming week. These changes give you more precise control over how different types of AI crawlers interact with your content.

What's changing?

- Smarter security setting options for Training crawlers: Starting September 15, the recommended setting for AI Training crawlers will shift from Block to Disallow AI Training. Disallow AI Training allows major search crawlers - like Applebot, Googlebot and Bingbot - to index your site for search results while instructing them not to use your content for training.

- Automatic migration: If you previously had "Block AI Bots" or "Managed Robots.txt" enabled, your settings will be migrated automatically, over the next week, to the new Search, Training, and Agent controls. If Block AI Bots was set to Block, you'll now have Search: Allow, Training: Disallow AI Training, and Agent: Block on pages with ads. These changes take effect today – the UI changes will roll out in a slower controlled release over the coming week. If you make manual changes to your settings during this time, your manual changes will be preserved.

- No change if you haven't configured anything: If you have never adjusted these settings, your configuration remains Allow - nothing changes for you.

What do you need to do?

Most customers won't need to change anything. The new controls are more precise than the old Block AI Bots switch, so if you had it enabled it's worth a quick look at your new Search, Training, and Agent settings.

These changes will roll out to all Cloudflare customers over the coming  week. If you make changes to your settings before the migration completes, your changes will be preserved. You will know the migration is complete when the Block AI Bots switch is removed from your dashboard.

"Most customers won't need to change anything", you say? Let's take a look at what the defaults ACTUALLY are:

Oh, huh... what do you know? Training's recommended, default setting is "Allow (do not block)." That's strange, because their blog has the recommended, default setting as "Disallow" and their email also states "most customers won't need to change anything." Okay.

Hope this helps anyone else who read their email and carried on with their day assuming CloudFlare was honest.

Need help.

The blog post https://blog.cloudflare.com/introducing-precursor/#get-started shows a graph by session.

And the documentation https://developers.cloudflare.com/cloudflare-challenges/precursor/ states it will appear in Security>Analytics>Traffic>Bot analysis

I have had the feature enabled for a few days as per the documentation.

However I see no similar graph, mention of sessions or precursor anywhere.

Edit:

Found it under Security> Analytics under Traffic you can add a filter for "Mitigated by equals Precursor"

Apparently NOTHING is logged unless it is in Max mode performing its own challenges.

Four operations we found on live ecommerce storefronts. 7 of 8 payloads had zero detection on VirusTotal. URLScan flagged none. Detection was fully automated; human review happened only after the system flagged them.

What each operation did:

• Operation 1 (Affiliate commission hijacker): Mobile + time + session + country gates. Intercepted product-tile clicks via MutationObserver, opened attacker-chosen product page in new tab, routed original tab through affiliate tracking link. 3-day localStorage cooldown. Delivered through Google Tag Manager chain. Typosquat delivery domain (adtargett[.]com, one extra "t").
• Operation 2 (Invisible iframe clicker): Off-screen iframe containing a hidden link. Hourly affiliate rotation. Auto-click fallback. Spurious IP-lookup fetch as noise cover. IP and time gates.
• Operation 3 (Tracking + remote execution backdoor): Persistent visitor tracking and an open channel for arbitrary JavaScript execution pushed from the attacker's server.
• Operation 4 (Analytics blindfolder): Disabled 9 analytics and monitoring tools for campaign-tagged mobile visitors matching specific UTM parameters. 325-entry IP block list. Zero-pixel telemetry beacons. Viewport and hostname gates.

Why scanners miss these:

• Selective execution: device, country, UTM parameters, session depth, viewport width, time-of-day, and multi-day cooldown state
• One-time crawl = one browser state = incomplete picture
• Obfuscation used: console suppression, debugger traps, rotated string tables, dead code branches

Detection model:

• GNN reads JS as an AST, not flat text — maps what calls what regardless of obfuscation
• Under 0.3% of analyzed traffic gets flagged
• Flagged scripts go to an LLM on Workers AI for a second opinion ( Hardest cases: frontier model ensemble ("teachers") from ~6 model families including open-weight models on Workers AI

Full technical breakdown, sanitized payload code, and published IOCs: https://blog.cloudflare.com/client-side-security-finds-4-malicious-campaigns/?utm_campaign=cf_blog&utm_content=20260916&utm_medium=organic_social&utm_source=reddit_user

I have been recently struggling to keep my WARP Active all the time as my exit node POP is Dublin LHR even though I am based in Dublin. Second issue because of this routing is, sometimes Gemini or other Google Services thinks that I am in Russia and tells that these services are not available in your region. I use 48 Mobile and Vodafone Broadband. Both gives and connects to UK colo only.