Public preview

Cheesy Games

A family games platform: four games, a web portal with unified accounts, and deployment tooling, built as a monorepo on Cloudflare. The portal is public; the catalog is rights-aware and family games stay private.

Cloudflare Workers
Rust
Next.js
D1

Cheesy Games public portal with sign-in and a notice that no public games are available — Open full-size screenshot or illustration

What it is

Cheesy Games is a small arcade platform I build and operate: a web portal with unified accounts, four games, shared platform kits, and the deployment and recovery tooling that keeps it running on Cloudflare.

The portal is the public front door at cheesy-games.com. It handles sign-in, shows the game catalog, and links to each game that the signed-in player is entitled to launch.

What is public

The portal is the entry point for the platform. Catalog visibility depends on account entitlements and each game’s distribution approval. Family-only games are not offered for general public play. Visit the portal for its current access options.

This page deliberately does not embed or deep-link family-only games.

Platform architecture

Portal: a Cloudflare Worker serving the portal UI, an authorization-code OIDC provider with PKCE, short-lived asymmetric tokens, replay protection, recovery codes, data export, and account deletion.
Identity: every game adapter keys account links to an immutable platform subject; identity linking uses the platform subject rather than a display-name match.
Games: a mix of static web games with a Worker/D1 cloud backend and realtime Rust/Next services for LAN play.
Registry: a canonical game catalog compiles into player-facing registries; the portfolio never bundles it.
Operations: repository gates, an artifact scanner that rejects forbidden identifiers in staged builds, and a generated operations inventory that marks unverified claims as unverified.

Engineering decisions

Rights-aware visibility instead of hidden links. The platform defines catalog visibility and backend entitlement checks separately. The logged-out portal currently lists no games for public play. This portfolio does not ship a game catalog.

OIDC in the portal, enforced again at the game backend. The family LAN games re-check the portal’s family entitlement at their own backend rather than trusting a client-side check, so a crafted launch link is not enough.

Honest operations record. Deployment evidence is tracked in a generated inventory that says unverified where something has not been observed, which keeps the marketing story and the operational truth the same document.

Stack

Cloudflare Workers with static assets and D1, Rust and Next.js game services, and a compiled platform registry.