Building blocks for small sites behind Cloudflare

using Webling.AspNetCore;
using Webling.Cloudflare;

builder.AddCloudflareOrigin();
builder.Services.AddTurnstile(config.GetSection("Turnstile"));
builder.Services.AddPublicCaching("__Host-session");

var app = builder.Build();
// 403 unless the request came through your zone.
app.UseCloudflareOrigin();
app.UseSecurityHeaders(nonce =>
    $"script-src 'self' 'nonce-{nonce}'");
app.UseAuthentication();
// [PublicPage] components: cached at the edge,
// private for signed-in visitors.
app.UsePublicPageCaching();

using Webling.Cloudflare;
using Webling.Jobs;

builder.Services.AddDbContext<AppDbContext>(...);
builder.Services.AddJobDispatcher<AppDbContext>(
    config.GetSection("Jobs"));
builder.Services.AddJobHandler<ResizePhoto, ResizePhotoHandler>();
builder.Services.AddCloudflareCache(config.GetSection("Cloudflare"));

// Anywhere, in the same SaveChanges as the upload:
db.EnqueueJob(new ResizePhoto(photo.Id), now);
await db.SaveChangesAsync();

using Webling.Aspire;

web.PublishAsAzureContainerApp((_, app) =>
    app.UseCloudflareIngress("www.example.com",
        certificateName: "origin-ca"));

if (builder.ExecutionContext.IsPublishMode)
{
    // Fails the deploy if Cloudflare changed its ranges.
    await CloudflareIngress.EnsureRangesCurrentAsync();
    builder.RunJobBeforeApps("migrations",
        subscription, resourceGroup, "web", "worker");
}