🔧 CF OSINT Toolkit

Production patterns for building OSINT tools on Cloudflare's edge — D1 · KV · R2 · Cron · AT Protocol

---

What Is This

A battle-tested collection of Cloudflare Workers patterns extracted from real OSINT tools in production. Built by VPDLNY running 65+ workers across 38 custom domains.

Use these as starters, templates, or reference implementations for your own intelligence tools.

---

Patterns Included

Pattern	Description	Storage
news-aggregator	NewsAPI + KV caching with TTL	KV
d1-heatmap-api	REST API over D1 for map data	D1
bsky-poster	AT Protocol post with image embed	KV
campaign-drip	Scheduled thread posting engine	D1
cron-digest	Daily digest via Telegram/email	KV
btc-gating	Bitcoin payment verification gateway	KV
leaflet-worker	Full Leaflet.js app served from Worker	Static
r2-cdn	R2-backed image CDN with custom domain	R2

---

Architecture Philosophy

Every OSINT tool follows this pattern:

1. CF Worker  →  handles all HTTP (no server, no cold start)
2. D1         →  primary structured data (SQLite at edge)
3. KV         →  cache, rate limits, short-lived flags
4. R2         →  images, PDFs, blobs
5. Cron       →  scheduled refreshes (max 5/account on free)
6. CF Access  →  Zero Trust auth for admin endpoints

---

Quick Start

# Clone the toolkit
git clone https://github.com/indicaindependent/cf-osint-toolkit
cd cf-osint-toolkit

# Pick a pattern
cd patterns/news-aggregator

# Configure
cp wrangler.toml.example wrangler.toml

# Deploy
npm install -g wrangler
wrangler login
wrangler deploy

---

Related Tools (Live in Production)

• 🗺️ FaceHeatMap — FR surveillance tracker
• ⚡ StraitTracker — Hormuz intel
• 🌍 WarHeatMap — Global conflict map
• 🔭 EdgeIntel — OSINT news aggregator

---

License

MIT — Build freely. Credit appreciated.

---

_{Extracted from 65+ production workers | Indica Independent}