Infrastructure on Start + Void

​

Worker

• Staging candidate: the staging Worker name (workers_dev off, TUTURUUU_NOINDEX=1). A production Worker (tuturuuu-infrastructure, workers_dev and preview_urls off, TUTURUUU_NOINDEX=0) is created by the cutover PR; nothing here attaches a route.
• Entry: apps/infrastructure/cloudflare/worker.ts; Wrangler config is emitted by void into dist.
• Host: infrastructure.tuturuuu.com. Root-only: mountHosts is empty and unknownHost is reject, so tuturuuu.com/infrastructure and any other host answer 404 before app code runs.
• Binding: ASSETS (static output, run_worker_first).
• Variables (names): TUTURUUU_NOINDEX, optional INTERNAL_WEB_API_ORIGIN (default https://tuturuuu.com).
• Secrets (names, set in the Worker, never in the repo): NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY, SUPABASE_SECRET_KEY, TUTURUUU_APP_COORDINATION_SECRET, TUTURUUU_AZURE_TENANT_ID, ENCRYPTION_MASTER_KEY, CRON_SECRET, OPS_HUB_GATEWAY_SECRET, OPS_HUB_WORKER_URL, CHAT_REALTIME_TOKEN_SECRET, AUTH_RECOVERY_HASH_SECRET, GITHUB_TOKEN. Compare with the Vercel project environment list before the flip.
• Other names the source reads (verify each against the Vercel project list before the flip; set only the ones that project defines): FIREBASE_PROJECT_ID, FIREBASE_CLIENT_EMAIL, FIREBASE_PRIVATE_KEY, MODAL_TOKEN_ID, MODAL_TOKEN_SECRET, EMAIL_UNSUBSCRIBE_SECRET, INVENTORY_SIMULATED_ORDER_SECRET, OPS_HUB_ALLOWED_USER_IDS, REQUIRED_MFA_POLICY_ENABLED.
• Known gap: vite.config.mts aliases playwright to a stub that always fails, so only the Zalo web sync reports the browser as unavailable on Workers; every other route is unaffected. The Docker, blue-green, cron-control and stress-test panels read PLATFORM_* host paths and tokens that do not exist on Workers; they report unavailable there. Do not rerun the start-bridge codemod on this app without restoring the playwright alias in vite.config.mts.

​

Build and qualification

bun install --frozen-lockfile --ignore-scripts
bun turbo:local run build --filter=@tuturuuu/infrastructure^... --concurrency=2
bun scripts/ci/generate-build-metadata.ts
bun run --cwd apps/infrastructure routes:check
bun run --cwd apps/infrastructure type-check:cloudflare
bun run --cwd apps/infrastructure build:cloudflare
CI=true CI_SOURCE_SHA=$(git rev-parse HEAD) bun run --cwd apps/infrastructure test:runtime

​

Smoke checks after the route is attached

curl -sI https://infrastructure.tuturuuu.com/api/build-info   # 200, JSON, no-store
curl -sI https://infrastructure.tuturuuu.com/                 # 307 to /login for a signed-out client
curl -sI https://infrastructure.tuturuuu.com/login            # renders, no 5xx
curl -sI https://tuturuuu.com/infrastructure        # 404 (root-only app)

​

Rollback

1. Before the flip, record the current production Vercel deployment id for the app (the repo does not store it) and the DNS records and TTLs for infrastructure.tuturuuu.com in the release record.
2. Roll back by detaching the Worker route or restoring the captured DNS records to the recorded deployment. vercel-production-infrastructure.yaml still deploys the Next app.
3. Rerun the smoke checks against the previous origin.