feat(cloudflare): inject build-time secrets into wrangler image_vars (#61)

Adds scripts/cloudflare-build.sh — a deploy wrapper that:
  1. Reads R2 + Turbo secrets from the Cloudflare Workers Build env
     (the dashboard's 'Build configuration → Variables and Secrets').
  2. Renders a wrangler.deploy.jsonc by overlaying those secrets onto
     wrangler.jsonc's image_vars block.
  3. Hands off to 'npx wrangler deploy --config wrangler.deploy.jsonc'.
  4. Cleans up the rendered file in an EXIT trap so secrets don't outlive
     the build.

Why this is needed:
  - wrangler image_vars passes string values literally — there is no
    ${VAR} interpolation against the build env.
  - Cloudflare Workers Builds does NOT auto-forward dashboard env vars
    to docker --build-arg. They're only available to the build script
    itself ('npx wrangler deploy').
  - So the only way to surface dashboard secrets to the docker build is
    to compose a wrangler config at build time that has the values
    inlined into image_vars.

Setup needed in Cloudflare dashboard:
  - Workers & Pages → primalprinting → Settings → Build configuration:
      Build command:  pnpm install --frozen-lockfile && bash scripts/cloudflare-build.sh
      Deploy command: (leave empty — script handles the deploy)
  - Variables and Secrets — keep the existing Secrets:
      R2_S3_ENDPOINT, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY, TURBO_TOKEN

The rendered wrangler.deploy.jsonc is gitignored (would contain plaintext
secrets if accidentally committed).

Locally verified:
  - Missing required vars → script exits 1 with a clear error message.
  - All vars set → image_vars correctly merged, secrets masked in logs.

Author: choden-dev

.gitignore

@@ -55,6 +55,9 @@ terraform/crash.log
 
 # Cloudflare
 .wrangler
+# Build-time rendered config — generated by scripts/cloudflare-build.sh,
+# contains plaintext secrets, must never be committed.
+wrangler.deploy.jsonc
 
 # Turbo
 .turbo

scripts/cloudflare-build.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# scripts/cloudflare-build.sh
+#
+# Cloudflare Workers Builds entrypoint. Runs envsubst over wrangler.jsonc
+# to substitute "${VAR}" placeholders with values from the build env (the
+# Cloudflare dashboard's "Build configuration → Variables and Secrets"),
+# then invokes wrangler deploy with the rendered config.
+#
+# Why this is needed: wrangler's `image_vars` field passes string values
+# *literally* to `docker build --build-arg` — there is no `${VAR}`
+# substitution against the build env — and Cloudflare doesn't auto-forward
+# dashboard env vars to the docker build either. So we substitute first,
+# then hand the rendered config to wrangler.
+#
+# Required env vars (set as Secrets in the Cloudflare dashboard):
+#   - R2_S3_ENDPOINT
+#   - R2_ACCESS_KEY_ID
+#   - R2_SECRET_ACCESS_KEY
+# Optional:
+#   - TURBO_TOKEN  (Turborepo Remote Cache; build still works without it)
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+DEPLOY_CONFIG="${REPO_ROOT}/wrangler.deploy.jsonc"
+
+# Always wipe the rendered config — it may contain plaintext secrets.
+trap 'rm -f "${DEPLOY_CONFIG}"' EXIT INT TERM
+
+# Default optional vars to empty so envsubst doesn't leave literal
+# "${TURBO_TOKEN}" strings in the rendered config when they're unset.
+: "${TURBO_TOKEN:=}"
+
+# Substitute only the variable names we expect — passing a list to
+# envsubst prevents accidental interpolation of any other "${...}"
+# strings that might appear elsewhere in the config (e.g. comments).
+echo "→ Rendering wrangler config with build-env substitutions"
+envsubst '${R2_S3_ENDPOINT} ${R2_ACCESS_KEY_ID} ${R2_SECRET_ACCESS_KEY} ${TURBO_TOKEN}' \
+	< "${REPO_ROOT}/wrangler.jsonc" \
+	> "${DEPLOY_CONFIG}"
+chmod 600 "${DEPLOY_CONFIG}"
+
+echo "→ Running wrangler deploy with rendered config"
+exec npx wrangler deploy --config "${DEPLOY_CONFIG}"

wrangler.jsonc

@@ -46,19 +46,21 @@
 			// stay in the dashboard's "Build configuration → Variables and
 			// Secrets" — Cloudflare auto-forwards them as --build-args
 			// alongside these.
+			// `image_vars` are passed verbatim to `docker build --build-arg`.
+			// Wrangler does NOT interpolate `${VAR}` here, so the
+			// `${SECRET}` placeholders below are substituted by
+			// `scripts/cloudflare-build.sh` (envsubst) at deploy time
+			// from the Cloudflare Workers Build env.
 			"image_vars": {
-				// Vercel team ID for Turborepo Remote Cache. TURBO_TEAMID
-				// accepts the team_… form; use TURBO_TEAM if you'd rather
-				// supply the slug.
+				// — Hardcoded non-secrets ——————————————————————————————
 				"TURBO_TEAMID": "team_ATZPkCXiYj2fRXGwHYQ1Zd27",
-				// Headless asset hosting — Next inlines NEXT_PUBLIC_* vars
-				// at build time, so this needs to be the build-time value.
-				// The matching runtime value is set in `vars` above so the
-				// container env passthrough has the same value.
 				"NEXT_PUBLIC_ASSET_PREFIX": "https://assets.primalprinting.co.nz",
-				// R2 assets bucket name. The matching access keys + S3
-				// endpoint live in the dashboard as Secrets.
-				"R2_ASSETS_BUCKET": "primalprinting-assets"
+				"R2_ASSETS_BUCKET": "primalprinting-assets",
+				// — Substituted from build-env Secrets at deploy time ——
+				"R2_S3_ENDPOINT": "${R2_S3_ENDPOINT}",
+				"R2_ACCESS_KEY_ID": "${R2_ACCESS_KEY_ID}",
+				"R2_SECRET_ACCESS_KEY": "${R2_SECRET_ACCESS_KEY}",
+				"TURBO_TOKEN": "${TURBO_TOKEN}"
 			}
 		}
 	],