Running a Monitoring SaaS on Cloudflare Workers + Supabase for Almost Nothing

Merlonix is a monitoring product that provides continuous uptime, SSL/TLS, DNS, email authentication, blacklists, Certificate Transparency, Core Web Vitals, and MCP server monitoring for agencies. To keep infrastructure costs low until revenue is generated, the system runs on eight Cloudflare Workers, including an HTTP API worker and seven background workers that handle scheduling, check-running, vendor-checking, vendor-fetching, dead-letter queue management, browser-checking, and database backup.

The frontend consists of two static Cloudflare Pages projects for marketing and the app, with dynamic content served through the API worker. Communication between components is facilitated by Cloudflare Queues, and state is managed using one Supabase Postgres database with forced row-level security for tenant data. The system employs a revenue-gated SLA throttle that only enforces full monitoring cadence when a paying customer is present, ensuring cost-effectiveness.

An issue was discovered where a database blip could silently throttle monitoring cadence, but this was fixed by tracking failures and notifying operators through Sentry and structured logs. To avoid relying solely on Cloudflare for monitoring, the system uses Supabase with pg_cron and the http extension for external watchdog monitoring, ensuring redundancy and no shared faults.

The monitoring system also includes SSRF protection by checking DNS resolution against a blocklist of private IP ranges and limiting response and request sizes to prevent stalls and memory ballooning.