Production Deploy

Deploy Flow

1. Update wrangler.jsonc — Worker name, D1/R2/KV/Queue IDs, public vars
2. Set secrets — wrangler secret put for each sensitive variable
3. Remote migrations — pnpm db:migrate:remote (when migrations/ changed)
4. Build and deploy — pnpm run deploy
5. Verify — see Verify checklist

Important

Use pnpm run deploy, not pnpm deploy (pnpm treats the latter as a package-management command).

Set Secrets Example

pnpm wrangler secret put BETTER_AUTH_SECRET
pnpm wrangler secret put GOOGLE_CLIENT_SECRET
pnpm wrangler secret put STRIPE_SECRET_KEY
pnpm wrangler secret put STRIPE_WEBHOOK_SECRET
pnpm wrangler secret put RESEND_API_KEY
pnpm wrangler secret put R2_ACCESS_KEY_ID
pnpm wrangler secret put R2_SECRET_ACCESS_KEY
pnpm wrangler secret list

Public vars in wrangler.jsonc

Non-sensitive values can live in vars (included in build or runtime config):

{
  "vars": {
    "VITE_SITE_URL": "https://your-domain.com",
    "VITE_GA_MEASUREMENT_ID": "G-XXXXXXXX",
    "VITE_POSTHOG_HOST": "https://us.i.posthog.com",
    "R2_PUBLIC_URL": "https://oss.your-domain.com",
    "EMAIL_FROM": "Your App <no-reply@your-domain.com>"
  }
}

Deploy Command

pnpm run deploy

Equivalent to:

1. vite build — SSR and client bundles
2. Copy Sentry instrument.server.mjs
3. wrangler deploy — publish Worker

Build-time Variables

After changing VITE_*, redeploy — updating secrets alone is not enough.

Database Migrations

pnpm db:migrate:remote

Run before each deploy when migrations/ has updates.

Warning

Never commit .dev.vars, service account JSON, or Stripe/Resend keys. Use Stripe live keys in production.