[MKT-719]:feat/cloudflare workers migration

[jaaaaavier]

What

Ports the website from the PM2 VM to Cloudflare Workers using the
@opennextjs/cloudflare adapter.

This is a pure migration: behaviour is preserved as-is. No SSR→ISR/static
conversions, no cache-control changes, no axios→fetch rewrites.

Nothing is deployed by this PR. cd.yml is untouched, so the VM keeps
serving production and remains the rollback path.

Why

The VM requires manual capacity and patching, has a single point of failure and
no edge presence. On top of that, the in-memory rate limiting and cache we rely
on today are not correct in a multi-process/multi-isolate world (see below).

Adapter and configuration

• @opennextjs/cloudflare 1.20.6 + wrangler 4.131.2 (≥ 4.36.0 is required for
  the Rate Limiting binding).
• wrangler.jsonc: nodejs_compat + global_fetch_strictly_public, the assets
  binding and the five rate limiting namespaces.
• open-next.config.ts uses the default config — no incremental cache, since
  the site is 100% SSR (141 getServerSideProps, 0 getStaticProps).
• check-envs.js no longer requires a .env.local on disk (it does not exist in
  CI/Workers builds) and now warns about variables the code uses but that are
  missing from .env.local.example.
• New scripts: build:cf, preview, deploy:cf, cf-typegen.

In-memory state → Workers primitives

Workers isolates do not share memory, so the previous limits were effectively
N × limit with N unknown, and the cache hit rate was undefined.

• src/utils/rate-limiter.ts → Rate Limiting binding. The signature is unchanged,
  so the 4 consuming endpoints need no edits.
• src/pages/api/contact.ts → CONTACT_LIMITER.
• src/lib/github.ts → memory-cache replaced by the Cache API, same 5 min TTL
  and the same return shape.
• New src/utils/get-client-ip.ts: the client IP now comes from CF-Connecting-IP.
  req.socket.remoteAddress does not exist on Workers, and x-forwarded-for is
  client-writable.

Images

There is no Next.js image optimizer on Workers, so resizing is delegated to
Cloudflare Image Resizing through a custom loader (image-loader.ts, wired up in
next.config.js). The loader is a no-op outside production so local dev is
unaffected. Note that a custom loader ignores remotePatterns — allowed
external origins must be authorised in the Cloudflare dashboard (kept in
next.config.js for the non-Workers build path).

Cookies

src/lib/cookies.ts now derives the secure flag from x-forwarded-proto
instead of letting the cookies library infer it from the socket, which is not
reliable behind the Cloudflare proxy. Falls back to NODE_ENV === 'production'
when the header is absent.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
website	Ready	Preview	Sep 16, 2026 6:59am UTC

[sonarqubecloud]

Quality Gate failed

Failed conditions
0.0% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud