Operations on vanityURLs

Operator timezone is not just a setup question

Mon, 01 Jun 2026 00:00:00 +0000

The operator timezone question in npm run setup looks like a small preference. It is more useful than that.

vanityURLs uses timezone names in places where a numeric offset is too brittle: scheduled links, generated registry metadata, and operator-facing views such as /en/_stats/.

Use a place, not an offset

Enter an IANA timezone such as America/Toronto, America/New_York, Europe/Paris, or UTC. Do not enter -4, -5, or GMT-0400.

An offset only describes one moment. It does not describe daylight saving time, historical transitions, or the operator’s normal working context. A place-based timezone lets the JavaScript runtime handle EST/EDT or other local transitions without the instance owner updating config twice a year.

Cloudflare products vanityURLs leaves out

Fri, 29 May 2026 00:00:00 +0000

Cloudflare has more useful products than a short-link redirector should use.

That is not a criticism of Cloudflare. It is an operating boundary. vanityURLs uses Cloudflare DNS, Cloudflare Workers, Cloudflare Access, SSL/TLS, and selected edge protections. The baseline product list lives in Cloudflare products. The detailed setup lives in Network protection.

This page records the other side of that decision: products that are visible, useful in the right deployment, and still not part of the default vanityURLs setup.

vanityURLs' secret sauce is a JSON ledger

Fri, 29 May 2026 00:00:00 +0000

The problem showed up in the usual small way: a Cloudflare dashboard label moved, a setup page still named the old path, and the next maintainer had to decide whether the documentation was stale or the product guidance had changed.

vanityURLs stands on Cloudflare’s shoulders. That is the point. A short-link redirector should not need a fleet of servers, a database, or a private control plane. It can run on Cloudflare’s serverless architecture and let Cloudflare stop noisy traffic before the Worker executes.

Do not turn every Cloudflare knob

Thu, 28 May 2026 00:00:00 +0000

The Cloudflare dashboard is not a checklist.

That is the rule. A vanityURLs instance has a narrow job: serve short links from a Worker, keep operational pages behind Access, and let Cloudflare reject obvious noise before application code runs. The baseline controls are documented in Network protection. The product inventory is documented in Cloudflare products.

This post is the negative space. It names the knobs that should stay off unless an operator has a reason that survives writing down.

Do not delete a link to change its meaning

Wed, 27 May 2026 00:00:00 +0000

A short link usually outlives the moment that created it.

Someone pastes it into a runbook. Someone prints it on a slide. Someone bookmarks it. Six months later, a destination changes and the tempting fix is to delete the row.

Do not start there. In vanityURLs, lifecycle states make the operational decision explicit in custom/v8s-links.txt: redirect, expire, disable, hold for maintenance, or disappear as a true not-found.

Redirect States

Use permanent when the destination is stable. vanityURLs returns HTTP 301, the permanent redirect status defined by RFC 9110.

Cloudflare Access is not a checkbox

Tue, 26 May 2026 00:00:00 +0000

The failure mode is ordinary. Someone opens /en/_stats/ from a private browser window and sees the dashboard instead of the Cloudflare Access login page.

That is the whole problem. Public redirects should stay public. Operational pages should not.

For vanityURLs, Cloudflare Access has one narrow job: keep localized stats paths such as /en/_stats/, localized test paths such as /en/_tests/, and similar operator surfaces private before the Worker serves them. Treat it as an access boundary, not a setup souvenir.

Random slugs still have human readers

Tue, 26 May 2026 00:00:00 +0000

Random slugs are for the moments when the keyword does not matter.

You paste a long URL. lnk chooses the slug. You keep moving. The catch is that a random slug may still be read from a slide, typed from a badge, dictated over a call, pasted into a ticket, or compared in a screenshot.

In vanityURLs 3.x, random slug generation is configurable. Existing instances can get it by following the upgrade workflow, including npm run upgrade.

Owner labels for short-link change history