Skip to content

Automate Cantelop Fleet and database setup in the production script #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
stepandel wants to merge 4 commits into
base: main
Choose a base branch
from
+22 −2
Open

Automate Cantelop Fleet and database setup in the production script #22

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
25de935
Provision the Cantelop Fleet from the setup script
stepandel Oct 21, 2026
3fc3780
Call the Cantelop CLI explicitly from the setup script
stepandel Oct 21, 2026
75ba0de
Let the database setup read the owner URL from Vercel
stepandel Oct 21, 2026
112f071
Merge main into claude/hosted-setup-fleet-db
stepandel Nov 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion docs/managed-service.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -189,7 +189,11 @@ After launch, schema changes belong in new forward migrations.
3. `service/deploy/production-env.sh` performs this step and writes the
generated role URLs, auth secret, OAuth and Fleet values to Vercel production
without echoing them; run it per section (`auth`, `database`, `oauth`,
`cantelop`). Manually: run `npm run migrate:service` as the schema owner. Apply
`cantelop`). With `OWNER_FROM_VERCEL=1`, the `database` section reads
`JUICED_OWNER_DATABASE_URL` from the development environment instead of
prompting; connect the Neon resource there only for the run
(`vercel integration resource connect juiced-db juiced -e development --prefix JUICED_OWNER_`)
and disconnect it afterwards. Manually: run `npm run migrate:service` as the schema owner. Apply
`service/deploy/roles.sql` after migrations and provision login secrets outside
source control. The API role cannot update paid periods, included credits,
usage or immutable grants. Use separate database credentials and Fleet
Expand Down
18 changes: 17 additions & 1 deletion service/deploy/production-env.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,23 @@ database() {
echo "Database"
command -v psql >/dev/null || { echo "psql is required" >&2; exit 1; }
local owner api worker
owner=$(secret 'Owner PostgreSQL URL (used here only, never stored in Vercel)')
if [[ -n ${OWNER_FROM_VERCEL:-} ]]; then
# The Neon resource connected to the development environment only, as
# `vercel integration resource connect juiced-db juiced -e development
# --prefix JUICED_OWNER_`. Disconnect it afterwards.
local pulled
pulled=$(mktemp -d)
vercel env pull "$pulled/.env" --environment development --yes \
--project "$PROJECT" --scope "$SCOPE" >/dev/null 2>&1
owner=$(PULLED="$pulled/.env" node -e '
const line = require("fs").readFileSync(process.env.PULLED, "utf8")
.split("\n").find((l) => l.startsWith("JUICED_OWNER_DATABASE_URL="));
if (line) process.stdout.write(JSON.parse(line.slice(line.indexOf("=") + 1)));')
rm -rf "$pulled"
[[ -n $owner ]] || { echo "JUICED_OWNER_DATABASE_URL not found in development" >&2; exit 1; }
else
owner=$(secret 'Owner PostgreSQL URL (used here only, never stored in Vercel)')
fi
JUICED_DATABASE_URL=$owner JUICED_SERVICE_URL=$SERVICE_URL NODE_ENV=development \
JUICED_AUTH_SECRET=$(openssl rand -hex 32) npm run --silent migrate:service
api=$(openssl rand -hex 24)
Expand Down
Loading