Skip to content
This repository was archived by the owner on Mar 24, 2026. It is now read-only.

Commit 24205cc

Browse files
kzndotshkzndotsh
committed
chore(env): update environment URLs and streamline deployment scripts
Revise the Cloudflare environment URLs in type definitions to reflect the new development domain. Update deployment scripts in package.json for improved handling of environment variables and streamline the build process. Enhance documentation in README and PNPM_SCRIPTS.md to clarify setup instructions for Cloudflare bindings and secrets management, ensuring a better developer experience.
1 parent 1a6c45a commit 24205cc

18 files changed

+451
-1046
lines changed

‎.github/scripts/set-cloudflare-secrets.sh‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
#!/bin/bash
2+
3+
# Script to set prefixed secrets in Cloudflare Worker from GitHub Environment secrets/variables
4+
# This is used by GitHub Actions CI/CD workflow
5+
# Mirrors the pattern used in scripts/secrets.sh for consistency
6+
7+
set -e
8+
9+
# Environment type (DEV or PROD) - passed as first argument
10+
ENV_TYPE=${1:-DEV}
11+
12+
# Validate environment parameter
13+
if [ "$ENV_TYPE" != "DEV" ] && [ "$ENV_TYPE" != "PROD" ]; then
14+
echo "Error: Invalid environment type. Use 'DEV' or 'PROD'."
15+
exit 1
16+
fi
17+
18+
PREFIX="$ENV_TYPE"
19+
WORKER_NAME="allthingslinux"
20+
21+
echo "🔐 Setting $ENV_TYPE prefixed secrets in Cloudflare Worker..."
22+
echo "Worker: $WORKER_NAME"
23+
echo "Prefix: $PREFIX"
24+
echo ""
25+
26+
# Helper function to set a prefixed secret (same pattern as scripts/secrets.sh)
27+
set_prefixed_secret() {
28+
local BASE_NAME=$1
29+
local SECRET_VALUE=$2
30+
local PREFIXED_NAME="${PREFIX}_${BASE_NAME}"
31+
32+
if [ -z "$SECRET_VALUE" ]; then
33+
echo "⚠ Skipping $PREFIXED_NAME (value not provided)"
34+
return 0
35+
fi
36+
37+
echo "Setting $PREFIXED_NAME..."
38+
if echo "$SECRET_VALUE" | pnpm exec wrangler secret put "$PREFIXED_NAME" --name "$WORKER_NAME"; then
39+
echo "✓ $PREFIXED_NAME set successfully"
40+
return 0
41+
else
42+
echo "✗ Failed to set $PREFIXED_NAME"
43+
return 1
44+
fi
45+
}
46+
47+
ERRORS=0
48+
49+
# Sensitive secrets (from GitHub Environment Secrets)
50+
# These are passed as environment variables from the workflow
51+
set_prefixed_secret "QUICKBOOKS_CLIENT_ID" "${QUICKBOOKS_CLIENT_ID}" || ((ERRORS++))
52+
set_prefixed_secret "QUICKBOOKS_CLIENT_SECRET" "${QUICKBOOKS_CLIENT_SECRET}" || ((ERRORS++))
53+
set_prefixed_secret "QUICKBOOKS_REFRESH_TOKEN" "${QUICKBOOKS_REFRESH_TOKEN}" || true
54+
set_prefixed_secret "QUICKBOOKS_REALM_ID" "${QUICKBOOKS_REALM_ID}" || true
55+
set_prefixed_secret "QUICKBOOKS_ADMIN_KEY" "${QUICKBOOKS_ADMIN_KEY}" || ((ERRORS++))
56+
set_prefixed_secret "GITHUB_TOKEN" "${GITHUB_TOKEN}" || true
57+
set_prefixed_secret "MONDAY_API_KEY" "${MONDAY_API_KEY}" || ((ERRORS++))
58+
59+
# Non-sensitive variables (from GitHub Environment Variables)
60+
# Note: Even though not sensitive, we set as Cloudflare secrets to maintain prefix structure for environment isolation
61+
set_prefixed_secret "MONDAY_BOARD_ID" "${MONDAY_BOARD_ID}" || ((ERRORS++))
62+
set_prefixed_secret "DISCORD_WEBHOOK_URL" "${DISCORD_WEBHOOK_URL}" || ((ERRORS++))
63+
64+
# QUICKBOOKS_ENVIRONMENT (optional, auto-detected if not set)
65+
if [ -n "${QUICKBOOKS_ENVIRONMENT}" ]; then
66+
set_prefixed_secret "QUICKBOOKS_ENVIRONMENT" "${QUICKBOOKS_ENVIRONMENT}" || ((ERRORS++))
67+
fi
68+
69+
echo ""
70+
if [ $ERRORS -eq 0 ]; then
71+
echo "✓ All ${PREFIX}_* prefixed secrets set successfully"
72+
exit 0
73+
else
74+
echo "✗ Secret operations completed with $ERRORS error(s)"
75+
echo "Check output above for details."
76+
exit 1
77+
fi

‎.github/workflows/deploy.yml‎

Lines changed: 33 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,10 @@ jobs:
1818
name: Deploy to ${{ github.ref == 'refs/heads/main' && 'Production' || 'Development' }}
1919
runs-on: ubuntu-latest
2020
# Use GitHub Environments: 'prod' for main branch, 'dev' for PRs/other branches
21-
environment: ${{ github.ref == 'refs/heads/main' && 'prod' || 'dev' }}
21+
# URLs appear on the deployments page and in the workflow run visualization
22+
environment:
23+
name: ${{ github.ref == 'refs/heads/main' && 'prod' || 'dev' }}
24+
url: ${{ github.ref == 'refs/heads/main' && 'https://allthingslinux.org' || 'https://allthingslinux.dev' }}
2225
permissions:
2326
contents: read
2427
deployments: write
@@ -40,47 +43,46 @@ jobs:
4043
- name: Install dependencies
4144
run: pnpm install --frozen-lockfile
4245

46+
- name: Setup Cloudflare Bindings (R2, KV)
47+
run: |
48+
echo "🔧 Setting up Cloudflare bindings (R2, KV) if they don't exist..."
49+
chmod +x scripts/setup-bindings.sh
50+
# Run setup-bindings script - it's idempotent and checks for existing resources
51+
# Use || true to prevent workflow failure if bindings already exist or script has minor issues
52+
scripts/setup-bindings.sh || true
53+
env:
54+
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
55+
4356
- name: Build application
4457
run: pnpm run build:all
4558

4659
- name: Set secrets in Cloudflare Worker (Prefixed)
4760
run: |
4861
ENV_TYPE="${{ github.ref == 'refs/heads/main' && 'PROD' || 'DEV' }}"
49-
echo "🔐 Setting $ENV_TYPE prefixed secrets in Cloudflare Worker..."
50-
# Set prefixed secrets so both dev and prod can coexist in the same worker
51-
# Runtime detection will select the correct prefix based on request host
52-
PREFIX="$ENV_TYPE"
53-
54-
# Sensitive secrets (use GitHub Secrets)
55-
echo "${{ secrets.QUICKBOOKS_CLIENT_ID }}" | pnpm exec wrangler secret put ${PREFIX}_QUICKBOOKS_CLIENT_ID
56-
echo "${{ secrets.QUICKBOOKS_CLIENT_SECRET }}" | pnpm exec wrangler secret put ${PREFIX}_QUICKBOOKS_CLIENT_SECRET
57-
echo "${{ secrets.QUICKBOOKS_REFRESH_TOKEN }}" | pnpm exec wrangler secret put ${PREFIX}_QUICKBOOKS_REFRESH_TOKEN || true
58-
echo "${{ secrets.QUICKBOOKS_REALM_ID }}" | pnpm exec wrangler secret put ${PREFIX}_QUICKBOOKS_REALM_ID || true
59-
echo "${{ secrets.QUICKBOOKS_ADMIN_KEY }}" | pnpm exec wrangler secret put ${PREFIX}_QUICKBOOKS_ADMIN_KEY || true
60-
echo "${{ secrets.GITHUB_TOKEN }}" | pnpm exec wrangler secret put ${PREFIX}_GITHUB_TOKEN || true
61-
echo "${{ secrets.MONDAY_API_KEY }}" | pnpm exec wrangler secret put ${PREFIX}_MONDAY_API_KEY || true
62-
63-
# Non-sensitive variables (use GitHub Variables - still set as Cloudflare secrets for prefixed runtime access)
64-
# Note: Even though not sensitive, we set as secrets to maintain prefix structure for environment isolation
65-
if [ -n "${{ vars.DISCORD_WEBHOOK_URL }}" ]; then
66-
echo "${{ vars.DISCORD_WEBHOOK_URL }}" | pnpm exec wrangler secret put ${PREFIX}_DISCORD_WEBHOOK_URL || true
67-
fi
68-
if [ -n "${{ vars.MONDAY_BOARD_ID }}" ]; then
69-
echo "${{ vars.MONDAY_BOARD_ID }}" | pnpm exec wrangler secret put ${PREFIX}_MONDAY_BOARD_ID || true
70-
fi
71-
if [ -n "${{ vars.QUICKBOOKS_ENVIRONMENT }}" ]; then
72-
echo "${{ vars.QUICKBOOKS_ENVIRONMENT }}" | pnpm exec wrangler secret put ${PREFIX}_QUICKBOOKS_ENVIRONMENT || true
73-
fi
62+
# Ensure script is executable (defensive - file should already have execute permission)
63+
chmod +x .github/scripts/set-cloudflare-secrets.sh
64+
.github/scripts/set-cloudflare-secrets.sh "$ENV_TYPE"
7465
env:
7566
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
67+
# Pass GitHub Environment Secrets as environment variables
68+
QUICKBOOKS_CLIENT_ID: ${{ secrets.QUICKBOOKS_CLIENT_ID }}
69+
QUICKBOOKS_CLIENT_SECRET: ${{ secrets.QUICKBOOKS_CLIENT_SECRET }}
70+
QUICKBOOKS_REFRESH_TOKEN: ${{ secrets.QUICKBOOKS_REFRESH_TOKEN }}
71+
QUICKBOOKS_REALM_ID: ${{ secrets.QUICKBOOKS_REALM_ID }}
72+
QUICKBOOKS_ADMIN_KEY: ${{ secrets.QUICKBOOKS_ADMIN_KEY }}
73+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
74+
MONDAY_API_KEY: ${{ secrets.MONDAY_API_KEY }}
75+
# Pass GitHub Environment Variables as environment variables
76+
MONDAY_BOARD_ID: ${{ vars.MONDAY_BOARD_ID }}
77+
DISCORD_WEBHOOK_URL: ${{ vars.DISCORD_WEBHOOK_URL }}
78+
QUICKBOOKS_ENVIRONMENT: ${{ vars.QUICKBOOKS_ENVIRONMENT }}
7679

7780
- name: Deploy to Cloudflare Workers
7881
run: |
7982
echo "🚀 Deploying to ${{ github.ref == 'refs/heads/main' && 'PRODUCTION' || 'DEVELOPMENT' }} environment..."
80-
# Deploy to single worker "dev" (no --env flag = base worker)
81-
# Worker URL: dev.allthingslinux.workers.dev
82-
# Production: allthingslinux.org (custom route in wrangler.jsonc)
83-
# Secrets are prefixed (DEV_* / PROD_*) - runtime detection selects correct prefix
83+
# Deploy to single worker "allthingslinux" (no --env flag = base worker, not using Wrangler environments)
84+
# Custom domains: allthingslinux.dev (dev) and allthingslinux.org (prod)
85+
# Secrets are prefixed (DEV_* / PROD_*) - runtime detection selects correct prefix based on request host
8486
pnpm exec opennextjs-cloudflare deploy
8587
env:
8688
# Only Cloudflare API token needed for deployment (secrets are set separately above)
@@ -102,6 +104,6 @@ jobs:
102104
103105
**URLs:**
104106
- **Production:** [https://allthingslinux.org](https://allthingslinux.org)
105-
- **Development:** [https://dev.allthingslinux.workers.dev](https://dev.allthingslinux.workers.dev)
107+
- **Development:** [https://allthingslinux.dev](https://allthingslinux.dev)
106108
107109
Deployment completed successfully! ✨

‎.vscode/settings.json‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,5 +37,8 @@
3737
],
3838
"prettier.requireConfig": true,
3939
"prettier.configPath": "prettier.config.mjs",
40-
"typescript.tsdk": "node_modules/typescript/lib"
40+
"typescript.tsdk": "node_modules/typescript/lib",
41+
"[github-actions-workflow]": {
42+
"editor.defaultFormatter": "redhat.vscode-yaml"
43+
}
4144
}

‎PNPM_SCRIPTS.md‎

Lines changed: 3 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -48,17 +48,6 @@ This document explains all available pnpm scripts in the project.
4848

4949
## Version Management
5050

51-
- `pnpm run deploy:dev`
52-
Builds and deploys to the development environment.
53-
54-
- `pnpm run deploy:prod`
55-
Builds and deploys to the production environment.
56-
57-
- `pnpm run deploy`
58-
Alias for production deployment - the default deploy command.
59-
60-
## Version Management
61-
6251
- `pnpm run version:upload`
6352
Creates a new version in Cloudflare Workers without deploying it immediately.
6453

@@ -98,11 +87,11 @@ This document explains all available pnpm scripts in the project.
9887

9988
## Infrastructure
10089

90+
- `pnpm run setup:bindings`
91+
Sets up Cloudflare bindings (R2 buckets, KV namespaces). IMPORTANT: Update wrangler.jsonc with the KV ID from the script output.
92+
10193
- `pnpm run cf:typegen`
10294
Generates TypeScript types for Cloudflare Workers bindings and environment variables.
10395

104-
- `pnpm run setup`
105-
Runs the main project setup script.
106-
10796
- `pnpm run coc:generate`
10897
Generates the Code of Conduct markdown file from TOML configuration.

‎README.md‎

Lines changed: 60 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# All Things Linux
22

33
[![Deploy to Production](https://img.shields.io/badge/Production-Deployed-brightgreen)](https://allthingslinux.org)
4-
[![Deploy to Dev](https://img.shields.io/badge/Dev-Deployed-blue)](https://allthingslinux-dev.allthingslinux.workers.dev)
4+
[![Deploy to Dev](https://img.shields.io/badge/Dev-Deployed-blue)](https://allthingslinux.dev)
55

66
The official website for All Things Linux ([allthingslinux.org](https://allthingslinux.org)).
77

@@ -13,9 +13,8 @@ git clone https://github.com/allthingslinux/allthingslinux.git
1313
cd allthingslinux
1414
pnpm install
1515

16-
# Set up secrets
17-
cp .env.secrets.example .env.secrets
18-
# Edit .env.secrets with your actual secrets
16+
# Setup Cloudflare bindings (R2, KV) - IMPORTANT: Update wrangler.jsonc with KV ID from output
17+
pnpm run setup:bindings
1918

2019
# Start development
2120
pnpm run dev:all
@@ -49,20 +48,35 @@ cd allthingslinux
4948
pnpm install
5049
```
5150

52-
### 2. Configure Secrets
51+
### 2. Setup Cloudflare Bindings
5352

5453
```bash
55-
# Copy templates for environment-specific secrets
56-
cp .env.secrets.dev.example .env.secrets.dev # Development (sandbox)
57-
cp .env.secrets.prod.example .env.secrets.prod # Production
58-
# Edit each file with appropriate credentials (gitignored)
59-
60-
# Upload secrets to Cloudflare (when needed for deployment)
61-
# pnpm run secrets:dev # Upload dev/sandbox secrets
62-
# pnpm run secrets:prod # Upload production secrets
54+
# Create R2 buckets and KV namespaces
55+
pnpm run setup:bindings
56+
57+
# IMPORTANT: Update wrangler.jsonc with the KV namespace ID shown in the script output
58+
```
59+
60+
### 3. Configure Secrets
61+
62+
**For local development**, create `.env.secrets.dev` and `.env.secrets.prod` files (these are gitignored):
63+
64+
```bash
65+
# Create .env.secrets.dev for local development (sandbox credentials)
66+
# Create .env.secrets.prod for production credentials
67+
# Add your secrets following the format: KEY=value (one per line)
68+
```
69+
70+
**For CI/CD**, secrets are managed via GitHub Environments (see Deployment section below).
71+
72+
**Upload secrets to Cloudflare manually** (when needed):
73+
74+
```bash
75+
pnpm run secrets:dev # Upload dev/sandbox secrets (sets DEV_* prefixed secrets)
76+
pnpm run secrets:prod # Upload production secrets (sets PROD_* prefixed secrets)
6377
```
6478

65-
### 3. Start Development
79+
### 4. Start Development
6680

6781
```bash
6882
pnpm run dev:all # Next.js + Wrangler + Trigger.dev
@@ -79,19 +93,21 @@ pnpm run dev:all # Next.js + Wrangler + Trigger.dev
7993

8094
**GitHub Actions with GitHub Environments** - Automatic deployments on push/PR:
8195

82-
| Branch | Environment | URL |
83-
| -------- | ----------- | ------------------------------------------------------------------------ |
84-
| `main` | Production | [allthingslinux.org](https://allthingslinux.org) |
85-
| PR/other | Development | [dev.allthingslinux.workers.dev](https://dev.allthingslinux.workers.dev) |
86-
87-
**Setup:** See [GitHub Environments Setup Guide](docs/GITHUB_ENVIRONMENTS_SETUP.md) for detailed configuration.
96+
| Branch | Environment | URL |
97+
| -------- | ----------- | ------------------------------------------------ |
98+
| `main` | Production | [allthingslinux.org](https://allthingslinux.org) |
99+
| PR/other | Development | [allthingslinux.dev](https://allthingslinux.dev) |
88100

89101
**Quick setup:**
90102

91103
1. Create GitHub Environments: `dev` and `prod` (Settings → Environments)
92-
2. Add secrets to each environment (see guide for required secrets)
93-
3. Push to any branch → Auto-deploys via GitHub Actions
94-
4. Merge to `main` → Auto-deploys to production
104+
2. Add secrets and variables to each environment:
105+
- **Secrets** (sensitive): `QUICKBOOKS_CLIENT_ID`, `QUICKBOOKS_CLIENT_SECRET`, `QUICKBOOKS_REFRESH_TOKEN`, `QUICKBOOKS_REALM_ID`, `QUICKBOOKS_ADMIN_KEY`, `GITHUB_TOKEN`, `MONDAY_API_KEY`, `CLOUDFLARE_API_TOKEN`, `CLOUDFLARE_ACCOUNT_ID`, `TRIGGER_SECRET_KEY`
106+
- **Variables** (non-sensitive): `MONDAY_BOARD_ID`, `DISCORD_WEBHOOK_URL`, `QUICKBOOKS_ENVIRONMENT`
107+
3. Push to any branch → Auto-deploys to development environment
108+
4. Merge to `main` → Auto-deploys to production environment
109+
110+
See [`docs/integrations/quickbooks.md`](docs/integrations/quickbooks.md) for detailed QuickBooks integration setup.
95111

96112
**Workflow:** `.github/workflows/deploy.yml` automatically handles branch detection and environment selection.
97113

@@ -122,10 +138,13 @@ pnpm run version:deploy # Deploy latest version
122138
### Build Process
123139

124140
```bash
125-
# Full production build
141+
# Full production build (Next.js + OpenNext for Cloudflare)
142+
pnpm run build:all
143+
144+
# Next.js build only
126145
pnpm run build
127146

128-
# Preview build locally
147+
# Preview build locally (tests the Cloudflare Workers build)
129148
pnpm run preview
130149
```
131150

@@ -139,24 +158,23 @@ pnpm run preview
139158
2. **Add secrets** to each environment (same secret names, different values per environment)
140159
3. **Secrets are automatically available** in GitHub Actions workflows
141160

142-
See [GitHub Environments Setup Guide](docs/GITHUB_ENVIRONMENTS_SETUP.md) for complete setup instructions.
161+
**Secrets are prefixed** (`DEV_*` and `PROD_*`) in the single Cloudflare Worker and selected at runtime based on the request host.
143162

144-
### Manual Deployment (Local)
163+
### Manual Secret Management (Local)
145164

146-
**For manual deployments from your local machine:**
165+
**Note:** GitHub Actions automatically manages secrets during CI/CD. Manual secret management is mainly for local testing.
147166

148-
```bash
149-
# 1. Copy templates for each environment
150-
cp .env.secrets.dev.example .env.secrets.dev # Sandbox credentials
151-
cp .env.secrets.prod.example .env.secrets.prod # Production credentials
167+
**For manual secret setup from your local machine:**
152168

153-
# 2. Edit with real values
169+
```bash
170+
# 1. Create .env.secrets.dev and .env.secrets.prod files (gitignored)
171+
# Format: KEY=value (one per line)
154172
# .env.secrets.dev: Sandbox QuickBooks + other dev secrets
155173
# .env.secrets.prod: Production QuickBooks + other prod secrets
156174

157-
# 3. Upload to Cloudflare (when needed)
158-
pnpm run secrets:dev # Dev environment (uses .env.secrets.dev)
159-
pnpm run secrets:prod # Production (uses .env.secrets.prod)
175+
# 2. Upload to Cloudflare Worker (sets prefixed secrets: DEV_*, PROD_*)
176+
pnpm run secrets:dev # Sets DEV_* prefixed secrets
177+
pnpm run secrets:prod # Sets PROD_* prefixed secrets
160178
```
161179

162180
### Security Notes
@@ -166,7 +184,7 @@ pnpm run secrets:prod # Production (uses .env.secrets.prod)
166184
- **Secrets are encrypted** and managed via `wrangler secret put` or GitHub Environments
167185
- **Use `.dev.vars`** only for non-sensitive local config
168186
- **Environment variables** are defined in `wrangler.jsonc` per environment
169-
- **No prefixing needed**: GitHub Environments handle isolation automatically
187+
- **Prefixed secrets**: Secrets are stored as `DEV_*` and `PROD_*` in the single worker, selected at runtime
170188

171189
## 📁 Project Structure
172190

@@ -214,12 +232,13 @@ pnpm run version:list # List all versions
214232
pnpm run version:deploy # Deploy latest version
215233

216234
# Secrets
217-
pnpm run secrets:dev # Upload to dev env
218-
pnpm run secrets:prod # Upload to prod env
235+
pnpm run secrets:dev # Upload dev secrets (sets DEV_* prefixed)
236+
pnpm run secrets:prod # Upload prod secrets (sets PROD_* prefixed)
219237

220238
# Infrastructure
221-
pnpm run cf:typegen # Generate Cloudflare types
222-
pnpm run coc:generate # Generate Code of Conduct
239+
pnpm run setup:bindings # Setup Cloudflare bindings (R2, KV)
240+
pnpm run cf:typegen # Generate Cloudflare types
241+
pnpm run coc:generate # Generate Code of Conduct
223242
```
224243

225244
See [`PNPM_SCRIPTS.md`](PNPM_SCRIPTS.md) for detailed script explanations.

0 commit comments

Comments
 (0)