Deploy on Cloudflare
What of Loams 0.1.1 runs on Cloudflare today, R2 as the engine's bucket for a VM elsewhere, and what is planned, a single-node profile in a Cloudflare Container and apps on Workers.
Loams does not run on Cloudflare in 0.1.1. What you can use today is R2 as the engine's bucket, for a stack that runs on a VM elsewhere or on your own machine. A Cloudflare deployment of the engine itself is planned, as a single node in a Cloudflare Container, labelled preview. This page says what works and what does not, and why.
Why the engine cannot run on Workers
- The engine is a native Rust server with embedded stores that need a local disk with
fsyncand a single writer: the metastore on openraft and redb, Loams Live on redb, Durable on SQLite. A Worker has no disk and no long-lived process. - Loams House runs on chDB today, the embedded ClickHouse library, which is native code inside the
loams-fabricimage. It cannot run in a Worker. Our own Rust engine for the House is designed (design 75), not built, and it is a native server too. - Loams Postgres needs durable disks for its safekeepers. It is out of scope for Cloudflare for now (design 70, D1371).
- Cloudflare Containers have no persistent disk. A container that sleeps restarts on a fresh disk from its image. So a Container can host the engine only as a node that checkpoints its metadata to R2 and states how much it can lose on a crash. That node is designed, not built.
- Cloudflare has no VMs, so the VM path the other clouds use has no Cloudflare equivalent.
Development (VM)
Available Run the development VM on another cloud, or on your own machine, and keep its bucket in R2 if you like.
- Start the stack on a VM as on AWS, Google Cloud or Azure, or on a laptop or homelab with Self-hosting over Tailscale. Do not start it yet if you want R2: the bucket is chosen before the first start.
- In the Cloudflare dashboard, create an R2 bucket, and an R2 API token with object read and write on that bucket. Note its access key ID and secret, and your account ID.
- In the bundle's
release/directory, before the firstdocker compose up -d:
# .env
LOAMS_BUCKET=s3://my-r2-bucket/loams# secrets/engine.env (mode 0600)
AWS_ACCESS_KEY_ID=...
AWS_SECRET_ACCESS_KEY=...
AWS_ENDPOINT_URL=https://<ACCOUNT_ID>.r2.cloudflarestorage.com
AWS_REGION=autodocker compose up -d, then reach the engine athttps://loams.<tailnet>.ts.netfrom a device on your tailnet, with Loams Desktop in 0.1.1 (the console at/ui/is Planned for 0.1.2).
The engine speaks S3 to R2's endpoint. R2 supports the conditional writes it needs (If-Match and If-None-Match on PutObject). Only the engine's bucket moves to R2: the embedded metastore and Loams Postgres's storage stay on the VM's disk.
The engine is still reached only over your tailnet. R2 is storage; nothing about the engine becomes public.
Free tier
R2's free tier includes 10 GB-month of storage and a monthly allowance of operations, and R2 charges nothing for egress (verify on R2 pricing). That makes it a cheap bucket for a VM on any cloud, since reads back to the VM cost no transfer. The VM itself is billed by its own cloud.
To estimate the whole monthly bill on Cloudflare (compute, disk, bucket, requests and egress, from public list prices), use the cost calculator. Loams itself is free.
Production
What is supported today
Available R2 as the bucket of a production node on another cloud. The node is one VM, as on the AWS, Google Cloud or Azure pages, with LOAMS_BUCKET and secrets/engine.env set as above. Everything those pages say about one node, backups, networking, identity and upgrades applies.
- Backups: R2 encrypts at rest with its own keys; there are no customer-managed keys (design 70). Check R2's current docs for what it offers to recover overwritten or deleted objects (verify). Back up the VM's disk on its own cloud, and keep
.envandsecrets/somewhere safe. - Networking: your tailnet only.
- Identity: the built-in single organization, with
tailscale,oidcorapikeysign-in. Zitadel and OpenFGA are Planned (design 76). - Upgrades: 0.1.1 changes the default stack; reinstall.
Not supported today: the engine, the House or Loams Postgres on Cloudflare; a Worker calling your engine (the TypeScript SDK runs in Workers, but there is no supported way from a Worker to an engine on a tailnet yet); Cloudflare Tunnel in front of the engine; the console on your own Cloudflare project.
What is planned
Cloudflare is the second deploy target after TiDB X in design 78's order. These pieces are designed and approved, not built:
| Piece | What it is | Status |
|---|---|---|
| Deploy to Cloudflare, phase 0 | A template for your own account: a front Worker and the console on Workers static assets, a Durable Object that owns one Container running the light engine image, and R2 as the source of truth. Metadata is checkpointed to R2 every few seconds, so a crash can lose a few seconds of writes and a graceful stop loses none. Single node, labelled preview. Git repositories live directly on R2. No Postgres; House only if its sandbox works on Containers | Planned BY0 |
| The edge on Cloudflare | The front Worker is the only door. Data calls carry an environment-bound lk_ API key and are checked against an allow-list; the console and admin routes sit behind Cloudflare Access with your identity provider; workers.dev is off; no Container port is reachable except through the Durable Object | Planned BY0 |
| Cloudflare-native, phase 1 | The metastore and Durable on Durable Object SQLite, Jobs on Workflows and Queues, Git smart HTTP with a sequencer Durable Object, Postgres through Hyperdrive to a Postgres elsewhere | Planned BY3 |
| Cloudflare-native, phase 2 | Workers for Platforms for the multi-tenant Software Factory and the agents marketplace | Planned BY3 |
| Apps on Workers | App BYOC: apps and agents on Workers, D1, R2, Queues and Cron Triggers within the free plan, deployed with loams app deploy --target cloudflare | Planned design 71, AB0 |
| Void for apps | Void, an MIT app framework that deploys to your own Cloudflare account, as the recommended way to build those apps, with Vite+ as the toolchain | Planned design 79 |
| Edge reach | Workers and other serverless callers reaching an engine on another cloud through the gateway's edge listener over Cloudflare Tunnel or Workers VPC, with every request authenticated first. The engine stays off the internet | Planned design 69 |
Cost for phase 0, from design 70's estimates: about $46 a month for an always-on Container at low load, more for a larger one, plus Workers Paid ($5 a month) and R2 storage.
Deploy on Azure
Run Loams 0.1.1 on an Azure VM in your own subscription, as a development environment over your tailnet, or as a single production node with its bucket on Blob Storage.
Deploy with Vercel
Vercel runs your apps and agents, not the Loams data plane. The engine runs on a VM or in your own cloud, its bucket on Cloudflare R2, and apps reach it privately.