Lemon Squeezy Billing

lemonsqueezy-billing

Lemon Squeezy's Next.js Billing App — GitHub sign-in through Auth.js with database sessions, plans synced from a Lemon Squeezy store, checkout in Lemon.js's overlay, subscriptions kept current by signed webhooks and paused, resumed, cancelled or changed from the dashboard, Drizzle over Postgres — running on Cloudflare Workers + Static Assets through @opennextjs/cloudflare, with its Postgres a Supabase project's database reached through Cloudflare Hyperdrive, both provisioned by Terraform through Orun and the schema applied by Orun's db-migrate, and packaged as an Orun baseline: one command takes a new billing portal from nothing to live on stage and prod, in its own repository, under its own name, in ONE landing.

The template's code is the code. What the port changes is what the Workers runtime and a fresh, unattended deployment force: the database client is built per call over the Hyperdrive binding (src/db/index.ts) instead of a module-level Neon client, Auth.js is configured per request, the webhook's signature is checked with WebCrypto, the schema is migrations instead of drizzle-kit push, and nothing has to be connected for the app to deploy — without Lemon Squeezy's keys the billing page shows sample plans and says what to connect, without a GitHub OAuth app the dashboard is open as a preview, and Auth.js's key defaults to one the database generates for itself. What the baseline adds is everything needed to make a copy of it somebody else's. See specs/epics/lemonsqueezy-billing for the design, the milestones and the as-built status, including every departure.

Instantiating a product

git clone --depth 1 --branch <baseline-tag> https://github.com/sourceplane/lemonsqueezy-billing
cd lemonsqueezy-billing
orun new --blueprint repo-blueprint.yaml --out ~/products/acme-billing --run-hooks --resume \
  --set reponame=acme-billing --set productname="Acme Billing" \
  --set githuborg=acme-inc --set subdomain=<workers-dev-subdomain>

Or, once the platform's registry lists it, from the Orun console (Baselines → lemonsqueezy-billing → Build). Two phases: 01-product creates the repository, mints the five brokered credentials (Cloudflare and Supabase) and lands the whole product as one pull request, whose convergence on main provisions and deploys it per environment in a fixed order —

supabase ──▶ cloudflare-hyperdrive ──▶ db-migrate ──▶ web

— each edge mode: enforced on a push to main and advisory on a pull request; then 02-docs records the live deployment from probed facts. BOOTSTRAP.md is the operator guide; docs/phases/ has a page per phase.

The new repository receives the product only — the app, the Terraform roots, the migrations, the tests, its CI, its tooling, a README of its own and its operating contract — renamed throughout to the product's name, repository, Worker, Supabase project and Hyperdrive config. None of this repository's machinery ships. Lemon Squeezy and the GitHub OAuth app are the owner's to connect afterwards, as the product's optional Orun secrets (its README, "Connect Lemon Squeezy" and "Connect sign-in"): no platform brokers them, so the card asks for neither.

What is here (the product)

Getting started

pnpm install
pnpm run wire:fixture   # re-render apps/web/wrangler.jsonc from its template (committed; this changes nothing)
pnpm typecheck
pnpm lint
pnpm test
pnpm build              # next build + opennextjs-cloudflare build → apps/web/.open-next

The build needs no database, no Lemon Squeezy store and no OAuth app.

Running it locally. A Postgres on localhost:54322 (supabase start), the migrations applied in order, then Next's dev server or the built Worker:

export POSTGRES_URL=postgres://postgres:postgres@localhost:54322/postgres
for f in packages/db/src/migrations/*/up.sql; do psql "$POSTGRES_URL" -v ON_ERROR_STOP=1 -q -f "$f" || break; done
pnpm --filter @app/web dev                  # http://localhost:3000, or:
pnpm build && pnpm --filter @app/web preview   # the Worker under wrangler dev, http://localhost:8787

Copy apps/web/.dev.vars.example to apps/web/.dev.vars for Lemon Squeezy's keys, a GitHub OAuth app and a WEBHOOK_URL tunnel; every key is optional, and without them the app runs unconnected.

Connecting Lemon Squeezy and sign-in. In a deployed product they are the product's own Orun secrets, per environment — LEMONSQUEEZY_API_KEY, LEMONSQUEEZY_STORE_ID, LEMONSQUEEZY_WEBHOOK_SECRET, AUTH_GITHUB_ID, AUTH_GITHUB_SECRET (orun secrets set <KEY> --env <env>) — which the next deploy hands to the Worker; then Setup Webhook on the dashboard registers the store's webhook. The product's README (.baseline/product/README.md, which is what a product built from here carries) has the steps in full.

How it maps to Vercel and Neon

CI

Licence

The app is Lemon Squeezy's Next.js Billing App, MIT © 2023 Lemon Squeezy, LLC — apps/web/LICENSE, kept with the code it covers.