backend (Cloudflare Workers demo)

This demo shows how to run the Wisp proxy path (/wisp/) on Cloudflare Workers by combining:

Wisp protocol handling from @mercuryworkshop/wisp-js
Outbound TCP from cloudflare:sockets

It is a minimal proof-of-concept based on:

../../AssppWeb/backend/src/services/wsProxy.ts
../wisp-js

The Worker also serves static files from ../frontend/dist via Wrangler assets.

What this demo supports

GET /healthz health check
WS /wisp/ Wisp v2 server path
Apple host allowlist + port 443 only
Optional token auth (?token=...)

What this demo does not support

UDP streams (disabled)
Legacy wsproxy path (for example /wisp/example.com:443)
Asspp backend HTTP APIs (/api/*)

Setup

bun install
cd backend
bun run types
bun run check

bun run check will build frontend first, then run Worker dry-run deploy.

Local dev

cd backend
bun run dev

Default local URL: http://127.0.0.1:8787

Deploy

cd backend
bun run deploy

Pushes to main deploy automatically to the Worker's workers.dev URL through .github/workflows/deploy-workers.yml.

Configure these repository secrets under Settings → Secrets and variables → Actions:

CLOUDFLARE_API_TOKEN: a Cloudflare API token with Workers Scripts: Edit, scoped to the deployment account
CLOUDFLARE_ACCOUNT_ID: the target Cloudflare account ID

Create the token from the Cloudflare dashboard's Manage Account → Account API Tokens page. Find the account ID on the target account's Cloudflare dashboard overview page.

Optional auth

Set one of these as Worker secrets:

ACCESS_TOKEN_HASH (preferred): expected token value directly
ACCESS_PASSWORD: plaintext password, Worker computes SHA-256 hex and compares with ?token=

cd backend
bunx wrangler secret put ACCESS_TOKEN_HASH
# or
bunx wrangler secret put ACCESS_PASSWORD