| 1 | # Account service for reasonix.io — email/password auth, sessions, profiles. |
| 2 | # First deploy: |
| 3 | # wrangler d1 create reasonix-accounts # paste database_id below |
| 4 | # wrangler d1 migrations apply reasonix-accounts --remote |
| 5 | # wrangler secret put SESSION_PEPPER # any long random string |
| 6 | # wrangler secret put RESEND_API_KEY # only if EMAIL_PROVIDER=resend |
| 7 | # wrangler deploy |
| 8 | name = "reasonix-accounts" |
| 9 | main = "src/index.ts" |
| 10 | compatibility_date = "2026-06-01" |
| 11 | |
| 12 | routes = [{ pattern = "id.reasonix.io", custom_domain = true }] |
| 13 | |
| 14 | [vars] |
| 15 | # Where the web frontend lives — used for pages and post-action redirects. |
| 16 | APP_ORIGIN = "https://reasonix.io" |
| 17 | # Canonical public origin of this Worker — used for backend email actions. |
| 18 | # Override with http://localhost:8787 in .dev.vars when exercising email flows locally. |
| 19 | ACCOUNT_ORIGIN = "https://id.reasonix.io" |
| 20 | # Browsers that may call this API with credentials (comma-separated). |
| 21 | ALLOWED_ORIGINS = "https://reasonix.io,https://www.reasonix.io" |
| 22 | # Cookie scope. ".reasonix.io" lets the apex + any subdomain (and the future CLI) |
| 23 | # share the session. Leave empty for host-only (local dev). |
| 24 | COOKIE_DOMAIN = ".reasonix.io" |
| 25 | # "stub" logs email links to the worker console (local dev); "resend" sends real |
| 26 | # mail via RESEND_API_KEY. |
| 27 | EMAIL_PROVIDER = "resend" |
| 28 | # From-domain must match a verified Resend domain — send.reasonix.io is verified |
| 29 | # (DKIM), the apex is not, and Resend rejects sends from an unverified domain. |
| 30 | MAIL_FROM = "Reasonix <no-reply@send.reasonix.io>" |
| 31 | # Comma-separated emails minted as admins on first sign-up. |
| 32 | ADMIN_EMAILS = "" |
| 33 | |
| 34 | [[d1_databases]] |
| 35 | binding = "DB" |
| 36 | database_name = "reasonix-accounts" |
| 37 | database_id = "bae20011-a6fe-4fad-ae61-a3aaac605e0c" |
| 38 | migrations_dir = "migrations" |
| 39 | |
| 40 | # Per-IP throttle for the sensitive auth endpoints (login/register/forgot/reset). |
| 41 | [[unsafe.bindings]] |
| 42 | name = "AUTH_LIMITER" |
| 43 | type = "ratelimit" |
| 44 | namespace_id = "2001" |
| 45 | simple = { limit = 10, period = 60 } |
| 46 |