Homo sapiens by birth;

Running a URL Shortener on Cloudflare for $0 (Part 4): Operating It for Free

A service that costs nothing still needs a deploy pipeline, security headers, backups and a plan for failure. Part 4 covers Terraform with its state in R2, deploys from tags with API tokens instead of OIDC, the first deploy by hand, one CSP kept in three places, restore and regional failure, the bugs that only production showed, the files that make the API usable by agents, and when to start paying $5 a month.

Running a URL Shortener on Cloudflare for $0 (Part 3): Writes and Abuse on a Free Plan

Creating a link on mol.la is one validation pass, one ID from a leased block, a keyed Feistel permutation in WebCrypto, and one D1 batch. Part 3 explains each step, what a create really costs in D1 rows, and why rate limits on a free plan protect against floods but not against a patient client using up the day's write quota.

Running a URL Shortener on Cloudflare for $0 (Part 2): The Redirect at the Edge

A click on mol.la is answered by the browser cache, a Cache API entry in the nearest Cloudflare data center, or one D1 read. Part 2 explains why the Cache API and not Workers Cache, why one response carries two cache lifetimes, how a removed link stops working without a versioned cache, which guarantees that relaxes, and how a click is counted after the response.

Running a URL Shortener on Cloudflare for $0 (Part 1): The Architecture

mol.la is an open-source URL shortener that runs on one Cloudflare Worker and one D1 database for $0 a month. Part 1 explains the requirements, which free-plan quota really limits the design, why KV, Queues and Durable Objects were left out, what every action costs in requests and rows written, and how the code keeps the platform at the edges.

Designing a URL Shortener in AWS (Part 3): Writes, Clicks, and the Slow Path

A redirect is only half the system. Part 3 follows a link from creation to its click count: validation that never fetches the destination, an idempotency key and a generated code written in one DynamoDB transaction, a Kinesis click pipeline that never slows a redirect, abuse controls for a public API with no accounts, and a test strategy that needs no cloud account.