Queue Mode
Fair FIFO line
Visitors see position and estimated wait. Optional ahead / behind depth when you turn depth display on.
Open source · Fair queues
TideGuard
A fair waiting room for traffic surges. Visitors join a FIFO queue on the edge; your origin only sees the rate you admit.
The path through the surge
TideGuard is a corridor, not a dashboard. Traffic enters, holds, and exits at the rate your origin can survive.
Join
Every visitor enters the same FIFO line. No VIP cuts, no randomized order. Durable Objects keep that order strongly consistent for one named queue.
Wait
Heartbeats keep the line honest. Silent clients drop out. ETA stays pluggable so you can show a calm estimate without flooding your origin.
Admit
Admission is a controlled rate. Signed HMAC tokens prove a visitor earned their turn, then expire so capacity cannot leak past your policy.
Capabilities
Everything an operator needs for a surge: admission modes, signed access, branding, and the knobs that set capacity and cost.
Features
Lottery Mode
Equal-odds draw
Each admit picks uniformly among current waiters. The room shows odds in the pool instead of a hard line number.
HMAC admission tokens
Signed, time-limited access
Admitted visitors carry a token (cookie, Bearer, or query). No session database on your origin.
Admin setup wizard
Brand, mode, depth
Password onboarding, live branding preview, admission mode, and waiting-count toggle before KV save. Then a live control room with metrics.
Embeddable waiting room
iframe-ready /wait
Ship ?embed=1 for a calm in-page line. Return path and showWaiting overrides are query-driven.
Protected demo path
Token-gated pages
/demo redirects unauthenticated visitors into the queue, then lets them through with a valid admission token.
Cost calculator
Ballpark before launch
Estimate Workers and Durable Objects spend for one surge. Defaults match real poll (15s) and heartbeat (30s) intervals.
Operator REST API
Join through metrics
Typed routes for /join, /status, /leave, /heartbeat, /admit, /mode, /metrics, and /health for automation and ops.
Edge Durable Object queue
Strong consistency
One QueueRoom DO per queue name owns order. KV holds branding and admin hash only. No KV writes on join, status, or heartbeat.
Settings
Defaults from a fresh deploy. Override in wrangler.jsonc, secrets, or the admin wizard.
MAX_CONCURRENT_USERS
20
How many admitted visitors the protected surface can hold at once.
ADMIT_PER_SECOND
2
Steady admit rate used for release pacing and wait ETA.
ADMISSION_MODE
queue
queue (FIFO) or lottery. Switchable live from admin or POST /mode.
TOKEN_TTL_SECONDS
600
How long an admission token stays valid after admit.
HEARTBEAT_TIMEOUT_SECONDS
60
Drop silent waiting tabs that stop proving they are still here.
QUEUE_TIMEOUT_SECONDS
1800
Maximum time a visitor may stay in the waiting pool.
Status poll / heartbeat
15s / 30s
Waiting-room client intervals. Longer intervals cut Durable Object request volume.
DEFAULT_QUEUE
default
Named queue used when the request does not specify one.
Branding + depth
KV / admin
Colors, title, message, font, and showWaitingCount. Depth stats stay off until you enable them.
/demoFull page, widget, and API client (simulated)./costEstimate Cloudflare spend for your next drop./faqDeep answers for operators.
Hold the line on Black Friday
Clone the repo, set your admit rate, and put a fair queue in front of the origin that cannot take everyone at once.