How I built this blog, Part 2: putting it on the internet

The build fails with Cannot resolve entry module astro/entrypoints/prerender. My first build failed as I had the root set to / and not /web. As soon as I edited that, builds were fixed.

If the Worker name doesn’t match name in wrangler.jsonc, the deploy fails.

Most of this file is Cloudflare housekeeping, but two settings change what visitors see:

• Clean URLs (html_handling). Astro bakes each post into a file like my-post.html, but nobody wants .html in their address bar. This setting serves that file at /blog/my-post. If someone types it with a slash on the end, they get sent to the version without one, so every page has exactly one address.
• Real 404s (not_found_handling). If someone asks for a page that doesn't exist, they get my own "page not found" page, and Cloudflare also tells the browser it's a 404. That second part matters: without it, a missing page can look like a real one to Google.

This is the finished version of the file. The routes, workers_dev and preview_urls lines came later, when I connected my domain. I'll explain them in that step.

Headers are little notes the server sends along with every file, telling the browser how to handle it.

Caching: When Astro builds the site, it gives the CSS and JavaScript files names with a random-looking code in them, like index.a1b2c3.css. If I change the file, the code changes, so it gets a brand-new name. That means the browser can safely keep its copy for a whole year (max-age=31536000 is a year in seconds) without asking "is this still fresh?" (immutable). Pages load faster on a second visit, and nobody ever sees an old stylesheet. The pages themselves don't get this rule, so new posts show up right away.

Safety: The other four lines are a basic set of precautions for every page:

• X-Content-Type-Options: nosniff: "Believe the label." The browser treats each file as the type it says it is, and doesn't guess.
• Referrer-Policy: When you click a link from my site to another one, that site only learns you came from gilltrish.dev, not which page you were on.
• X-Frame-Options: DENY: Other sites can't show my pages inside a frame on theirs, which is a trick used to get people to click things they can't see.
• Permissions-Policy: My pages can't ask for your camera, microphone or location, and they opt out of the browser's ad-interest tracking (browsing-topics).

None of these are needed for a simple blog to work. They're cheap, sensible defaults.

With “Trigger on drafts” on, every save while typing kicks off a rebuild.

“Domain registrations are non-refundable… Confirm spelling before purchase.”

.dev requires HTTPS (it’s on browsers’ HSTS preload list). Without SSL the site won’t load at all. Cloudflare provides the certificate free and automatically.

A public phone book of who owns each domain. Cloudflare hides your personal details in its WHOIS (check it out here), but “the registry may still display this information in its own WHOIS service, outside Cloudflare’s control.”

Cloudflare sells domains at cost. The catch: DNS must stay on Cloudflare, which for me, was just convenient.

Buying from the Worker’s Domains tab did not connect the domain. Back on the tab, nothing was listed. Fix: Add domain again; the new domain now appears in the list, so select it.

The root (or apex) is gilltrish.dev itself; a subdomain is something.gilltrish.dev. www is technically a subdomain too.

The canonical link, og:url, og:image and the sitemap line in robots.txt all still said https://gilltrish-dev.gilltrish-developer.workers.dev, because SITE_URL was still set to that. That’s what step C3 fixes.

Custom domains match exactly, so gilltrish.dev and www.gilltrish.dev are two different doors.

Pick one canonical version (I chose no www) and redirect the other, or you get duplicate pages.

192.0.2.0 comes from a range reserved for examples. Because the record is proxied, Cloudflare answers before anything tries to go there.

The “HTTP to HTTPS” template does the same job as the Always Use HTTPS toggle. Use one, not both.

Without it, www.gilltrish.dev/blog?utm_source=linkedin would lose the ?utm… part.

https://www.* catches anything starting with www; ${1} is whatever the * matched, pasted after https://. Deep links keep their path, and it works without typing the domain. 301 means “moved permanently” and tells search engines to move everything to the main address.

Clicking Deploy warned: “This rule may not apply to your traffic. Your DNS configuration may not be proxying traffic for www…”. The proxied www record already existed, so I chose Ignore and deploy rule anyway. This is why the DNS record comes first; if you skip it, the other option creates it for you.

Right after deploying, https://www… returned 522: Cloudflare tried the placeholder address and timed out because the rule wasn’t live yet. A 522 on www means DNS is fine but the redirect rule isn’t live.

With the toggle off, the old address still loaded (CF-Cache-Status: HIT). Bigger catch: every deploy reapplies wrangler.jsonc, and with no routes in it Wrangler treats workers_dev as on, so the next build would quietly switch the address back on. The fix is to declare it in the file (the routes, workers_dev and preview_urls lines in the wrangler.jsonc above).

The config file is the boss; the dashboard is a sticky note the next deploy throws away.

A Domain property covers www/non-www and http/https in one; URL prefix is one exact address.

“To stay verified, don’t remove the DNS record.” The google-site-verification=… TXT record now lives in Cloudflare DNS; leave it alone.

On a Domain property the box isn’t pre-filled with your address. Type the full URL: https://gilltrish.dev/sitemap.xml.

The Performance and Pages reports stay empty (“Processing data”) for a few days on a new property. That’s normal.