Configuration

Configuration layers#

TanStarter SES separates product choices from secrets:

• src/config/website.ts contains product identity and feature flags.
• src/config/types.ts defines the typed configuration contract.
• .env and .env.local contain local values.
• .env.production is generated for production values.
• Wrangler secrets hold sensitive production credentials.
• wrangler.jsonc declares Cloudflare bindings and custom domains.

Routes import domain APIs. They should not read vendor secrets directly.

Public provider selectors#

Provider selectors use VITE_ names because they are part of typed product configuration:

VITE_MAIL_PROVIDER=ses
VITE_NEWSLETTER_PROVIDER=resend
VITE_PAYMENT_PROVIDER=stripe
VITE_BASE_URL=https://app.example.com

A selector chooses a registry adapter. The corresponding secret variables remain server-only.

Local preview adapters#

MAIL_PREVIEW=true
NEWSLETTER_PREVIEW=true
NOTIFICATION_PREVIEW=true

These settings are intentional development implementations. They let acceptance tests complete without third-party accounts. Production generation sets them to false so missing credentials fail visibly.

Authentication#

BETTER_AUTH_SECRET=replace-with-a-long-random-secret
ADMIN_EMAILS=owner@example.com,ops@example.com
GOOGLE_CLIENT_ID=...
GOOGLE_CLIENT_SECRET=...

Google OAuth is exposed only when both Google values exist. ADMIN_EMAILS is evaluated when a user is first created.

Cloudflare bindings#

The Worker expects:

DB       D1
STORAGE  R2
CACHE    KV
EMAIL    Cloudflare Send Email
AI       Workers AI

Regenerate the TypeScript environment after binding changes:

pnpm cf-typegen

Provider-specific values#

See the dedicated guides for AWS SES, Payments, AI, and Newsletter and notifications.

Secret handling rules#

• Never commit .env, .env.local, .dev.vars, Wrangler state, or provider keys.
• Keep .env.example current with variable names but no real values.
• Use wrangler secret put or the setup CLI for production secrets.
• Rotate Better Auth and provider credentials through the owning platform.
• Treat webhook secrets independently from checkout API keys.