GitHub main → Vercel
Vercel builds this repository directly from the protected main branch. There is no ChatGPT Sites proxy and no ChatGPT login. GitHub OAuth protects the exact owner; Cloudflare D1 and private Vercel Blob keep durable data in accounts you control.
Import repository into Vercel ↗Starts sealedMissing OAuth, D1, or Blob configuration never falls back to a public or in-memory workspace. Configure all user-owned credentials before promoting main.
Create the protected D1 data plane
Create D1 in your Cloudflare account, apply canonical migrations, and deploy the narrow RPC Worker. Select that Worker by name in Cloudflare Access, protect production and previews, and add a Service Auth policy for one dedicated service token. Vercel receives that token, the endpoint, and a separate 32-byte HMAC secret—never a Cloudflare account token.
Create private Blob storage
In the Vercel project Storage tab, create a Private Blob store. Vercel injects BLOB_READ_WRITE_TOKEN. Private document bytes are streamed only after owner authorization.
Create GitHub owner login
Create a GitHub OAuth app with callback https://freecrm.dev/api/auth/callback/github. Add its client values, a random AUTH_SECRET, and the exact verified owner email as encrypted Production variables.
# Vercel project settings
Production Branch: main
Framework: Next.js
Root Directory: .
Build Command: npm run build:vercel
Install Command: npm ci
# Required Production environment variables
FREE_CRM_AUTH_MODE=authjs
NEXTAUTH_URL=https://freecrm.dev
NEXT_PUBLIC_SITE_URL=https://freecrm.dev
FREE_CRM_OWNER_EMAIL
AUTH_SECRET
AUTH_GITHUB_ID
AUTH_GITHUB_SECRET
FREE_CRM_D1_RPC_URL
FREE_CRM_D1_RPC_SECRET
FREE_CRM_D1_ACCESS_CLIENT_ID
FREE_CRM_D1_ACCESS_CLIENT_SECRET
BLOB_READ_WRITE_TOKENConnect and promote main
Use the settings above, attach both domains, and keep freecrm.dev canonical. Pull requests become previews; only main becomes Production. Open the complete runbook ↗