Operations and deploy

Local day-0 loop, Cloudflare dogfood deploy, migrate, seed, and day-2 care.

Local day-0 loop

Most development never needs Cloudflare credentials. Install, migrate, seed, typecheck, test, and run e2e locally with non-interactive gates.

pnpm install
pnpm db:migrate
pnpm seed
pnpm typecheck
pnpm test:ci
# optional: start API + web, then
pnpm test:e2e

Deploy prerequisites

Dogfood deploy needs a Cloudflare account, API token with Workers/D1/R2/Queues permissions as required, account id, and secrets channel outside git. Set SPEAKEROPS_D1_DATABASE_ID when leaving wrangler placeholders. TURNSTILE_SECRET_KEY is set via wrangler secret put for production Workers.

NamePurpose
CLOUDFLARE_API_TOKENWrangler auth
CLOUDFLARE_ACCOUNT_IDAccount scope
SPEAKEROPS_D1_DATABASE_IDReal D1 id
SMOKE_BASE_URLOptional health re-smoke base
DOGFOOD_SKIP_DEPLOY1 = health-only path
DEPLOY_DRY_RUN1 = validate without network deploy

Deploy shape

Operator scripts build the Worker, apply migrations remotely as documented, set secrets, deploy, and smoke GET /health for 200. Custom domain cutover may be separate from the workers.dev dogfood claim. Learn has its own static worker and wrangler.learn.toml for learn.speakerops.org.

  1. Export Cloudflare credentials in a secure shell session (not committed files).
  2. Ensure D1 database id and bindings match wrangler config.
  3. Put required secrets with wrangler secret put.
  4. Run the deploy script for the target environment.
  5. Smoke GET /health and critical login path.
  6. Seed remote demo data when the environment expects it.

Day-2 care

Apply new migrations forward with the documented migrate path. Use D1 Time Travel only with explicit operator care for rollback scenarios. Rotate API keys and Turnstile secrets on a schedule. Watch queue drain for email and projection backlogs.