Capabilities

Everything an operator needs for a surge

Admission modes and signed tokens at the edge, plus a control room for branding, pacing, staff bypass, event-window geo gates, and live charts — without a commercial waiting-room suite.

Try demos Estimate cost Docs

Admission

How visitors wait, how they get through, and how the protected surface trusts them.

Queue Mode

Fair FIFO line

Visitors see position and estimated wait. Optional ahead / behind depth when you turn depth display on.

Lottery Mode

Equal-odds draw

Each admit picks uniformly among current waiters. The room shows odds in the pool instead of a hard line number.

HMAC admission tokens

Signed, time-limited access

Admitted visitors carry a token (cookie, Bearer, or query). No session database on your origin.

Click-to-enter hold

Continue before the seat expires

Optional Continue button plus a hold timer so abandoned admits release capacity back to the line.

Embeddable waiting room

iframe-ready /wait

Ship ?embed=1 for a calm in-page line. Return path is query-driven for full page or widget.

Edge Durable Object queue

Strong consistency

One QueueRoom DO per queue name owns order. No KV writes on join, status, or heartbeat — that is the cost discipline.

Control room

Operators run the launch from /admin — brand the room, pace admissions, and watch the line.

Admin setup wizard

First-run onboarding

Guided claim: account, Cloudflare verify, Turnstile, queue, and branding with live preview.

Live queue

Ops panel · ~5s refresh

Waiting, admitted, open slots, average and oldest wait, admit rate, and geo-block hits while the room is hot.

Analytics

~15s buckets · ~24h retention

Server-backed inflow / max-outflow traffic chart from the Durable Object (2h / 12h / 24h presets, CSV export), plus live queue metrics and geo-block hit counts.

Google Analytics

Optional GA4 on /wait

Set a Measurement ID (G-…) under Branding to load Google’s gtag on the waiting room. Consent and cookie policy are yours.

Traffic controls

Opening time · silent pause · health

Countdown before open, pause admissions without alarming visitors, and cut rate or auto-pause when origin health probes fail.

Branding + depth toggle

Tokens over chrome

Colors, title, message, font, redirect path, and showWaitingCount. Depth stays off until you enable it.

Access & gates

Staff bypass, smoke tests, and temporary geo gates for event windows — not a replacement for WAF.

IP allowlist

Office / staff bypass

Match CF-Connecting-IP (proxied traffic). Allowed clients skip the queue without joining the Durable Object or consuming a concurrent slot.

Pass queue

This-browser smoke test

From admin, mint a normal admission cookie for the current browser. Use it to exercise the protected app during an event without standing in line.

Temporary country block

CF-IPCountry · TTL

Block listed countries for a limited window. Expired lists deactivate automatically. IP allowlist and Pass queue still get through.

Cloudflare setup in admin

Required first-run zone gate

During setup, verify API token + zone, fix proxied DNS and IP Geolocation, then optionally set Full (strict) SSL and attach a custom domain.

Protect & integrate

Put TideGuard in front of a real origin, or wire join/status into your own UI.

Demo mode

Smoke-test without gating the site

After setup, origin stays ungated. Exercise /demo (or /wait?return=/demo), then Go live to enable proxy + protect-all when ready.

Origin proxy

Gate then forward

Configure upstream URL and path prefixes. Unauthenticated requests hit /wait; admitted visitors are proxied with TideGuard headers.

Protected demo path

Token-gated /demo

Unauthenticated visitors enter the queue; a valid admission token lets them through. Same pattern as a protected origin path.

Operator REST API + OpenAPI

Join through metrics

Typed routes for /join, /status, /leave, /heartbeat, /admit, /mode, /metrics, and /health — plus admin routes. Machine-readable OpenAPI 3.1 in the repo.

Cost calculator

Ballpark before launch

Estimate Workers and Durable Objects spend for one surge. Defaults match timeslot check-ins (750 status RPS budget).

Settings

Deploy to Cloudflare asks only for TOKEN_SECRET. Capacity and timeouts default in code; queue name, mode, origin proxy, branding, and gates are set in /admin after deploy.

Setting	Value	Explanation
TOKEN_SECRET	deploy secret	Only value Deploy to Cloudflare prompts for. HMAC key for visitor tokens, admin sessions, and first claim.
MAX_CONCURRENT_USERS	20	Code default capacity past the waiting room. Optional advanced Worker var override.
ADMIT_PER_SECOND	2	Code default steady admit rate for pacing and ETA. Optional advanced Worker var override.
Max waiting visitors	1M	Per-queue waiting-row safety cap (default 1,000,000 — not a paid seat limit). When full, /join returns 503 queue_full. Raise or lower in System → Danger zone (up to 50M).
TOKEN_TTL_SECONDS	600	Code default admission token lifetime after admit.
HEARTBEAT_TIMEOUT_SECONDS	180	Code default: drop silent waiting tabs that stop proving they are still here.
QUEUE_TIMEOUT_SECONDS	86400	Code default maximum time a visitor may stay in the waiting pool (24h). Deep timeslots need hours, not 30 minutes.
Status check-ins	timeslot	Server assigns nextCheckAt so status density stays near ~750/s (period ≥ 5s). Fixed poll/heartbeat env overrides exist but are not recommended.
ADMISSION_MODE	admin	queue (FIFO) or lottery. Set in the setup wizard or control room; switchable live via POST /mode.
DEFAULT_QUEUE	admin	Named queue from setup (fallback default). Not prompted at deploy.
Branding + depth	admin KV	Colors, title, message, font, and showWaitingCount (“Show place in line” → optional #X of Y). Depth stats stay off until you enable them.
Origin proxy	admin	Upstream URL and protect-all vs path prefixes in the control room. Public HTTPS only; private IPs rejected.
IP allowlist	admin KV	IPs and CIDRs matched against CF-Connecting-IP on proxied hostnames.
Country block	admin KV	ISO country codes + TTL hours. Inactive when expired or disabled.

Deep operator guides live in the docs — admin, analytics, IP allowlist, country block, and protecting an origin.