---
title: Deploying Self-Hosted Storage on Cloudflare Workers
description: Step-by-step guide to running Allure Report Storage as a Cloudflare Worker, backed by D1 and R2.
---

# Deploying Self-Hosted Storage on Cloudflare Workers (Allure 3)

Run [Allure Report Storage](/docs/self-hosted-storage/) as a Cloudflare Worker, backed by Cloudflare D1 (metadata) and R2 (report files).

1. [Create the Cloudflare resources](#_1-create-the-cloudflare-resources).
2. [Configure secrets](#_2-configure-secrets).
3. [Deploy](#_3-deploy).
4. [Validate it's running](#_4-validate-its-running).
5. [Use S3-compatible storage instead of R2](#_5-use-s3-compatible-storage-instead-of-r2) (optional).

## Requirements

- [A Cloudflare account](https://dash.cloudflare.com/sign-up)
- [`wrangler`](https://developers.cloudflare.com/workers/wrangler/), Cloudflare's CLI

## 1. Create the Cloudflare resources

Create the D1 database and R2 bucket:

```bash
corepack enable
yarn dlx wrangler d1 create allure-report-storage
yarn dlx wrangler r2 bucket create allure-report-storage
```

Update `wrangler.toml` with the `database_id` printed by the first command. The R2 bucket name must match `bucket_name` in `wrangler.toml` (`allure-report-storage` by default) or be updated there.

## 2. Configure secrets

```bash
yarn dlx wrangler secret put ACCESS_TOKEN
yarn dlx wrangler secret put SECRET
```

Both are plain strings you choose yourself when prompted, not a generated or fixed-format value; pick anything long and unguessable. Their use is narrow: `ACCESS_TOKEN` only authorizes minting a report-access token (`POST /api/token`) and setting a project's main branch, nothing else; `SECRET` is never sent anywhere, it just signs the report-access tokens issued from those `ACCESS_TOKEN` requests. Neither is what you give to Allure 3 directly - that's a separate, freshly minted `ars1.<payload>.<signature>` token, covered in [Connecting Allure 3 to the storage service](/docs/self-hosted-storage/#connecting-allure-3-to-the-storage-service).

## 3. Deploy

```bash
corepack enable
yarn dlx wrangler deploy
```

Or run it locally first, entirely on your own machine. `wrangler dev` emulates D1 and R2 locally, with no real Cloudflare resources touched:

```bash
yarn dlx wrangler dev
```

## 4. Validate it's running

```bash
curl https://<your-worker-domain>/api/ping
```

A `{"pong":true,...}` response confirms the service is up. From here, [connect Allure 3 to the storage service](/docs/self-hosted-storage/#connecting-allure-3-to-the-storage-service).

## 5. Use S3-compatible storage instead of R2

Set `STORAGE_BACKEND=s3` (as a var or Worker secret, same as `ACCESS_TOKEN`/`SECRET`) to store report files in an S3-compatible bucket instead of the native R2 binding.

| Variable               | Required | Purpose                                                                        |
| ---------------------- | -------- | ------------------------------------------------------------------------------ |
| `S3_BUCKET`            | Yes      | Bucket name                                                                    |
| `S3_REGION`            | Yes      | Bucket region (`auto` for Cloudflare R2)                                       |
| `S3_ENDPOINT`          | Yes      | S3-compatible endpoint URL                                                     |
| `S3_ACCESS_KEY_ID`     | No\*     | Access key                                                                     |
| `S3_SECRET_ACCESS_KEY` | No\*     | Secret key                                                                     |
| `S3_FORCE_PATH_STYLE`  | Yes      | `true` for most self-hosted S3-compatible servers (e.g. MinIO), `false` for R2 |
| `S3_SESSION_TOKEN`     | No       | Session token, for temporary credentials                                       |
| `S3_PREFIX`            | No       | Prefix applied to every object key                                             |
| `S3_REPORTS_PREFIX`    | No       | Prefix for report files (default `files`)                                      |
| `S3_ASSETS_PREFIX`     | No       | Prefix for shared assets (default `assets`)                                    |

\* If omitted, the AWS SDK's default credential provider chain is used instead.

```bash
yarn dlx wrangler secret put STORAGE_BACKEND
yarn dlx wrangler secret put S3_BUCKET
yarn dlx wrangler secret put S3_REGION
yarn dlx wrangler secret put S3_ENDPOINT
yarn dlx wrangler secret put S3_ACCESS_KEY_ID
yarn dlx wrangler secret put S3_SECRET_ACCESS_KEY
yarn dlx wrangler secret put S3_FORCE_PATH_STYLE
```

Cloudflare R2 example values:

```bash
STORAGE_BACKEND=s3
S3_BUCKET=allure-report-storage
S3_REGION=auto
S3_ENDPOINT=https://<cloudflare-account-id>.r2.cloudflarestorage.com
S3_ACCESS_KEY_ID=<access-key>
S3_SECRET_ACCESS_KEY=<secret-key>
S3_FORCE_PATH_STYLE=false
```

Bucket-specific R2 endpoints (`<bucket>.<account-id>.r2.cloudflarestorage.com`) are normalized internally to the account-level form above.

See [Self-hosted storage](/docs/self-hosted-storage/) for how to use it: publishing, branches, history, and deleting reports.