Capabilities

Everything an operator needs for a surge

Admission modes and signed tokens at the edge, plus a control room for branding, pacing, staff bypass, event-window geo gates, and live charts — without a commercial waiting-room suite.

Try demos Estimate cost GitHub docs

Admission

How visitors wait, how they get through, and how the protected surface trusts them.

Queue Mode

Fair FIFO line

Visitors see position and estimated wait. Optional ahead / behind depth when you turn depth display on.

Lottery Mode

Equal-odds draw

Each admit picks uniformly among current waiters. The room shows odds in the pool instead of a hard line number.

HMAC admission tokens

Signed, time-limited access

Admitted visitors carry a token (cookie, Bearer, or query). No session database on your origin.

Click-to-enter hold

Continue before the seat expires

Optional Continue button plus a hold timer so abandoned admits release capacity back to the line.

Embeddable waiting room

iframe-ready /wait

Ship ?embed=1 for a calm in-page line. Return path is query-driven for full page or widget.

Edge Durable Object queue

Strong consistency

One QueueRoom DO per queue name owns order. No KV writes on join, status, or heartbeat — that is the cost discipline.

Control room

Operators run the launch from /admin — brand the room, pace admissions, and watch the line.

Admin setup wizard

First-run onboarding

Password, queue, branding, and mode with live preview before KV save. Requires Bearer TOKEN_SECRET so strangers cannot claim the Worker.

Live queue

Ops panel · ~5s refresh

Waiting, admitted, open slots, average and oldest wait, admit rate, and geo-block hits while the room is hot.

Analytics

5-minute charts · 1h / 12h / 24h

Queue depth, average wait, and country-block hits from live metrics, stored in the operator browser. Zooming ranges does not hit the Durable Object again.

Traffic controls

Opening time · silent pause · health

Countdown before open, pause admissions without alarming visitors, and cut rate or auto-pause when origin health probes fail.

Branding + depth toggle

Tokens over chrome

Colors, title, message, font, redirect path, and showWaitingCount. Depth stays off until you enable it.

Access & gates

Staff bypass, smoke tests, and temporary geo gates for event windows — not a replacement for WAF.

IP allowlist

Office / staff bypass

Match CF-Connecting-IP (proxied traffic). Allowed clients skip the queue without joining the Durable Object or consuming a concurrent slot.

Pass queue

This-browser smoke test

From admin, mint a normal admission cookie for the current browser. Use it to exercise the protected app during an event without standing in line.

Temporary country block

CF-IPCountry · TTL

Block listed countries for a limited window. Expired lists deactivate automatically. IP allowlist and Pass queue still get through.

Cloudflare access helper

Check / fix zone setup

Optional Zone ID + API token to verify proxied DNS and IP Geolocation so geo headers and connecting IP behave as expected.

Protect & integrate

Put TideGuard in front of a real origin, or wire join/status into your own UI.

Origin proxy

Gate then forward

Configure upstream URL and path prefixes. Unauthenticated requests hit /wait; admitted visitors are proxied with TideGuard headers.

Protected demo path

Token-gated /demo

Unauthenticated visitors enter the queue; a valid admission token lets them through. Same pattern as a protected origin path.

Operator REST API

Join through metrics

Typed routes for /join, /status, /leave, /heartbeat, /admit, /mode, /metrics, and /health — plus admin routes for schedule, pause, geo, and allowlist.

Cost calculator

Ballpark before launch

Estimate Workers and Durable Objects spend for one surge. Defaults match real poll (15s) and heartbeat (30s) intervals.

Settings

Defaults from a fresh deploy. Override in wrangler.jsonc, secrets, or the admin control room.

Setting	Value	Explanation
MAX_CONCURRENT_USERS	20	How many admitted visitors the protected surface can hold at once.
ADMIT_PER_SECOND	2	Steady admit rate used for release pacing and wait ETA.
ADMISSION_MODE	queue	queue (FIFO) or lottery. Switchable live from admin or POST /mode.
TOKEN_TTL_SECONDS	600	How long an admission token stays valid after admit.
HEARTBEAT_TIMEOUT_SECONDS	60	Drop silent waiting tabs that stop proving they are still here.
QUEUE_TIMEOUT_SECONDS	1800	Maximum time a visitor may stay in the waiting pool.
Status poll / heartbeat	15s / 30s	Waiting-room client intervals. Longer intervals cut Durable Object request volume.
DEFAULT_QUEUE	default	Named queue used when the request does not specify one.
Branding + depth	KV / admin	Colors, title, message, font, and showWaitingCount. Depth stats stay off until you enable them.
Origin proxy	admin / vars	Upstream URL, protect-all vs path prefixes. Public HTTPS only; private IPs rejected.
IP allowlist	admin KV	IPs and CIDRs matched against CF-Connecting-IP on proxied hostnames.
Country block	admin KV	ISO country codes + TTL hours. Inactive when expired or disabled.

Deep operator guides live in therepository docs— admin, analytics, IP allowlist, country block, and protecting an origin.