Secrets

This stack (Pulumi config)

  • pulumi config set cloudflare:apiToken --secret … — Cloudflare API token (DNS edit on foodtrucknerdz.com)

  • pulumi config set cloudflareZoneId … — zone id for foodtrucknerdz.com

  • pulumi config set vercel:token --secret … — Vercel token so Pulumi can set Vercel project environment variables

  • pulumi config set vercel:projectIdNextjs … — Vercel project id for the Next.js production site (where CONVEX_DEPLOY_KEY is written)

  • Optional: dmarcRua, dmarcPolicy (default none)

Never commit tokens or SMTP/API keys. App deploy keys live as Pulumi stack secrets (for example convex:deployKeyProd).

Convex (ftn-site)

Bitwarden item dashboard.convex.dev holds team-sharable Convex deploy keys (not login passwords). Even if the Bitwarden UI calls them a “team API key”, their values are scoped deploy keys with prod: / dev: prefixes (e.g. prod:…|…).

Bitwarden custom field Use

ftn/ftn-site Prod API key

Production deploy key (`prod:…

…) (deploy-key format, not a Management API token). Vercel Production env `CONVEX_DEPLOY_KEY only. Until release, do not put this on Preview, Development, or local .env.local while sharing prod Convex data.

ftn/ftn-site Dev API key

Dev deployment deploy key (`dev:…

…`) (deploy-key format, not a Management API token). For a future dedicated dev/staging Convex after launch — not Vercel Preview today.

Convex team access token (Management API)

Optional separate token from Convex team settings for api.convex.dev automation (projects, deploy-key minting). Management tokens are “JWT-shaped” strings and do not include the prod: / dev: deploy-key prefix. Not CONVEX_DEPLOY_KEY and not consumed by the Next.js app.

Set Convex deploy key in Pulumi config

cd infra
pulumi login
pulumi config set convex:deployKeyProd --secret '<from Bitwarden field: ftn/ftn-site Prod API key>'

Run pulumi up for this stack to set Vercel Production (CONVEX_DEPLOY_KEY) from the Pulumi secret (convex:deployKeyProd).

What Pulumi does not replace

Vendor sign-up (Convex, Vercel, Square, Radar, Resend, …) still happens in each vendor’s UI. Minting the first app API key is manual (or a future one-shot script). Pulumi applies infrastructure you already have credentials to manage — today: Cloudflare DNS.

App secrets by environment

Environment Where app keys live today

Local / personal dev

ftn-site/site-nextjs/.env.local + your Convex dev deployment. Do not run this stack to start the app.

Cloud preview (Vercel Preview)

Vercel project env (Preview). Convex deploy key / URL as configured for preview builds.

Production

Vercel Production env + Convex prod deploy key. Org DNS via this repo’s ftn-prod stack.

This Pulumi program

Cloudflare DNS via stack config. Also sets Vercel Production env CONVEX_DEPLOY_KEY from the Pulumi stack secret convex:deployKeyProd. Other app keys (RESEND_API_KEY, Square, Radar, Better Auth) stay in Bitwarden + Vercel.

Product-facing checklist (signups + tiers): website docs Accounts & keys checklist in ftn-site.