Deploy Server

Update apps/server/wrangler.jsonc

Fill in your Worker name, D1 Database ID, R2 bucket name, and public variables:

{
  "name": "your-server-worker",          // Worker name — globally unique, determines default URL
  "main": "src/index.ts",
  "compatibility_date": "2025-06-15",
  "compatibility_flags": ["nodejs_compat"],
  "d1_databases": [
    {
      "binding": "DB",
      "database_name": "easystarter-db",
      "database_id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"  // D1 Database ID (UUID)
    }
  ],
  "vars": {
    "NODE_ENV": "production",
    "WEBSITE_URL": "https://your-app.com",           // Public URL of the web app
    "SERVER_URL": "https://your-server.workers.dev", // Public URL of this server Worker
    "GITHUB_CLIENT_ID": "your-github-client-id",     // Public — safe to put in vars
    "GOOGLE_CLIENT_ID": "your-google-client-id"      // Public — safe to put in vars
  },
  "r2_buckets": [
    {
      "binding": "STORAGE",
      "bucket_name": "easystarter-bucket"            // R2 bucket name
    }
  ]
}

Prepare production secrets (.env.production)

Create apps/server/.env.production with all sensitive variables. This file is never included in the build — it is only used by wrangler secret bulk in the next step.

# Better Auth — signs sessions; must be a long random string
BETTER_AUTH_SECRET=

# GitHub OAuth — Secret only; Client ID is already in wrangler.jsonc vars
GITHUB_CLIENT_SECRET=

# Google OAuth — Secret only; Client ID is already in wrangler.jsonc vars
GOOGLE_CLIENT_SECRET=

# Resend email service
RESEND_API_KEY=

# R2 public access URL (from R2.dev subdomain or custom domain)
R2_PUBLIC_URL=

# Stripe payments
STRIPE_SECRET_KEY=
STRIPE_WEBHOOK_SECRET=

# RevenueCat (only needed when mobile in-app purchases are enabled)
REVENUECAT_SECRET_API_KEY=

Key notes:

• Generate BETTER_AUTH_SECRET with openssl rand -base64 32 — minimum 32 characters
• Only the Secret keys for GitHub and Google go here; their Client IDs are already in wrangler.jsonc vars as public values
• R2_PUBLIC_URL is the public-facing URL of your R2 bucket — enable the R2.dev subdomain or bind a custom domain in the R2 bucket settings to get it
• Variables for unused integrations (e.g. RevenueCat) can be left empty or removed

Deploy the Worker

pnpm deploy:server

This compiles apps/server/src/index.ts and publishes it to Cloudflare Workers. On success:

Deployed your-server-worker triggers:
https://your-server-worker.your-subdomain.workers.dev

Save this URL — you'll need it when configuring the web app and updating SERVER_URL.

Push secrets

Encrypt and store all variables from .env.production in Workers Secrets:

pnpm -F server secrets:bulk:production

This runs wrangler secret bulk .env.production. Each value is encrypted at rest on Cloudflare's side and never appears in deployed code or logs.

Secrets and code deployments are independent. To update a sensitive variable, re-run this command — no redeploy needed.

Run database migrations

Apply the database schema to Cloudflare D1. The pnpm db:migrate command uses drizzle-kit's D1 HTTP driver, which requires these three values in apps/server/.dev.vars:

CLOUDFLARE_ACCOUNT_ID=        # Your Cloudflare account ID
CLOUDFLARE_API_TOKEN=         # API token with D1 Edit permission
CLOUDFLARE_D1_DATABASE_ID=    # D1 database UUID

Then run:

pnpm db:migrate

This creates all required tables in the production D1 database (users, sessions, subscriptions, billing, etc.).

After every schema change: run pnpm db:generate to produce a new migration file, then pnpm db:migrate to apply it to production.

Connect your GitHub repository

1. Go to Cloudflare Dashboard → Workers & Pages
2. Click Create → Workers → Connect to Git
3. Authorize Cloudflare to access your GitHub account and select your repository
4. Choose the deployment branch (usually main)

Push secrets

After connecting the repository but before the first build fires, push all secrets to Cloudflare from your local machine so the Worker has everything it needs on startup:

pnpm -F server secrets:bulk:production

This runs wrangler secret bulk .env.production, encrypting every variable in apps/server/.env.production into Worker Secrets.

Secrets and code deploys are independent. You only need to re-push when a secret value changes — not on every code update.

Enter the build configuration

Fill in the following settings on the build configuration page:

Root directory is / because this is a monorepo — pnpm workspaces must resolve dependencies from the repo root.

Run database migrations

Auto-deploy does not run database migrations automatically. After the first deploy, run this manually from your local machine:

pnpm db:migrate

Make sure apps/server/.dev.vars has these values filled in:

CLOUDFLARE_ACCOUNT_ID=
CLOUDFLARE_API_TOKEN=
CLOUDFLARE_D1_DATABASE_ID=

For every future schema change: run pnpm db:generate locally to generate a migration file, then pnpm db:migrate to apply it to the production D1.