guerz.lol Cloudflare 0$ Roadmap

🧠 Prime directive: GitHub remains the source of truth. Build and test on a Worker staging URL first. Do not change live DNS because a dashboard button looked lonely.

Progress, not perfection

0 of 0 tasks done · 0%

Saved in this browser using localStorage. Export a backup before clearing browser data or summoning a new laptop.

Right now

Click Pick my next task so the roadmap stops staring at you.

Import progress

0$ targeteasy confidence taskmedium build taskspicy production riskEvery phase has a done-means-done exit ramp

Do Not Accidentally Break DNS

45–90 minutes · 0$ · low risk

foundations

Before building anything, take inventory. “Cloudflare DNS/proxy exists” and “GuerzBook Worker exists” are discovery claims to verify—not assumptions to click through.

Open Cloudflare and confirm guerz.lol is the active zone.Just confirm. No edits yet.P0.1

Export or screenshot every current DNS record.Save it in your Cloudflare Lab Log or project folder.P0.2

Locate the existing guestbook Worker and Formspree path.Write down routes, bindings, and secrets by name—never their values.P0.3

Create an Obsidian note named Cloudflare Lab Log.Use it for what changed, proof, rollback, and what you learned.P0.4

Confirm whether Cloudflare Web Analytics is already collecting data.Do not add tracker number two just to feel productive.P0.5

Create the Parallel Universe

1–2 sessions · 0$ · low risk

staging

The live GitHub Pages site stays untouched. Make a branch and deploy a Cloudflare Worker version to a separate workers.dev address. This is your sandbox, not your replacement yet.

Copy-ready terminal setup

cd ~/path/to/your/repository
git switch main
git pull origin main
git tag pre-cloudflare-workers-migration
git push origin pre-cloudflare-workers-migration
git switch -c feat/cloudflare-workers-staging
git push -u origin feat/cloudflare-workers-staging

Create and push feat/cloudflare-workers-staging.All early hosting work stays here.P1.1

Create a Cloudflare Worker project with static assets.Choose static assets. Skip database/AI bindings for now.P1.2

Deploy the first ugly staging version to workers.dev.Ugly but reachable counts. Gorgeous but imaginary does not.P1.3

Make the Worker serve existing static site assets.Keep plain HTML/CSS/JS. This is not a React conversion ritual.P1.4

Test homepage, CSS, JS, theme, routes, sitemap, robots, and fake 404.Use a private window so cache does not lie to you.P1.5

Done means doneA Workers URL displays a working clone while guerz.lol still runs from GitHub Pages.

Let GitHub Push the Big Red Button

1 session · 0$ · low risk

CI/CD

GitHub remains home base. Cloudflare deploys what you commit. The goal: edit locally → commit → push branch → preview deploy → verify.

Connect only the relevant GitHub repository to Workers Builds.Least access first. No need to hand over every repository.P2.1

Configure root directory, build command, and deploy command.Document values in your Lab Log.P2.2

Push one harmless change and watch it build/deploy.A README punctuation fix is respectable proof.P2.3

Write a six-line deploy ritual in the repo README.So Future Nicholas does not need to re-learn setup at 1 AM.P2.4

Check staging in Safari, Firefox, Chrome, and on a phone.Safari is not optional DLC on your Mac.P2.5

Fix GuerzBook’s Split-Brain Situation

1–2 weekends · security-sensitive

D1 + Turnstile

Replace “maybe it went somewhere” with one source of truth: a Cloudflare storage layer plus a protected API. D1 fits a moderated guestbook; only approved entries should ever be public.

Pick storage once, then stop reopening the decision

KV: fastest/simple wall, best if you want it shipped immediately.
D1: SQLite tables, better for moderation, replies, filters, and database practice.
Recommendation: D1—useful full-stack practice and a natural fit for structured guestbook entries.

Read the existing Worker before replacing anything.Find storage, CORS rules, and why Formspree exists.P3.1

Create a staging D1 database and tiny guestbook_entries table.Fields: id, name, message, created_at, status. Skip emails unless genuinely needed.P3.2

Make GET /api/guestbook return published entries only.Never leak pending/moderation/admin fields.P3.3

Make POST /api/guestbook validate input server-side.Validate lengths, required fields, content type, and malformed JSON.P3.4

Add Turnstile and verify its token inside the Worker through Siteverify.Site key in frontend; secret key in Worker secrets—never Git.P3.5

Add server-side rate limiting for POST /api/guestbook.Use a documented Worker protection layer. Test normal use, bursts, and rejection.P3.6

Run the abuse test matrix on staging.Empty, huge, HTML/script-like, malformed JSON, bad token, cross-origin, and burst submissions.P3.7

Retire Formspree only after a successful test week.Keep it notification-only temporarily if that makes the switch less scary.P3.8

Move Production Without the Jump Scare

one calm evening · spicy production risk

production

Production migration comes after parity, not vibes. Attach the custom domain only when the staging site passes and rollback exists in writing.

Create a production pre-flight checklist in your Lab Log.Include assets, 404, GuerzBook, robots, sitemap, metadata, Safari, CORS, and rollback.P4.1

Deploy to staging.guerz.lol or equivalent first if available.Keep guerz.lol on GitHub Pages until staging behaves.P4.2

Write rollback steps before routing the custom domain.“I’ll figure it out” is not a rollback plan.P4.3

Confirm secrets are not in Git, HTML, build output, or browser responses.Rotate accidentally exposed secrets; deleting a line is not enough.P4.4

Attach guerz.lol to the Worker only when calm, fed, and un-rushed.Then test a private window and phone connection.P4.5

Run curl checks for homepage, robots, sitemap, API, and missing page.Save output/screenshots as proof.P4.6

Keep GitHub Pages setup documented for 30 days.Rollback capability is adult supervision.P4.7

Done means doneguerz.lol serves from Workers, GitHub deploys it, users see no drama, and rollback remains possible.

R2 + Browser Rendering Fun Lab

2–4 weekends · cached outputs only

fun stuff

Generate assets with a headless browser, store them in R2, and reuse them. Do not render a browser for every visitor request—the free browser budget is a scheduled-job snack, not an open bar.

Create R2 bucket guerz-site-assets.Use prefixes og/, screenshots/, pdf/, inventory/.P5.1

Create a 1200×630 homepage OG-card route/template.Make it graphic and readable at tiny preview size.P5.2

Use Browser Rendering once to screenshot that route.Test screenshot before automation.P5.3

Store image in R2 under a stable name.Example: og/home-v1.png.P5.4

Use absolute image URL in Open Graph metadata.Verify it resolves in a private tab.P5.5

Add one weekly Cron Trigger only after checking current limits.One trigger first. Make the budget prove it deserves friends.P5.6

Make Private Tools, Not Secret Public URLs

ongoing · access control

Access

Use a private subdomain and Cloudflare Access when a tool is for you, not the internet. It is a sensible base for inventory, moderation, and learning utilities.

Choose one private subdomain: lab, admin, tools, or inventory.Pick boring and clear. Boring is secure-ish; cute is just cute.P6.1

Create a Cloudflare Access application for that hostname.Use one-time PIN email or GitHub identity for yourself first.P6.2

Test authenticated and unauthenticated access separately.Denied without auth is success, not a bug.P6.3

Build a tiny private Cloudflare Lab dashboard.Static JSON is enough. Do not require a database for version one.P6.4

Pick one next private tool: GuerzBook moderation OR vinyl inventory scratchpad.One. The other goes in Parking Lot.P6.5

AI Dessert, Not AI Dinner

after foundations · bounded experiment

Workers AI

Cloudflare AI is capable, but the site does not need an AI chatbot stapled onto it to prove it is modern. Make one useful workflow feature, then stop and evaluate.

Choose one real AI use case in one sentence.Examples: summarize finished build logs; draft alt text for review; categorize likely guestbook spam.P7.1

Prototype it privately, not on the public homepage.Make it work before making it a feature.P7.2

Set a weekly usage-check habit before expanding it.Free allocation is for experiments, not forgetting the meter exists.P7.3

Decide keep, iterate, or kill after ten real uses.Cool once is not a product requirement.P7.4

Pen-test / pressure-test gate

Malformed JSON returns a controlled 4xx response, not a stack trace. Oversized name/message input is rejected server-side. HTML/script-like input displays as text, not executable markup. Missing, invalid, expired/reused, and forged Turnstile tokens fail. Cross-origin requests are not allowed from arbitrary origins. Burst posts slow/fail safely without breaking normal use. Public endpoints expose no secrets, pending entries, or admin data. Rollback instructions were tested from the written note, not memory.

Parking lot: deliberately not next

Snippets not available on Free
Durable Objects: overkill for the current GuerzBook
Queues: wait for real background work
Vector database: not until you have content worth searching
Registrar transfer: separate risk event, do later
React rewrite: absolutely not required for this site

Liner notes: rights, credit, and remix rules

Reuse it noncommercially with credit to Guerz, a link to the original and license, an indication of changes, and the same CC BY‑NC‑SA 4.0 license on publicly shared adaptations. Original reusable HTML/CSS/JS may be released under MIT separately if Guerz chooses.

“Guerz,” its logo, and branding are not licensed for reuse or endorsement. Cloudflare, GitHub, Formspree, and other third-party names/trademarks belong to their owners; their content is not covered here unless explicitly identified.

Primary author, editor, and implementer: Guerz. Research and drafting assistance: Perplexity AI. Educational planning artifact—not a security guarantee.