The Zero-Cost Stack: Building a Global Web App with Cloudflare Free Tier

#cloudflare #webdev #serverless #tutorial

What if I told you that you could deploy a web application serving users globally — with a database, API, static hosting, and custom domain — for exactly $0 per month?

No catch. No "free for 30 days." Actually free, indefinitely.

The Stack

Here's what I use to run two production web applications (Slitherlinks and OmniConvert) at zero cost:

Cloudflare Pages — Static site hosting with global CDN
Cloudflare Workers — Serverless API endpoints
Cloudflare D1 — SQLite database at the edge
Cloudflare R2 — Object storage (if needed)

All on the free tier. Let me break down each component.

Cloudflare Pages: Global CDN for Free

Pages gives you:

Unlimited bandwidth
Unlimited requests
500 builds per month
Preview deployments for every branch
Custom domains with automatic SSL

My Slitherlinks frontend is a static site built with HTML, CSS, and vanilla JavaScript. Every deployment pushes to Cloudflare's global CDN — 300+ data centers worldwide. A user in Tokyo gets the same sub-50ms response time as a user in São Paulo.

Deployment is one command: wrangler pages deploy dist/

Cloudflare Workers: API Without Servers

Workers run JavaScript/TypeScript at the edge. Free tier gives you:

100,000 requests per day
10ms CPU time per request
Global deployment (runs in the nearest data center to the user)

My Slitherlinks API handles puzzle delivery, user authentication, game completion tracking, leaderboards, and daily challenges — all in a single Worker.

The Worker code is surprisingly simple. It's essentially a router that maps endpoints to handler functions, with D1 database access.

Cloudflare D1: SQLite at the Edge

D1 is the game-changer. It's a serverless SQLite database that:

Replicates globally (reads are fast everywhere)
Supports standard SQL
Free tier: 5M reads, 100K writes per day
5GB storage

My D1 database stores 1,900 puzzles across 5 grid sizes and multiple difficulty levels, plus user accounts, game history, and leaderboard data. Total size: about 2MB.

For a puzzle game, 5M reads/day is essentially unlimited. I could serve thousands of daily active users before touching any limits.

The Authentication Pattern

One thing that surprises people: you can build real authentication on this stack. My implementation uses:

PBKDF2 password hashing (100K iterations, SHA-256)
HMAC-SHA256 JWT tokens (30-day expiry)
JWT_SECRET stored as a Worker secret

No third-party auth service needed. The Worker handles registration, login, and token verification directly.

Why Not Vercel/Netlify/Railway?

These are excellent platforms. But they all have usage-based pricing that kicks in at scale. Vercel's free tier limits bandwidth to 100GB. Netlify's limits to 100GB. Railway charges per resource-hour.

Cloudflare's free tier has no bandwidth limits on Pages and generous daily request limits on Workers. For applications that are read-heavy (like a puzzle game or a file converter), this is effectively unlimited.

Real Numbers

Here are my actual usage stats for Slitherlinks:

Pages: ~2,000 requests/day, 0% of any limit
Workers: ~500 API calls/day, 0.5% of daily limit
D1: ~3,000 reads/day, 0.06% of daily limit
Monthly cost: $0.00

Even if traffic 10x'd, I'd still be comfortably within free tier.

The Trade-offs

It's not perfect:

Workers have 10ms CPU limit on free tier (enough for most API work, tight for heavy computation)
D1 is eventually consistent for global reads (fine for games, tricky for financial applications)
No WebSocket support on free Workers (use Durable Objects on paid tier)
Cold starts exist but are minimal (~5ms)

For most indie projects, these limitations don't matter.