Turn email newsletters into private RSS feeds

Prerequisites

You need a free Cloudflare account with a domain managed by Cloudflare DNS, and Node.js ≥ 18.

• Cloudflare account (free tier is enough)
• A domain with DNS managed by Cloudflare
• Node.js ≥ 18 & npm
• Git

Clone & authenticate

Clone the repo and log in to Cloudflare via Wrangler. This opens a browser window to authorize the CLI.

$ git clone https://github.com/juherr/kill-the-news.git
$ cd kill-the-news
$ npm install
$ npx wrangler login

Run the setup script

The interactive setup script creates the KV namespace, sets the admin password secret, and writes wrangler.toml for you.

$ bash setup.sh

# The script will ask for:
#   - Your domain (e.g. newsletters.example.com)
#   - An admin password (stored as a Wrangler secret)
#   - Whether to enable R2 for attachments (optional)

This generates wrangler.toml from the example template. Do not commit it — it is gitignored.

Deploy the Worker

$ npm run deploy

# Wrangler compiles the Worker, uploads it to Cloudflare,
# and prints the Worker URL. Your admin UI will be live at:
#   https://<your-domain>/admin

Configure email ingestion

Choose how incoming emails reach your Worker:

Optional: enable attachment storage

To store email attachments and expose them as RSS enclosures, create an R2 bucket and bind it in wrangler.toml:

[[r2_buckets]]
binding = "ATTACHMENT_BUCKET"
bucket_name = "kill-the-news-attachments"

Attachments will be served at /files/:id/:filename and linked as <enclosure> elements in the RSS feed.

Harden with WAF rate limiting

Protect your endpoints against abuse using Cloudflare WAF custom rate-limiting rules — no code changes required, pure infrastructure.

Recommended limits:

Terraform equivalent (supports method filtering and longer periods — requires a paid Cloudflare plan):

resource "cloudflare_ruleset" "rate_limiting" {
  zone_id = var.cloudflare_zone_id
  name    = "kill-the-news rate limiting"
  kind    = "zone"
  phase   = "http_ratelimit"

  rules {
    description = "Rate limit /api/inbound"
    expression  = "(http.request.uri.path eq \"/api/inbound\" and http.request.method eq \"POST\")"
    action      = "block"
    ratelimit {
      characteristics     = ["ip.src"]
      period              = 60
      requests_per_period = 60
      mitigation_timeout  = 60
    }
  }

  rules {
    description = "Rate limit /admin"
    expression  = "starts_with(http.request.uri.path, \"/admin\")"
    action      = "managed_challenge"
    ratelimit {
      characteristics     = ["ip.src"]
      period              = 60
      requests_per_period = 20
      mitigation_timeout  = 300
    }
  }
}

These rules run at the Cloudflare edge before the Worker is invoked — zero latency impact on normal traffic. If ForwardEmail's delivery IPs ever trigger the /api/inbound limit, add them as an IP Access Rule with action Allow under Security → WAF → Tools.