Przemysław Zalewski

This page is a Cloudflare Worker

served from CMH US · stamped in by HTMLRewriter

Cloudflare developer: Workers live in week one, with a cost cap

I build and fix apps on Cloudflare Workers so a bot swarm, an outage or a migration does not turn into your invoice or your downtime. Every paid endpoint gets a daily cost cap in code, because Cloudflare budget alerts only send an email. Four of my side projects and this page run on Workers, Durable Objects, R2 and Workers AI. The black badge above names the data center that served it.

Book a free 30‑min call Email me instead

Calls this week · work starts 3 November 2026 · Wrocław, Poland (CET), remote

Przemysław Zalewski
270+tagged releases of one product in 10 months of 2026
10,000+affiliate programs cataloged, ~97% found automatically
260+merged PRs of my own in 2026, plus 300+ reviews of other engineers’ PRs
300+generated sites deployed automatically

Sound familiar?

Cloudflare problems I fix in 2026

Is Cloudflare blocking Googlebot or ChatGPT from my site?

Since 15 September 2026, new Cloudflare domains block Training and Agent bots on pages with ads by default. A site that blocks Training also shuts out Googlebot, Applebot and Bingbot, because they crawl for both (Cloudflare blog).

I set Search, Agent and Training separately, based on where you want to be found, align robots.txt and WAF rules to match, then check in the logs that search and AI assistant crawlers get a 200. After that, my AI Visibility Desk can track whether assistants name you. In June 2026 a change in our own bot check quietly broke sign‑in inside a product’s desktop and mobile apps; I fixed it on the server the same evening, with no app release.

How do I cap Cloudflare Workers spending?

Cloudflare budget alerts are informational only and do not pause or cap usage (Cloudflare docs), so an AI endpoint hammered by bots keeps billing after the alert email arrives.

Every paid endpoint I ship reserves its cost in a Durable Object before the model runs, sits behind per‑IP and global rate limits, and returns 429 with Retry-After once the daily cap is spent. The rate limit demo on this page returns 429 on the sixth click within 10 seconds. In October 2026, because Cloudflare offers no spend limit, I built my own brake: a tool stops at USD 5 a day, and at USD 50 a day everything paid is switched off and containers are verified stopped until I restore it by hand.

Sound like you? Book a free 30‑min call →

Can our Next.js app run on Cloudflare Workers?

Next.js 16.2 shipped a stable Adapter API on 25 March 2026, yet the Next.js deployment docs (updated 6 August 2026) still list only Vercel and Bun as verified adapters. Cloudflare is still building one, and its current Workers integration is not verified by the Next.js team (Next.js docs). Caching, revalidation and streaming still need checking app by app.

I move the app behind a Worker one route group at a time, run Playwright on the pages that earn money on both hosts, and switch DNS only with 301s and a sitemap diff. If a feature does not hold on Workers, you hear it before the cutover, along with plan B.

Cloudflare went down and took our site with it. What now?

On 20 February 2026, a Cloudflare change withdrew about 25% of Bring Your Own IP prefixes from the internet, and sites behind them were unreachable for over five hours, from 17:48 to 23:03 UTC. Some customers restored service themselves in the dashboard, while those whose service bindings had been removed had to wait (Cloudflare postmortem).

I write the runbook before you need it. It covers a scoped API token stored outside the dashboard, which records can safely go DNS‑only and what breaks if they do, and uptime alerts that run from outside Cloudflare’s network. In March 2026 long mailbox syncs were cut off by Cloudflare’s 100‑second timeout with HTTP 524; I added a keep‑alive every 10 seconds and automatic retry, and the syncs stopped failing.

Facing one of these? Book a free 30‑min call →

Why me

Cost caps, not surprises

Every AI or API endpoint I ship has a per‑IP rate limit, a global rate limit and a daily cost cap in a Durable Object. The demo below trips its limit on the sixth click, on purpose.

Six Cloudflare products in production

Workers with static assets, R2 for generated images, Durable Objects for atomic counters, Workers AI for models, Cache API for expensive responses, HTMLRewriter for per-request HTML. All six run on ciunkos.com today.

Off WordPress without losing search traffic

Static pages move first, then APIs one by one, with a 301 for every old address and a sitemap diff before the switch. That is how I moved the help center described below.

Strict headers, same-day patches

CSP without inline scripts, nosniff, referrer and permissions policies, OAuth where it belongs. React2Shell was patched the day the advisory went out, with a WAF rule as extra mitigation.

Live demo

See what the Worker sees

The data center code and country above were written into this HTML by the Worker with HTMLRewriter before it left Cloudflare. The panel below asks the Worker a few more things: TLS version, round‑trip time, a Cache API hit and a rate limit that bites.

Demo loading…

Click “Fetch twice” and compare the timings. Then hammer the rate limit button and watch the 429 arrive with a Retry-After header.

Proof

Work I can show

Problem, what I did, result. Client names only where I am allowed to use them.

Sign-in quietly broken in the apps, fixed without an app release

The problem
In June 2026 email sign‑in inside a product’s apps had been failing quietly and nothing had alerted. Web and single sign‑on worked, so nobody looked at the desktop and mobile apps.
What I did
I traced it to a change in our own bot check at the edge: the challenge escalated to a step that in‑app webviews cannot complete, so email sign‑in failed inside the apps. Installed apps could not be updated quickly, so I fixed it on the server the same evening, let signed app clients through, added the platform to the sign‑in audit log and turned on alerts for errors nobody had been seeing.
Result
Sign‑in worked again in every app without waiting for store review, and the next failure of this kind reaches a person the day it starts.

same-evening fix no app release new alerts

Four side projects on Cloudflare Workers under one domain

The problem
Ideas die when deploying them costs a weekend. I wanted a path from idea to a URL in an evening.
What I did
Korpo Tłumacz, Wyrocznia, Migawki and Przemo (Agent): each a Worker with static assets, Workers AI with per‑IP and global rate limits, a cost cap in a Durable Object, R2 for generated images, a first-party PostHog proxy and a CSP without inline scripts.
Result
Live at ciunkos.com/korpo-tlumacz, /wyrocznia, /migawki and /przemo. This page runs on the same pattern.

Workers AI Durable Objects R2 Open ↗

See also: AI & agents · Maintenance & CI/CD

Offer: Company login for apps your people built with AI

Affiliate discovery: 300 seeds into a 10,000+ catalog, 97% automated

The problem
A manually curated list of ~300 affiliate programs could not keep up with the market.
What I did
Multi-phase semantic search over pgvector with query expansion and negative queries, embedding-based clustering, tiered caching in Cloudflare R2. Due diligence on 230+ brands against a 50‑criterion scorecard rejected two thirds of them.
Result
A 10,000+ catalog with ~97% of entries found automatically.

10,000+ ~97% automated pgvector + R2

See also: AI & agents

Facing something similar? Book a free call →

One foot in the door

Not ready for a project? Start with one week or one pull request.

Two ways to see how I work before you commit to a sprint. Fixed scope, the price range below, the final number in writing within 24 hours of the call.

One-week Cloudflare code audit

I read the repo, CI, tests, deploys and the parts the team avoids, by hand. You get a written report with risks ranked by cost, what to fix first, a plan with milestones and a go or no‑go you can defend. The report is yours whether or not we continue.

$1,080⁠–⁠$2,160 excl. VAT · 30⁠–⁠40 h · See price and start date →

Code review of one pull request or one module

Send me the diff that worries you. Within a few days you get line‑level comments, the three things I would change first and whether I would merge it. I have reviewed 800+ pull requests on one product since 2018.

$72⁠–⁠$216 excl. VAT · 2⁠–⁠4 h · See price and start date →

Book a call to pick one Free 30‑minute call first. If neither fits, I say so on the call.

How it works

Three steps from this page to a running project.

  1. 1

    A 30-minute call

    You describe the product and the problem. I ask the questions I would ask on day one.

  2. 2

    Scope in writing

    Within 24 hours after the call you get a short written plan: what we build first, what we measure, how we work together and what it costs. No slide deck.

  3. 3

    Working software in week one

    Deployed, measured and open for your review. After that, the numbers set the pace.

Book a free call Email me instead

Fit check

Is this a fit?

A good fit when

  • You need a senior who owns delivery, not a pair of hands
  • The product has to ship and be measured, with or without a product manager
  • A solo engagement, or one team of up to four that I lead directly
  • TypeScript, React, Node.js, Cloudflare, Postgres, PostHog, and Python when the work needs it

Probably not when

  • A program that needs a ten‑person vendor team
  • A stack built around Java or a cloud I do not work in
  • Body leasing by the hour with no say in how the work is done

Working style

How I work

Zero bug policy

A bug is fixed or consciously closed, never parked. Alerts and error tracking in every project, so I learn about problems before the client does.

Agents under rules

Claude Code and Codex work on main with hooks, lint and test gates. The model suggests, the criteria decide. Every PR gets a human review and AI‑assisted content is disclosed.

Measured, not assumed

PostHog in every project from day one. A tracking plan per feature, and dashboards leadership reads instead of asking me for numbers.

Good to know

Cloudflare billing and limits few teams read

Idle containers still cost money

Containers bill memory and disk for every second an instance is awake, busy or idle; only CPU is billed by use. By the published rates, an awake standard‑4 with no traffic costs about 2.71 USD a day (Containers pricing).

A Durable Object bills 128 MB and wall time

Duration is charged for the full 128 MB allocation, whatever the object uses. Calling accept() on a WebSocket bills the whole connection; the Hibernation API avoids that (Durable Objects pricing).

One pending fetch keeps an object awake

Each pending I/O operation can keep a Durable Object in memory, and billed, for up to 15 minutes. Each setAlarm() also counts as a row written (Durable Objects pricing).

10,000 subrequests, not 1,000

On the paid plan a Worker gets 30 seconds of CPU by default (up to 5 minutes) and 10,000 subrequests; the free plan gets 10 ms and 50. Older posts quoting 1,000 are out of date (Workers limits).

R2 egress is free, listing is not

ListObjects is a Class A operation, the expensive kind. Infrequent Access adds a 30‑day minimum, a retrieval fee and no free tier (R2 pricing).

D1 caps bound parameters at 100

A D1 query takes at most 100 bound parameters, which breaks naive bulk inserts. A database is capped at 10 GB on paid plans (D1 limits).

FAQ

Questions people ask before they book

What does a Cloudflare project cost?
My base rate is $45 an hour excl. VAT, $36 for simple work and $54 for hard work. A one‑week audit of a Workers codebase is $1,080⁠–⁠$2,160; a three‑week first slice is $3,672⁠–⁠$7,452. Every range is on pricing, and you get the final number in writing within 24 hours of the call.
Can you help with a D1 migration or recovery?
Yes. D1 has point‑in‑time recovery, but rolling the database back does not unsend emails, undo subscription changes or unclick reminders. So I rehearse every migration on a clone first, give every outbound action an idempotency key, and in a real incident: stop processing, restore, run consistency checks, reconcile the billing and email providers’ event history, and only then reopen. The full approach is on how I work.
Workers or a Node.js server?
Workers when the product is request-shaped: pages, APIs, edge logic, scheduled jobs, light AI. A Node.js server when you need long‑lived processes, heavy libraries or a database on the same box. Often both, with Workers in front.
When do you reach for Durable Objects?
When two requests must agree on one piece of state right now: a cost counter, a rate limiter with memory, a per-channel archive, a WebSocket room. Not for a general database.
How do you keep Workers AI bills under control?
Rate limit per IP, global rate limit, a reservation in a Durable Object before the model runs and a settlement after it answers. The four side projects under ciunkos.com share that pattern, and the AI and agents page shows the agent that runs on it.
Can you move us off Vercel, WordPress or a VPS?
Yes. The usual shape is an audit of what the current host does for you, a worker that serves the static part first, then APIs one by one, with 301 redirects and a sitemap diff so search traffic survives. For Next.js specifically, start with the Next.js page. For a company site on WordPress, there is a fixed offer measured in hours.
Do you do Cloudflare for enterprise accounts?
I work on the Workers platform, DNS, WAF rules and Access. I do not resell plans and I am not a Cloudflare partner. Ask me about the engineering, ask Cloudflare about the contract.
Will Workers lock us in?
Only where you decide it is worth it. There is no proprietary framework: business logic stays in plain TypeScript modules, and the Cloudflare-specific parts (D1, R2, Durable Objects, bindings) are listed in the repo with what replacing each one would take. The code and the Cloudflare account are yours from the first commit, and the copyright is transferred in writing.
Can you promise our Cloudflare bill will never spike?
Nobody can promise an exact invoice: Cloudflare budget alerts only notify and do not cap usage (Cloudflare docs). What I can do is put the limit in code: per‑IP and global rate limits, a reservation of the worst‑case cost before any paid call, a daily cap that answers 429 with Retry-After, and an emergency stop that stays on until a person switches it off. The same brake runs on my own Workers.
Whose account is it, and what if you are unavailable?
Yours. I work in your Cloudflare account with a scoped API token, never through mine, so billing, logs and data stay with you. Code, CI, the runbook and architecture notes live in your repository from day one. Notice is one month on both sides with a written handover, and if I am ill you hear it the same day. I do not sell on‑call, so the outage runbook is written for your team to run without me. How I work.
Is your Cloudflare work only side projects?
What you can test before you pay is mine: this page, four Workers under ciunkos.com and my free tools. Client work on Cloudflare is under NDA, for example R2 tiered caching behind a 10,000+ program catalog. The delivery habits come from products with real users: Patriot Mail (built at Sanddev) passed CASA Tier 2 twice, in January and October 2026, and Sandtime.io (built at Sanddev) shipped 270+ tagged releases in 10 months of 2026.
How soon can you start?
From 3 November 2026. Book the call now and the first Worker can be live in the first week. If it is not, you stop: hourly work has no minimum and the code is already in your repository.
Why is my Cloudflare Containers bill high when nothing is running?
Memory and disk are billed for every second an instance is awake, even with no CPU use (Containers pricing). I set a hard lifetime per instance and check that it really stopped.
Can I use Workers KV for counters or rate limits?
No. KV is eventually consistent, and a write can take 60 seconds or more to show up elsewhere (how KV works). Counters belong in a Durable Object or D1.
Is Cloudflare blocking Googlebot or ChatGPT from my site?
Since 15 September 2026, new Cloudflare domains block Training and Agent bots on pages with ads by default. A site that blocks Training also shuts out Googlebot, Applebot and Bingbot, because they crawl for both (Cloudflare blog). I set Search, Agent and Training separately, based on where you want to be found, align robots.txt and WAF rules to match, then check in the logs that search and AI assistant crawlers get a 200. After that, my AI Visibility Desk can track whether assistants name you. In June 2026 a change in our own bot check quietly broke sign‑in inside a product’s desktop and mobile apps; I fixed it on the server the same evening, with no app release.

Bonus · #suchar

A dad joke, on the house

Free, like the first call. Same sense of humor, included in every project.

Why does a Cloudflare Worker never get tired?Punchline

It only works on request. Ba‑dum‑tss.

Why did the Worker move out of the data center?Punchline

It wanted to live on the edge. Ba‑dum‑tss.

What did one server say to the other on a date?Punchline

“We have a great connection. I hope it’s more than keep‑alive.” Ba‑dum‑tss.

In 30 minutes you will know if we are a fit

You bring the problem, I bring the questions. Want a number first? The configurator shows hours, a price range and the start date.

Book a free 30‑min call Email me instead

or write to ciunkos@gmail.com

After you book you get a calendar invite. Nothing else to fill in.

My pledge

  • Reply within 24 hours. I reply within 24 hours on working days, personally, not a bot. Weekend messages: by Monday noon.
  • Late means free. If I am late, the first hour of work is free. You do not have to ask.
  • Scope in writing within 24 hours. A free 30‑minute call with no company deck, then the scope and the price in writing within 24 hours. You decide.
  • The person who does the work. You talk to the person who does the work. No sales layer, no handoff.
  • Follow‑up only with news. I follow up only when I have something new for you. Never a “did you see my offer”.
  • Honest “not a fit”. If I am not the right person, I say so on the call and point you to someone who is.

Calls this week · work starts 3 November 2026 · B2B contract · Wrocław, Poland (CET), remote

You own the code, domain and accounts from day one. Nothing is held hostage.

More

Related services

The same engineer, a different angle.

Maintenance & CI/CDUpgrades with a safety net, migrations, GitHub Actions, legacy kept alive.Live demo AI & agentsAgents in production: tools, MCP, evals, cost caps.Live demo TypeScript & Node.jsTyped APIs, Postgres at scale, tests that encode security.Live demo See all services16 pages, one engineerBrowse all

Specific offers on this stack