1 Buat Worker, D1, dan R2

2 Skema Tabel D1

-- wrangler d1 execute sipadi-db --file=schema.sql
CREATE TABLE users (
  id TEXT PRIMARY KEY, email TEXT UNIQUE, password_hash TEXT,
  nama TEXT, role TEXT, satker TEXT, status TEXT DEFAULT 'aktif'
);
CREATE TABLE register_nikah (
  id TEXT PRIMARY KEY, no_akta TEXT, no_pmrk TEXT, tgl_nikah TEXT,
  nama_suami TEXT, nik_suami TEXT, nama_istri TEXT, nik_istri TEXT,
  kua TEXT, file_url TEXT, created_by TEXT, created_at TEXT
);
CREATE TABLE ijazah (
  id TEXT PRIMARY KEY, no_ijazah TEXT, nama_siswa TEXT, nisn TEXT,
  madrasah TEXT, jenjang TEXT, file_url TEXT, created_by TEXT, created_at TEXT
);
CREATE TABLE pegawai (
  id TEXT PRIMARY KEY, nama TEXT, nip TEXT, satker TEXT,
  jabatan TEXT, status TEXT
);

3 Endpoint Worker (Auth & CRUD)

// src/index.js — Worker utama, route ke D1 + R2
export default {
  async fetch(req, env) {
    const url = new URL(req.url);

    if (url.pathname === '/auth/login' && req.method === 'POST') {
      const { email, password } = await req.json();
      const user = await env.DB.prepare(
        'SELECT * FROM users WHERE email = ?'
      ).bind(email).first();
      if (!user || !(await verifyPassword(password, user.password_hash)))
        return Response.json({ error: 'Email atau password salah' }, { status: 401 });
      const token = await signToken(user); // JWT sederhana via Web Crypto
      return Response.json({ token, user: { id: user.id, nama: user.nama, role: user.role, satker: user.satker } });
    }

    if (url.pathname === '/nikah' && req.method === 'GET') {
      const auth = await requireAuth(req, env);
      if (!auth) return Response.json({ error: 'Unauthorized' }, { status: 401 });
      const { results } = await env.DB.prepare('SELECT * FROM register_nikah').all();
      return Response.json(results);
    }

    // ... endpoint lain: /ijazah, /pegawai, /operators, /verify/:hash, dst.
    return new Response('Not found', { status: 404 });
  }
};

4 Upload File ke R2

// Worker — terima file dan simpan ke R2
if (url.pathname.startsWith('/upload/') && req.method === 'PUT') {
  const auth = await requireAuth(req, env);
  if (!auth) return Response.json({ error: 'Unauthorized' }, { status: 401 });
  const key = url.pathname.replace('/upload/', '');
  await env.ARSIP_BUCKET.put(key, req.body, {
    httpMetadata: { contentType: req.headers.get('Content-Type') || 'application/octet-stream' }
  });
  return Response.json({ url: `${env.R2_PUBLIC_URL}/${key}` });
}

5 Deploy Worker

⚙ Konfigurasi URL & Secret

Frontend ini satu file HTML statis tanpa proses build, sehingga tidak memakai environment variable Netlify untuk konfigurasi. URL Worker dan R2 di-hardcode langsung di dalam index.html (konstanta WORKER_URL dan R2_URL) — aman karena keduanya memang URL publik, bukan rahasia.

📄 File netlify.toml (Konfigurasi Lanjutan)

# netlify.toml — letakkan di root folder project

[build]
  publish = "dist"           # folder output build
  command = "npm run build"  # perintah build

[build.environment]
  NODE_VERSION = "18"

# Redirect untuk SPA (React Router)
[[redirects]]
  from   = "/*"
  to     = "/index.html"
  status = 200

# Custom headers untuk keamanan
[[headers]]
  for = "/*"
  [headers.values]
    X-Frame-Options        = "DENY"
    X-XSS-Protection       = "1; mode=block"
    X-Content-Type-Options = "nosniff"
    Referrer-Policy        = "strict-origin-when-cross-origin"
    Content-Security-Policy = "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://unpkg.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; connect-src 'self' https://sipadi-worker.kemenagjember.workers.dev https://pub-cb38c139fc6248b0a2cd34173379ba58.r2.dev https://api.mistral.ai;"

🔐 Domain Kustom (Opsional)

✅ Checklist Sebelum Go-Live

• File index.html ada di root atau folder publish yang dikonfigurasi
• WORKER_URL dan R2_URL di frontend mengarah ke Worker/bucket produksi (bukan dev)
• NIK_SECRET sudah diganti dari placeholder sebelum data produksi masuk
• CORS di Worker mengizinkan origin domain Netlify produksi
• netlify.toml dikonfigurasi (terutama command = "" dan redirect SPA)
• Password default semua operator sudah diganti
• Uji coba login dari domain Netlify produksi (bukan localhost)
• Verifikasi operasi CRUD (nikah, ijazah, pegawai, operator) dari domain production
• Endpoint Worker (auth, CRUD, upload R2, verify QR) sudah dites satu per satu
• Backup awal data D1 sudah dilakukan sebelum distribusi ke 51 satker