Cloudflare Setup

Cloudflare Setup

Worker configuration

The interactive setup generates wrangler.toml with:

• the worker.js entrypoint
• NODE_APP_URL pointing to /api/webhook/email
• the MAIL_STORE R2 binding
• the MAIL_QUEUE producer and consumer bindings
• the top-level EMAIL Email Service binding

The Email Service binding must use top-level Wrangler syntax:

[[send_email]]
name = "EMAIL"

Do not place send_email inside a queue consumer block.

Required secrets

npx wrangler secret put WEBHOOK_SECRET
npx wrangler secret put CLOUDFLARE_SEND_WEBHOOK_SECRET
npx wrangler secret put MAILBRIDGE_PUBLIC_KEY_PEM < secrets/mailbridge-r2-public.pem

• WEBHOOK_SECRET authenticates inbound Worker calls to Mailbridge.
• CLOUDFLARE_SEND_WEBHOOK_SECRET authenticates outbound Mailbridge calls to the Worker.
• MAILBRIDGE_PUBLIC_KEY_PEM encrypts inbound mail before R2 storage.

Never upload the Mailbridge private key.

Resources

npx wrangler r2 bucket create mailbridge-inbound
npx wrangler queues create mailbridge-inbound
npx wrangler deploy --dry-run
npx wrangler deploy

Adjust resource names to match the generated wrangler.toml.

Dashboard setup

1. Enable Email Routing for the inbound domain.
2. Route the desired addresses to the deployed Worker.
3. Confirm the Worker has R2, Queue, and Email Service bindings.
4. Ensure NODE_APP_URL is publicly reachable over HTTPS.
5. If using a Tunnel, route the public hostname to Mailbridge port 3090.

The Worker stores ciphertext in R2, enqueues object references, retries temporary webhook failures, and deletes stored objects after successful or permanent processing.