ci: build nxdns.sh and deploy it as a cloudflare worker with static assets

.gitea/workflows/site.yml

@@ -0,0 +1,56 @@
+name: Site
+
+# Builds nxdns.sh and deploys it as a Cloudflare Worker serving static assets,
+# configured in website/wrangler.jsonc, domain included. Cloudflare has no Gitea
+# integration, so the build runs here and wrangler uploads it.
+#
+# The site publishes docs/ and CHANGELOG.md as they stand, and reads the release
+# from build.zig.zon, so a change to any of them changes the site.
+#
+# Secret CLOUDFLARE_API_TOKEN: a token from the "Edit Cloudflare Workers"
+# template, limited to this account and the nxdns.sh zone. Variable
+# CLOUDFLARE_ACCOUNT_ID.
+on:
+  push:
+    branches: [master]
+    paths:
+      - "website/**"
+      - "docs/**"
+      - "CHANGELOG.md"
+      - "build.zig.zon"
+      - ".gitea/workflows/site.yml"
+  workflow_dispatch:
+
+concurrency:
+  group: site
+  cancel-in-progress: false
+
+env:
+  NODE_VERSION: "24.19.0"
+  # The newest wrangler older than npm's release-age floor on the day it was pinned.
+  WRANGLER_VERSION: "4.148.0"
+
+jobs:
+  deploy:
+    runs-on: ubuntu-24.04-light
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+
+      - name: Set up Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Build
+        working-directory: website
+        run: |
+          npm ci
+          npm run build
+
+      - name: Deploy
+        working-directory: website
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+        run: npx --yes "wrangler@${WRANGLER_VERSION:?}" deploy --message "${GITHUB_SHA:?}"

website/PLAN.md

@@ -9,8 +9,8 @@ Convince, then teach. A marketing front page sells the project; the docs sit one
 ## Domain and hosting
 
 - Domain: `nxdns.sh` (already owned).
-- Host: Cloudflare Pages.
-- Deploy: Gitea Actions builds the site on push to master, then `wrangler` uploads the output. A Cloudflare API token lives as a Gitea secret. (Cloudflare Pages has no Gitea integration, so direct upload is the mechanism.)
+- Host: Cloudflare, as a Worker serving the built site as static assets (`website/wrangler.jsonc`, which also binds the `nxdns.sh` custom domain). Cloudflare has folded Pages into Workers: wrangler's Pages commands now delegate to `wrangler deploy`.
+- Deploy: `.gitea/workflows/site.yml` builds the site on push to master and runs `wrangler deploy`. The Cloudflare API token is the Gitea secret `CLOUDFLARE_API_TOKEN`, and the account id the variable `CLOUDFLARE_ACCOUNT_ID`. Cloudflare has no Gitea integration, so CI uploads directly.
 
 ## Stack and layout
 

website/wrangler.jsonc

@@ -0,0 +1,17 @@
+// nxdns.sh: the built site, served as a Worker's static assets. Cloudflare has
+// folded Pages into Workers, and its Pages commands now delegate here. CI deploys
+// it with `wrangler deploy` (.gitea/workflows/site.yml).
+{
+	"name": "nxdns-site",
+	"compatibility_date": "2026-10-06",
+	"assets": {
+		"directory": "./dist",
+		// Astro writes every page as <route>/index.html and links them with a
+		// trailing slash; a missing page gets Starlight's 404.html with a 404.
+		"html_handling": "auto-trailing-slash",
+		"not_found_handling": "404-page",
+	},
+	"routes": [{ "pattern": "nxdns.sh", "custom_domain": true }],
+	"workers_dev": false,
+	"preview_urls": false,
+}