Cloudflare Workers Deployment

CareNova 1.2.0 includes an OpenNext adapter for deploying the dynamic application to Cloudflare Workers. Each customer must use their own Cloudflare account, Worker name, domain, Hyperdrive connection, and secrets.

Requirements

• A Cloudflare Workers paid plan suitable for the application's traffic and CPU usage.

• A Supabase project with a session-pooler connection on port 5432.

• A domain managed by or connected to Cloudflare.

• The released package-lock.json and Node.js 20.

Install and build

npm ci
npm run cf:build

Use the pinned OpenNext and Wrangler versions included in the package. Upgrade them only as a separate, tested maintenance task.

Create Hyperdrive

Create a Hyperdrive configuration that connects to the customer's Supabase session pooler on port 5432. Set the resulting binding ID in wrangler.jsonc under the HYPERDRIVE binding.

The runtime uses Hyperdrive inside the Worker. DATABASE_URL and DIRECT_DATABASE_URL remain private local/CLI fallbacks for controlled database work.

Review wrangler.jsonc

Replace every installation-specific value:

• Worker name.

• Custom domain/route.

• Hyperdrive ID.

• NEXT_PUBLIC_SITE_URL.

• SaaS and portal public flags.

• Any demo-only public values.

Do not deploy another installation's domain or Hyperdrive ID unchanged.

Configure public variables and private secrets

Configure browser-safe public/build variables separately, including:

• NEXT_PUBLIC_SUPABASE_URL.

• NEXT_PUBLIC_SUPABASE_ANON_KEY.

• NEXT_PUBLIC_SITE_URL.

• NEXT_PUBLIC_SAAS_MODE and other deliberately public feature flags.

The Supabase anonymous key is designed to be used by the browser, but it is not an authorization substitute. Correct database policies and application checks are still required.

Store private values as Cloudflare secrets, including:

• SUPABASE_SERVICE_ROLE_KEY.

• DATABASE_URL and DIRECT_DATABASE_URL when used outside Hyperdrive.

• CRON_SECRET.

• CARENOVA_PAYMENT_ENCRYPTION_KEY.

• RESEND_API_KEY when email is enabled.

Stripe secret and webhook values are saved per clinic through Dashboard -> Settings -> Payment and encrypted using the stable CareNova payment-encryption key.

Never place database passwords, service-role keys, Stripe secrets, webhook signing secrets, cron secrets, or encryption keys directly in wrangler.jsonc or source control.

Scheduled authentication cleanup

The supplied Worker entrypoint includes a scheduled handler. The default Wrangler trigger is:

0 2 * * *

The handler calls /api/cron/cleanup-auth with CRON_SECRET. Keep the secret stable and confirm the scheduled invocation succeeds after deployment.

Preview and deploy

After changing bindings, generate the Cloudflare environment types:

npm run cf-typegen

Build and test a preview:

npm run preview

Deploy only after the acceptance test passes:

npm run deploy

DNS and authentication

After attaching the custom domain:

1. Set NEXT_PUBLIC_SITE_URL to its exact HTTPS origin.

2. Add https://your-domain.com/auth/callback to Supabase's allowed redirect URLs.

3. Test email confirmation and every OAuth provider on that hostname.

4. Confirm secure cookies, clinic selection, and tenant isolation.

Go-live checklist

• Admin, staff, and patient sign-in work.

• Appointment, invoice, PDF, profile, and storage flows work.

• Bank-transfer review works.

• Stripe sandbox Checkout and signed webhooks work.

• The daily cleanup trigger succeeds.

• Logs and observability are enabled for the launch window.

• The previous Worker version remains available for immediate rollback.