Glot Rank
Back to Docs

Cloudflare Self-Hosting

Deploy Glot Rank to your own Cloudflare account for internet-facing, multi-device, or team use.

Host Glot Rank on Cloudflare for internet-facing self-hosting across multiple devices or with your team. One deploy command provisions everything, including the Cloudflare Access login gate. Works on Cloudflare's free plan.

Prerequisites

  • Node 22.6 or newer and pnpm (corepack enable sets it up).
  • A Cloudflare account with R2 enabled. Activating R2 requires a payment method on file, even within its free tier — if you have never used R2, open R2 in the Cloudflare dashboard once.
  • A DataForSEO account — see DataForSEO API key setup.

1) Clone your Glot Rank repo

Clone your Glot Rank repository (your own fork, or wherever you host the source) locally:

git clone https://github.com/YOUR_GITHUB_USER/glotrank.git
cd glotrank
corepack enable
pnpm install

## 2) Log in to Cloudflare (once)

```bash
pnpm alchemy login                # answer yes to "Customize OAuth scopes?" and enable access:write
pnpm alchemy cloudflare bootstrap # deploys alchemy's state-store Worker to your account

Already logged in from before without the access:write scope? Run pnpm alchemy login --configure — a plain repeat login doesn't re-ask about scopes.

3) Create .env.selfhost

Copy the template and fill in the required values:

cp .env.selfhost.example .env.selfhost

4) Deploy

pnpm deploy:selfhost --yes

This provisions the D1 database, KV namespaces, and R2 bucket, applies the database migrations, deploys the Worker, and creates the Cloudflare Access application protecting it (allowing exactly ACCESS_ALLOWED_EMAILS). If the account has no Zero Trust team yet, one is created for you, named after your workers.dev subdomain.

5) Validate setup

  1. Open the Worker URL printed at the end of the deploy.
  2. Sign in with Cloudflare Access.
  3. Glot Rank should load after login.

If login fails, re-check ACCESS_ALLOWED_EMAILS and redeploy.

Connect the MCP server through Cloudflare Access

Use the same Cloudflare Access application that protects your Glot Rank Worker. Managed OAuth is required for MCP clients and is not enabled by default.

  1. Open Cloudflare Zero Trust.
  2. Go to Access controls -> Applications.
  3. Find your Glot Rank application, then select Edit.
  4. Go to Additional settings -> OAuth.
  5. Turn on Managed OAuth.
  6. In Managed OAuth settings, allow the redirect URIs your MCP clients use:
    • Allow localhost / loopback clients for CLI and desktop agents (Codex CLI, Claude Code) that register http://localhost:PORT/callback.
    • Add HTTPS redirect URIs for web connectors (a path may end in /*).
    • Without this, clients can't finish Dynamic Client Registration and log in but expose no tools.
  7. Save.

MCP clients should connect to:

https://YOUR_WORKER_HOSTNAME/mcp

Give teammates access to Glot Rank

Add the teammate to ACCESS_ALLOWED_EMAILS in .env.selfhost and redeploy. Everyone allowed through shares one Glot Rank workspace.

Updating to the latest Glot Rank version

git pull        # or: git fetch upstream && git merge upstream/main, if you forked
pnpm install
pnpm deploy:selfhost --yes
  • Operations (see docs/SELF_HOSTING_CLOUDFLARE_OPERATIONS.md in the repository): telemetry and other day-to-day tasks.
  • Legacy deployments (see docs/SELF_HOSTING_CLOUDFLARE_LEGACY.md in the repository): maintenance for installs created with the retired Deploy-button or manual Wrangler flows.