$ show tobilg/cloudflare-ducklake
This repository implements a Cloudflare Worker that proxies HTTP requests to a Durable Object-backed Container running a DuckDB API. The Worker forwards environment variables to enable optional features: API token authentication, R2 Data Catalog for Iceberg support, and Postgres+R2 for DuckLake integration. The Container initializes DuckDB lazily on first request, loads extensions (httpfs, avro, iceberg, ducklake, postgres_scanner, spatial, nanoarrow), and conditionally attaches remote catalogs based on available secrets. The API provides endpoints for schema inspection and SQL querying, with query filtering to block dangerous operations. The architecture separates concerns: Worker handles routing and secret forwarding, Container manages the Hono server and DuckDB lifecycle, and lib modules encapsulate database utilities, logging, and query safety.
The LLM identified 2 files worth highlighting for reuse:
Manages the lifecycle of an in-memory DuckDB instance, including lazy initialization, loading of extensions, and conditional attachment of remote catalogs (Iceberg via R2 Data Catalog and DuckLake via Postgres and R2). Provides safe query execution with filtering and metadata extraction. Demonstrates non-obvious skill in managing DuckDB state and adapting to environment-specific configurations.
Implements a query filter that blocks dangerous SQL commands (INSTALL, LOAD, SET, PRAGMA, SECRET, and non-allowed duckdb_* functions) while allowing read-only queries and internal initialization queries. Demonstrates a non-obvious skill in securing a user-facing SQL API by using a denylist approach with bypass for trusted operations.