← All posts · 2026-10-29

Moving FakeOrg to Cloudflare Workers & R2 Parquet Datamarts

Why we replaced our static site with Astro on Cloudflare Workers to serve authenticated, byte-range queryable Apache Parquet honeynet datasets straight from R2.

Static blogs are fine for text, useless when you need to gate and stream gigabytes of columnar adversary telemetry at the edge.

We wiped the old Hugo stack and moved fakeorg.com to Astro + Cloudflare Workers (workerd) backed by Cloudflare KV for session state and Cloudflare R2 (fakeorg-datamart) for zero-egress Apache Parquet storage.

Why R2 + HTTP 206 Byte-Range Workers?

Every day our synthetic honeynets generate shell transcripts, network flows, and payload metadata. Instead of forcing analysts to pull entire daily dumps before running a single filter, our Worker endpoint (/api/datamart/<key>.parquet) forwards Range and conditional If-Match / If-None-Match headers directly to R2:

const object = await env.DATAMART.get(key, {
  range: request.headers,
  onlyIf: request.headers,
});

How DuckDB Queries R2 Over HTTP 206

When you point DuckDB (httpfs), Polars, or PyArrow at a /api/datamart/*.parquet URL with a Bearer token:

The client sends a tiny Range request for the final 8 bytes of the file (PAR1 magic + footer length) and reads the Parquet footer metadata.
Predicate pushdown skips irrelevant row groups entirely.
Only the exact column byte ranges needed for your query cross the wire via HTTP 206 Partial Content.

Schema & Partition Layout

Each daily .parquet partition in fakeorg-datamart is sorted by (target_service, timestamp) to maximize dictionary compression and row-group min/max pruning:

Column	Type	Description
`timestamp`	`TIMESTAMP_NS`	UTC ingress timestamp
`synthetic_org`	`VARCHAR`	Pseudonymized decoy tenant (`synthetic-ent-09`)
`target_service`	`VARCHAR`	Decoy surface (`active_directory`, `ssh_bastion`, `iam_sts`)
`attacker_ip`	`VARCHAR`	Raw unmasked source IPv4/IPv6
`attacker_asn`	`UINT32`	Ingress Autonomous System Number
`ja4_fingerprint`	`VARCHAR`	TLS client fingerprint
`command_line`	`VARCHAR`	Captured interactive shell / exploit payload

Edge Auth vs. Pre-Signed S3 URLs

Pre-signed S3 URLs leak in shell history and expire mid-analysis. By terminating authentication inside a Cloudflare Worker middleware in front of R2:

Browser operators unlock a Cloudflare KV session (SESSION binding) on /samples.
Headless pipelines & DuckDB pass Authorization: Bearer <API_TOKEN> on every range read with zero S3 IAM ceremony.

Try It Locally or in the Browser

Check out the full platform overview on our Service page, or jump straight to Samples to unlock the datamart and pull .parquet partitions.