Prerequisites
Before you turn Edge on for a property, confirm both of the following.
Lock the Origin to Cloudflare
Do not enable Edge for a property until its origin rejects requests that do not come through Cloudflare. Allegro does not check this for you.
The worker removes gated content on its way through Cloudflare. A visitor who can reach the origin directly gets the untransformed page, so an open origin makes Edge cosmetic.
Use Cloudflare's Authenticated Origin Pulls (mutual TLS between Cloudflare and the origin) and configure the origin or its host to refuse connections that don't present Cloudflare's client certificate. Where the hosting provider supports it, also restrict inbound traffic to Cloudflare's IP ranges.
To check, request an article directly from the origin's address, bypassing Cloudflare. The request must fail.
The Hostname Is Proxied by Cloudflare
The property's hostname must be in a zone in the organization's Cloudflare account, with the DNS record proxied (orange cloud). Allegro picks the zone whose name is the longest match for the hostname. If no zone in the connected account covers it, deploys fail with "No zone in the connected Cloudflare account covers {hostname}."
A Connected Cloudflare Account
The organization connects its Cloudflare account under Organization Settings → Allegro Edge. There are two ways to connect:
| Method | When to use it |
|---|---|
| OAuth | Available when the instance has a Cloudflare OAuth client. See Cloudflare OAuth for Edge to register one. |
| API token | Always available. Use it when the instance has no OAuth client, or when the organization wants a connection that doesn't depend on one person's Cloudflare login. |
Either way, the connection needs these permissions:
| Permission | Why |
|---|---|
| Account Settings: Read | Lists the accounts the connection can see. |
| Zone: Read | Matches each property's hostname to a zone. |
| Workers Scripts: Edit | Uploads and updates each property's worker. |
| Workers Routes: Edit | Binds each worker to its hostname and exclusions. |
Create token in Cloudflare on the settings page opens Cloudflare's token form with these permissions selected.
The Allegro Edge Package
Edge is a package that is enabled per organization. Enable Allegro Edge under Organization Settings → Packages before looking for its settings pages.
Next Steps
- Instance Configuration for the platform-side setup.
- Enabling Edge for a Property for the organization-side setup.