// Case Study · Branded Media Library
Branded Media Library
Cloudflare Workers · DAM and CDN · 2 Domains, 1 Worker
Giraux Fine Jewelry was paying per-image SaaS pricing for a CDN that still shipped 80 MB product pages. I replaced it with one Cloudflare Worker serving two domains: an access-gated asset manager on media.giraux.com and a public hotlink CDN on cdn.giraux.com. Today it holds 476,000+ files across 19 folders — 46 GB of media — cut page weight 97%, and saves ~$1,440/yr over the old stack. Zero framework: the whole admin UI is server-rendered template literals.
// 01 · Live in production
Six real diamonds from Giraux's catalog. Each iframe is the actual viewer used in RapNet listings and the live storefront. Drag to rotate. Pinch to zoom. Fullscreen if you want a closer look.
// 02 · The admin and the CDN
One Worker, two personalities. media.giraux.com is the Cloudflare-Access-gated admin: drag-drop upload, multipart for files over 90 MB, search, folders, soft-delete trash, in-browser PDF and video preview, automatic format conversion. cdn.giraux.com is the public side — read-only hotlinks embedded in the Shopify storefront, RapNet listings, and partner sites.
// 03 · How it works
Smart image pipeline
Every image request routes through a tiered cache. Large sizes come from pre-baked WebP versions (free and instant). Smaller sizes run through Cloudflare's image API on demand. Missing files fall back to a live transform with two safety nets. Net result: 360° product pages dropped from ~80 MB to ~2.5 MB. Competitive with Sirv at a fraction of the running cost.
360° spin viewer
Custom viewer that renders .spin JSON manifests with drag-to-rotate momentum, pinch zoom, fullscreen, and an embed mode that hides the surrounding UI so the viewer slots cleanly into RapNet listings and partner sites. Convert video to .spin or unwind a .spin back to MP4 in the admin UI.
Hardened against the usual web attacks
Every dynamic string in the admin UI is escaped against script injection. Every file operation validates its path against directory-traversal attempts. Renames and moves are atomic, with automatic conflict resolution on collision. Strict Content Security Policy. The admin is auth-gated by Cloudflare Access; the public CDN is read-only and never exposes admin endpoints.
Full feature surface
- Branded admin on a custom subdomain (media.giraux.com)
- Google login via Cloudflare Access — no auth code to maintain
- Folder organization, search, and bulk operations
- Hosts PDFs, images (PNG, JPG, WebP), and video (MP4, MOV)
- Two-way .spin conversion: video to 360° viewer and back
- Hotlink URLs that drop into Shopify, RapNet, or anywhere else
Built solo, running in production
Designed, shipped, and operated by one person — the same way I run the rest of the Giraux stack. If this is the kind of engineering you need on your team, my resume has the full picture.