# Cloudflare

The `org/cloudflare/` Terraform root manages the ` stormtrust.net` zone, stable Worker identities, and durable storage. Its state uses the ` stormtrust/cloudflare.tfstate` key in Cloudflare R2.

Application directories contain Wrangler configuration. Wrangler owns code, assets, bindings, deployments, custom domains, routes, and deploy-time observability.

## Deployment order

The trusted `main` workflow applies Terraform before it runs Wrangler. This order creates durable resources before an application references them.

Cloudflare jobs receive the Cloudflare token. They do not receive the GitHub organization provider token.

## Cloudflare topics

| Intent      | Start here                                                                        |
| ----------- | --------------------------------------------------------------------------------- |
| Tutorial    | [Build your first Worker](/stormtrust/engineering/operations/first-worker/)       |
| How-to      | [Catalog and connect an app](/stormtrust/engineering/operations/catalog-app/)     |
| How-to      | [Deploy a change](/stormtrust/engineering/operations/deploy/)                     |
| How-to      | [Recover a release](/stormtrust/engineering/operations/recover/)                  |
| Explanation | [Terraform and Wrangler ownership](/stormtrust/engineering/cloudflare/ownership/) |
| Reference   | [State and drift](/stormtrust/engineering/cloudflare/state-and-drift/)            |

## All pages

- [Terraform and Wrangler ownership](/stormtrust/engineering/cloudflare/ownership/)
- [State and drift](/stormtrust/engineering/cloudflare/state-and-drift/)