Supabase Slack Clone

supabase-slack-clone

Supabase's Slack clone — the Next.js example of a realtime team chat: channels, messages that arrive live over Supabase Realtime, email and password sign-up through Supabase Auth, and members, moderators and admins whose role rides in every session through an Auth hook and is enforced by row-level security — running on Cloudflare Workers + Static Assets through @opennextjs/cloudflare, with the Supabase project itself provisioned by Terraform and its schema applied by migrations through Orun, and packaged as an Orun baseline: one command takes a new product from nothing to live on stage and prod, in its own repository, under its own name, in ONE landing.

The example's code is the code. What the port changes is what the Workers runtime and a fresh, unattended deployment force: next pinned (upstream says latest) and the two calls Next 16 and supabase-js 2 no longer accept fixed, the build inlining the project's URL and publishable key from the same wrangler config the Worker runs with (next.config.ts), upstream's two migrations and its seed applied by db-migrate instead of supabase db push, the access-token hook supabase/config.toml switched on set by that runner through the Management API, each project created with its Auth pointed at the Worker and email confirmation off (so anyone can sign up on the first deploy, with no SMTP server), and a read-only /api/health only the Worker can answer. What the baseline adds is everything needed to make a copy of it somebody else's — built the way supabase-starter builds a product, in one landing. See specs/epics/supabase-slack-clone for the design, the milestones and the as-built status, including every departure.

Instantiating a product

git clone --depth 1 --branch <baseline-tag> https://github.com/sourceplane/supabase-slack-clone
cd supabase-slack-clone
orun new --blueprint repo-blueprint.yaml --out ~/products/acme-chat --run-hooks --resume \
  --set reponame=acme-chat --set productname="Acme Chat" \
  --set githuborg=acme-inc --set subdomain=<workers-dev-subdomain>

Or, once the platform's registry lists it, from the Orun console (Baselines → supabase-slack-clone → Build). Two phases: 01-product creates the repository, mints the four brokered credentials (Cloudflare and Supabase) and lands the whole product as one pull request, whose convergence on main provisions, migrates and deploys it per environment in a fixed order —

supabase ──▶ db-migrate ──▶ web

— every edge mode: enforced on a push to main and advisory on a pull request; then 02-docs records the live deployment from probed facts. BOOTSTRAP.md is the operator guide; docs/phases/ has a page per phase. The Supabase organization needs room for two projects (stage and prod) — the free plan's limit.

The new repository receives the product only — the app, the Terraform root, the migrations, the tests, its CI, its tooling, a README and an AGENTS.md of its own and its operating contract — renamed throughout to the product's name, repository, Worker and Supabase projects. None of this repository's machinery ships.

What is here (the product)

Getting started

pnpm install
pnpm run wire:fixture   # re-render apps/web/wrangler.jsonc from its template (committed; this changes nothing)
pnpm typecheck
pnpm lint
pnpm test
pnpm build              # next build + opennextjs-cloudflare build → apps/web/.open-next

The build needs no Supabase project. Running it against one — .env.local for next dev and the build, .dev.vars for wrangler dev — is in the product's README (.baseline/product/README.md), which is what a product built from here carries.

How it maps to Vercel and Supabase

The publishable (anon) key is a wrangler var, not a secret: it is shipped to every browser by design, and row-level security is the boundary. No service-role key is read anywhere.

CI

Licence and credit

The app is Supabase's Slack clone example, by Supabase. Its own package.json says MIT; the supabase/supabase repository it lives in is licensed under the Apache License 2.0, which apps/web/LICENSE carries. The migrations under packages/db/src/migrations are the example's own SQL, under the same terms.