Cloudflare Worker 安全连接 MySQL 数据库实战

┌─────────────────┐     ┌──────────────────┐     ┌─────────────────┐
│  Cloudflare     │────▶│  Cloudflare      │────▶│  Self-hosted    │
│  Worker         │     │  Tunnel          │     │  MySQL          │
│  (Edge)         │◄────│  (cloudflared)   │◄────│  (Private)      │
└─────────────────┘     └──────────────────┘     └─────────────────┘
         │                                               │
         └────────────── CF Access ──────────────────────┘
                    (Service Token Auth)

# 登录 Cloudflare
npm run cloudflared:login

# 配置 docker-compose.yml
TUNNEL_TOKEN="your-tunnel-token"

# 启动服务
npm run cloudflared

# 设置密钥
wrangler secret put CF_CLIENT_ID
wrangler secret put CF_CLIENT_SECRET

# 部署
wrangler deploy

import { Client } from '@planetscale/database';

export default {
  async fetch(request: Request, env: Env) {
    const client = new Client({
      host: env.DB_HOST,
      username: env.DB_USER,
      password: env.DB_PASS,
      fetch: (url: string, init: any) => {
        // 添加 Cloudflare Access 认证头
        init.headers = {
          ...init.headers,
          'CF-Access-Client-Id': env.CF_CLIENT_ID,
          'CF-Access-Client-Secret': env.CF_CLIENT_SECRET,
        };
        return fetch(url, init);
      },
    });

    const result = await client.execute('SELECT * FROM users');
    return Response.json(result.rows);
  },
};