Skip to content

deployment.md

Latest commit

 

History

History
54 lines (34 loc) · 2.41 KB

deployment.md

File metadata and controls

54 lines (34 loc) · 2.41 KB
Raw

Deployment

Meterboard intentionally does not provision billable infrastructure from source control. Do not deploy the API for real credentials until the remaining roadmap connector flows are implemented and reviewed.

1. Supabase

  1. Create a dedicated project.

  2. Apply every file in supabase/migrations/ in timestamp order with the SQL editor or CLI. The second migration is forward-only hardening for databases that already applied the baseline.

  3. Create a dedicated database login for the API; do not use Supabase anon/authenticated roles.

  4. Allow that login to switch to the migration-created restricted role:

    grant meterboard_app to meterboard_runtime;

  5. Use the runtime login's pooled connection string as DATABASE_URL.

Every store transaction executes SET LOCAL ROLE meterboard_app and sets transaction-local meterboard.owner_id. Forced RLS policies enforce ownership even if an application query accidentally omits its owner predicate.

2. Secrets with Doppler

Create a meterboard Doppler project with dev, stg, and prd configs. Populate the variables shown in both .env.example files. Generate a dedicated credential key with:

python -c 'import base64,os; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'

Never reuse the key for another product. Rotation requires decrypting and resealing each credential envelope.

3. WorkOS

Create a dedicated WorkOS application. Configure production redirect URIs and put its issuer/client values in Doppler. The runtime fails startup in staging or production unless WORKOS_ISSUER, WORKOS_AUDIENCE, DATABASE_URL, and CREDENTIAL_ENCRYPTION_KEY are all present.

The current public Next.js demo does not yet implement AuthKit login or callbacks.

4. API on Render

Connect the public repository and apply render.yaml. Inject secrets from Doppler or Render's secret environment UI.

  • /healthz: process liveness only.
  • /readyz: verifies auth configuration and database connectivity; use this for traffic readiness.

5. Web on Vercel

Import the repository with Root Directory apps/web. The current build is a static demo. Do not claim account connection support until AuthKit and API-backed onboarding are implemented.

Verification

curl -fsS https://API_HOST/healthz
curl -fsS https://API_HOST/readyz
curl -fsS https://API_HOST/v1/providers | python -m json.tool
curl -fsS https://WEB_HOST/ >/dev/null