Deploy to Cloudflare

Pre-deployment checks#

pnpm check
pnpm build
pnpm e2e
pnpm exec wrangler deploy --dry-run

The dry run validates packaging and bindings without creating live resources.

Deploy with the setup CLI#

pnpm tanstarter create my-saas \
  --mail ses \
  --domain app.example.com \
  --deploy

The resumable deployment can validate Cloudflare authentication, provision declared resources, rebuild with the final base URL, apply remote D1 migrations, synchronize secrets, deploy the Worker, and poll the live URL.

GitHub Actions production deployment#

The repository CI has two gates on pushes to main: verify runs build, checks, and Playwright first; Deploy production runs only after verification succeeds. Pull requests never deploy.

Configure these repository values:

Variable: CLOUDFLARE_ACCOUNT_ID
Variable: PRODUCTION_URL
Secret:   CLOUDFLARE_API_TOKEN

Use a dedicated Cloudflare API token scoped to the deployment account rather than a personal OAuth refresh token. The deploy build injects VITE_BUILD_SHA=${{ github.sha }} and /api/version exposes that SHA, so release automation can prove the exact commit currently serving production.

Deploy directly#

pnpm deploy
pnpm db:migrate:remote

Use the CLI for new projects because it coordinates resources and state. Direct Wrangler deployment is useful after the project is already provisioned.

Declared bindings#

The Worker expects D1 DB, R2 STORAGE, KV CACHE, Send Email EMAIL, and Workers AI AI.

Custom domains#

Add custom domains to the top-level routes array in wrangler.jsonc:

{
  "pattern": "app.example.com",
  "custom_domain": true
}

This repository deploys the product and documentation domains to the same Worker. The documentation domain redirects its root to /docs and shares the same build, release, and provider configuration.

Secret synchronization#

Provider selectors can be public configuration. API keys, webhook secrets, Better Auth secrets, AWS credentials, and OAuth secrets must be Wrangler secrets.

Smoke verification#

After deployment:

1. request public pages and machine-readable endpoints;
2. confirm anonymous protected-route redirects;
3. apply and inspect remote D1 migrations;
4. upload, download, and delete an R2 test object through the product;
5. exercise KV through a real module workflow;
6. run a Workers AI task;
7. verify DNS, TLS, SNI, and both custom domains.