Apply and preview

On this project, Pulumi does two different things:

  • Stack state (aka "current state host"): where Pulumi stores the live snapshot of what’s been applied. This is required for both local runs and CI runs.

  • App secrets / config injection: how app secrets (like Convex deploy keys) are pulled in from Pulumi stack secrets at run time. This is separate from stack state.

Below are both apply paths. Pick the one that matches your preference.

<details> <summary>Local (single operator runs pulumi up)</summary>

pnpm install
pulumi login
pulumi stack select ftn-prod --create
pulumi preview
pulumi up

Requires Cloudflare API token with DNS edit on foodtrucknerdz.com and cloudflareZoneId in stack config. See Secrets. </details>

<details> <summary>Team-optimized (GitHub Actions runs pulumi preview / pulumi up)</summary>

In CI, you still need access to the Pulumi stack state backend ("current state host"). That means CI must run pulumi login as well (typically via a Pulumi access token), even though you’re not running it from your laptop.

Minimal model:

  1. CI authenticates Pulumi (pulumi login), so Pulumi can read/write the stack state.

  2. CI runs pulumi stack select ftn-prod --create (or selects the stack you pre-create).

  3. CI runs pulumi preview on PRs and pulumi up --yes on main (exact commands depend on your workflow).

  4. Cloudflare credentials for this stack still come from cloudflare:apiToken and cloudflareZoneId config (see Secrets).

Note: CI still needs pulumi login so Pulumi can read/write the stack state backend. Secrets come from Pulumi stack config (and/or CI environment variables), not from any separate hosted service you keep “online” for the team. </details>

Shared state without Pulumi Cloud (Cloudflare R2 / Backblaze)

If you want to avoid Pulumi’s hosted team state backend, use an S3-compatible bucket for Pulumi stack state (Cloudflare R2 or Backblaze B2).

# 1) Create an R2 bucket + an API token in Cloudflare, then set env vars:
#
#    export AWS_ACCESS_KEY_ID='<r2-access-key-id>'
#    export AWS_SECRET_ACCESS_KEY='<r2-secret-access-key>'
#
#    Replace <bucket-name> and <account-id> below:
pulumi login 's3://<bucket-name>?endpoint=https://<account-id>.r2.cloudflarestorage.com&region=auto&s3ForcePathStyle=true'

Then continue with the usual stack flow (stack select + pulumi preview / pulumi up).