Deployment

Production deployments are managed via Terraform, providing repeatable, auditable infrastructure provisioning across Cloudflare.

Provisioned Infrastructure

The Terraform configuration provisions:

• Cloudflare D1 Database: Distributed SQLite database instance (cloudflare_d1_database.api).
• D1 Database Migrations & Seeding: Automatically applies apps/api/drizzle/migrations/ using Wrangler and seeds default roles, permissions, and official OAuth clients during deployment.
• API Worker: The Hono-powered API Worker (cloudflare_workers_script.api) with D1, R2, and Workflow bindings.
• Dashboard Worker / Assets: Deploys the built React single-page app (cloudflare_workers_script.dashboard).
• Cloudflare R2 Bucket: Object storage for user profile avatars (cloudflare_r2_bucket.profile).
• Cloudflare Workflows: Background durable execution workflow for scheduled account lifecycles.
• DNS Records: Custom subdomains for your API and dashboard.

---

Deployment Workflow

One-Command Deployment (Recommended)

Run the unified deploy script from the monorepo root:

bun run deploy

This single command orchestrates:

1. Generating Terraform variables and cryptographically secure OIDC/SSH CA keys (bun run vars).
2. Compiling the React dashboard and Hono API worker bundles (bun run build).
3. Provisioning Cloudflare resources via Terraform (terraform -chdir=terraform apply).
4. Applying database migrations and seeding standard D1 values (bun run seed).

Step-by-Step Manual Workflow

1. Build Artifacts: Compile the Worker and dashboard bundles from the root:

   bun run build

2. Initialize Terraform:

   terraform -chdir=terraform init

3. Generate Variables & Keys: Ensure .env is populated, then derive your Terraform configuration:

   bun run vars

   This generates terraform/terraform.tfvars including the OIDC signing key and Ed25519 SSH CA key.

4. Review Plan:

   terraform -chdir=terraform plan

5. Apply Configuration:

   terraform -chdir=terraform apply

6. Seed Standard Values: Seed the database with standard permissions, roles, and clients:

   bun run seed

---

Standard Database Seeding

Every deployment guarantees the remote Cloudflare D1 database is seeded with essential baseline data via scripts/seed-d1.ts. The script is completely idempotent (utilizing INSERT OR IGNORE and ON CONFLICT DO UPDATE), making it safe to execute repeatedly without duplicating rows or wiping tenant configuration.

The following standard values are provisioned:

1. System Permissions (SYSTEM_PERMISSIONS):

   • Platform superadmin wildcard: *
   • User administration: users:read, users:write, users:delete, users:lifecycle, users:password-reset, users:*
   • Role & permission management: roles:read, roles:write, roles:assign, permissions:read, roles:*
   • OAuth client management: oauth_clients:read, oauth_clients:write, oauth_clients:*
   • System settings & notifications: settings:read, settings:write, notifications:read, notifications:write
   • SSH & Certificate Authority: ssh:keys:manage, ssh:cert:issue, ssh:ca:read, ssh:cert:list, ssh:cert:revoke, ssh:keys:admin, ssh:*

2. Default System Roles (DEFAULT_ROLES):

   • admin (Administrator): Unrestricted superadministrator privileges (*).
   • user (User): Baseline authenticated member permissions for SSH self-service (ssh:cert:issue, ssh:keys:manage, ssh:ca:read).
   • everyone (Everyone): Universal role applied to all requests, permitting unauthenticated SSH CA public key inspection (ssh:ca:read).

3. Role-Permission Associations:

   • Links the baseline permissions to their corresponding system roles in role_permissions.

4. Official Muljax CLI OAuth Client (muljax-cli):

   • Registered as a public client without a secret hash.
   • Pre-configured with RFC 8252 loopback callback endpoints (http://127.0.0.1/callback, http://localhost/callback).
   • Pre-authorized for CLI scopes: openid, profile, email, offline_access, ssh:cert:issue, ssh:ca:read, ssh:keys:manage.

Local Development Seeding

When developing locally with wrangler dev and Miniflare SQLite, seed your local D1 instance using:

bun run seed:local

---

Terraform Outputs

After applying, Terraform prints output values:

Output Variable	Description
api_url	Public HTTPS URL of the API Worker
dashboard_url	Public HTTPS URL of the web dashboard
oidc_issuer	Canonical issuer URL for OpenID Connect clients
database_id	Cloudflare D1 database ID
database_name	Cloudflare D1 database name
profile_bucket_name	Cloudflare R2 bucket name for user avatars
api_worker_name	Deployed API Worker script name
dashboard_worker_name	Deployed Dashboard Worker script name
instance_name	Application brand name

View them anytime using:

terraform -chdir=terraform output