From 25ebf37abdb65d5417a4993996635fafb94f8f71 Mon Sep 17 00:00:00 2001 From: PlaygrndLabs Date: Fri, 6 Nov 2026 15:50:02 +0000 Subject: [PATCH] docs: label the workers-only install as beta --- README.md | 6 ++++-- SECURITY.md | 2 +- worker/README.md | 4 +++- worker/package.json | 2 +- 4 files changed, 9 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 05cc4ae..f2f586f 100644 --- a/README.md +++ b/README.md @@ -23,7 +23,7 @@ Free and open source; sub2api never charges you anything. You need a Cloudflare account on the [Workers Paid plan](https://developers.cloudflare.com/workers/platform/pricing/) ($5/month; Containers require it). -On Workers Free? See the [Workers-only install](#workers-only-install-api-keys-plus-limited-logins). +On Workers Free? See the [Workers-only install (beta)](#workers-only-install-beta). 1. Press the **Deploy to Cloudflare** button above. 2. Set the two secrets it asks for. Each needs at least 32 characters of `A-Z a-z 0-9 _ -`; `openssl rand -hex 32` makes one: @@ -114,7 +114,9 @@ sh test/container-smoke.sh # needs Docker: runs CPA against the R2 shim The container builds the newest CPA release and dashboard by default. To freeze them, set `CPA_VERSION`, `PANEL_VERSION` and `PANEL_SHA256` in `container/Dockerfile`. -## Workers-only install (API keys, plus limited logins) +## Workers-only install (beta) + +**Beta.** The Container install is the main install. This one is still in progress and may change between releases. For Workers Free. No container: the Worker runs our TypeScript port of CPA, with the same dashboard. API keys work with every app and provider. Logins are limited: Claude login works only with Claude Code, and ChatGPT login only for voice over WebSocket. diff --git a/SECURITY.md b/SECURITY.md index 65bef10..d4ce797 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -16,7 +16,7 @@ Everything a deploy holds belongs to its owner: your Cloudflare account, your R2 - **State stays in your R2 bucket.** CPA's S3 client talks to `http://r2.internal`, which only the container can reach and which the Worker serves from an R2 binding. No R2 API tokens exist. - **An upstream you trust.** By default the container builds the newest CPA release tag, and both installs download the newest dashboard release, so a new upstream release reaches your gateway on its next deploy, including the weekly one. The dashboard runs on your gateway's origin and holds your management key, so a compromised upstream release would control your gateway. To freeze them, set `CPA_VERSION`, `PANEL_VERSION` and `PANEL_SHA256` in `container/Dockerfile` (Container install), or the `PANEL_VERSION` and `PANEL_SHA256` repository variables (Workers-only install, `.github/workflows/deploy-worker.yml`). The build fails when the dashboard doesn't match its checksum. Each build prints the CPA tag and the dashboard's SHA-256. -### The Workers-only install (`worker/`) +### The Workers-only install, beta (`worker/`) - **API calls need a key from `access.api-keys`.** The key check and the Claude token are cached per Worker isolate for at most a minute, so a key or login you remove stops working everywhere within a minute. - **The dashboard and management API need two secrets,** as above: the `DASHBOARD_PASSWORD` sign-in cookie and the management key (`MANAGEMENT_KEY`). Both installs require a separate `MANAGEMENT_KEY`, because the dashboard can remember the key it is given in browser storage; the Workers-only install keeps its management API off until the key is set and differs from the password. Sign-in attempts are limited to 5 a minute per IP, and the dashboard page is never framed. diff --git a/worker/README.md b/worker/README.md index 358833a..916edcd 100644 --- a/worker/README.md +++ b/worker/README.md @@ -1,4 +1,6 @@ -# sub2api, Workers-only install +# sub2api, Workers-only install (beta) + +**Beta.** The [Container install](../README.md) is the main install. This one is still in progress and may change between releases. A version of sub2api with no container, for Cloudflare's **Workers Free** plan. It is a TypeScript rewrite of CPA (CLIProxyAPI), not CPA itself, and serves **CPA's own dashboard** (Cli-Proxy-API-Management-Center) through a port of CPA's v8 management API. So both installs look and work the same in the browser. diff --git a/worker/package.json b/worker/package.json index d195dce..47ef817 100644 --- a/worker/package.json +++ b/worker/package.json @@ -1,6 +1,6 @@ { "name": "sub2api-worker", - "description": "sub2api for the Cloudflare Workers Free plan: a TypeScript gateway that needs no container.", + "description": "sub2api (beta) for the Cloudflare Workers Free plan: a TypeScript gateway that needs no container.", "license": "MIT", "private": true, "type": "module",