Postgres + Drizzle

postgres-drizzle-starter

Vercel's Postgres + Drizzle Next.js Starter — a page that reads a profiles table with Drizzle and seeds it on first use — running on Cloudflare Workers + Static Assets through @opennextjs/cloudflare, with the database a Supabase Postgres project reached through Cloudflare Hyperdrive, both provisioned by Terraform through Orun and the schema applied by Orun's db-migrate — the way the Lumen baseline does it — and packaged as an Orun baseline: one command takes a new product from nothing to live on stage and prod, in its own repository, under its own name, in ONE landing.

The template's code is the code. What the port changes is what the Workers runtime and a fresh, unattended deployment force: the Postgres client is built per request over the Hyperdrive binding (lib/db.ts), and the table is created by migrations before the app serves rather than by the page's first request — upstream's CREATE TABLE IF NOT EXISTS from the page fails for one of two requests that race through it on a fresh database. The page still writes its three seed rows the first time it finds the table empty, which is safe to race. Every table in public has row-level security, so Supabase's Data API serves none of it. What the baseline adds is everything needed to make a copy of it somebody else's — built the way cirrus-baseline builds a product, in one landing. See specs/epics/postgres-drizzle-starter for the design, the milestones and the as-built status, including every departure.

Instantiating a product

git clone --depth 1 --branch <baseline-tag> https://github.com/sourceplane/postgres-drizzle-starter
cd postgres-drizzle-starter
orun new --blueprint repo-blueprint.yaml --out ~/products/acme-postgres --run-hooks --resume \
  --set reponame=acme-postgres --set productname="Acme Cloud" \
  --set githuborg=acme-inc --set subdomain=<workers-dev-subdomain>

Or, once the platform's registry lists it, from the Orun console (Baselines → postgres-drizzle-starter → Build). Two phases: 01-product creates the repository, mints the five brokered credentials (Cloudflare and Supabase) and lands the whole product as one pull request, whose convergence on main provisions and deploys it per environment in a fixed order —

supabase ──▶ cloudflare-hyperdrive ──▶ db-migrate ──▶ web

— each edge mode: enforced on a push to main and advisory on a pull request; then 02-docs records the live deployment from probed facts. BOOTSTRAP.md is the operator guide; docs/phases/ has a page per phase. The Supabase organization needs room for two projects (stage and prod) — the free plan's limit.

The new repository receives the product only — the app, the Terraform roots, the migrations, the tests, its CI, its tooling, a README of its own and its operating contract — renamed throughout to the product's name, repository, Worker, Supabase project and Hyperdrive config. None of this repository's machinery ships. The card asks for no third-party key: the app uses none.

What is here (the product)

Getting started

pnpm install
pnpm run wire:fixture   # re-render apps/web/wrangler.jsonc from its template (committed; this changes nothing)
pnpm typecheck
pnpm lint
pnpm test
pnpm build              # next build + opennextjs-cloudflare build → apps/web/.open-next

The build needs no database. Running it locally — a Postgres on localhost:54322 (supabase start), pnpm --filter @app/web db:migrate, then next dev or wrangler dev — is in the product's README (.baseline/product/README.md), which is what a product built from here carries.

How it maps to Vercel

CI