How to Deploy Open SEO to Production with Cloudflare Workers: Complete Guide

Deploy Open SEO to production on Cloudflare Workers by running pnpm deploy:selfhost --yes after configuring your .env.selfhost file and authenticating with the Alchemy CLI.

Open SEO is an open-source SEO platform designed to run entirely on Cloudflare's edge network. Deploying to production requires bundling the application with Vite, provisioning D1, KV, and R2 resources via the Alchemy CLI, and protecting the deployment with Cloudflare Access. This guide walks through the complete deployment pipeline using the actual source configuration from the every-app/open-seo repository.

Architecture Overview

The production deployment pipeline consists of three integrated components that transform source code into a running Workers service.

Vite Build Pipeline

The build process starts in vite.config.ts, which configures the @cloudflare/vite-plugin with viteEnvironment: { name: "ssr" } to target the Workers runtime. The custom leanWorkerBundle helper in vite-plugin-lean-worker-bundle.ts creates a minified bundle optimized for the Alchemy deployment workflow, resulting in a Workers script ready for Cloudflare's edge network.

Alchemy Resource Provisioning

Alchemy automates infrastructure setup through two distinct phases. First, pnpm alchemy cloudflare bootstrap creates a lightweight "state-store" Worker that holds authentication data. Then, pnpm alchemy deploy … --stage selfhost provisions the required Cloudflare resources including a D1 database, KV namespaces, and an R2 bucket. The process also creates a Cloudflare Access application using values defined in .env.selfhost such as TEAM_DOMAIN, POLICY_AUD, and ACCESS_ALLOWED_EMAILS.

Zero-Trust Integration

After deployment, Cloudflare Access guards the Worker URL, requiring authentication before serving the Open SEO interface. Enabling Managed OAuth in the Access application allows MCP (multi-client-processor) clients to perform dynamic client registration and connect via https://YOUR_WORKER_HOSTNAME/mcp.

Step-by-Step Deployment Guide

Follow these steps to deploy Open SEO to your Cloudflare account.

Clone and Install Dependencies

Start by cloning the repository and installing dependencies with pnpm:

git clone https://github.com/every-app/open-seo.git
cd open-seo
corepack enable
pnpm install

Authenticate with Cloudflare

Log in to Cloudflare using the Alchemy CLI and bootstrap the state-store Worker:

pnpm alchemy login
pnpm alchemy cloudflare bootstrap

Grant access:write permissions when prompted during the login process.

Configure Environment Variables

Copy the example environment file and configure your production settings:

cp .env.selfhost.example .env.selfhost

Edit .env.selfhost to set the required variables:

• AUTH_MODE=cloudflare_access
• TEAM_DOMAIN=https://your-team.cloudflareaccess.com
• ACCESS_ALLOWED_EMAILS=you@example.com,team@example.com
• DATAFORSEO_API_KEY=Base64-encoded-login:password

Additional configuration options are documented in docs/SELF_HOSTING_CLOUDFLARE.md.

Execute Production Deployment

Run the deployment command to build, provision, and deploy:

pnpm deploy:selfhost --yes

This command orchestrates pre-flight checks via scripts/selfhost-deploy-preflight.mjs, executes the Vite build with the Cloudflare plugin, provisions D1/KV/R2 resources, uploads the Worker script, and creates the Cloudflare Access application.

Verify the deployment by navigating to your Worker URL and signing in via Cloudflare Access.

Updating Your Deployment

When a new Open SEO version releases, update your instance with:

git pull
pnpm install
pnpm deploy:selfhost --yes

This pulls the latest source code from the repository, updates dependencies, and redeploys the Worker while preserving existing data.

Teardown and Cleanup

To remove all provisioned resources and the Worker deployment:

pnpm alchemy destroy --env-file .env.selfhost --stage selfhost

Summary

• Build Pipeline: vite.config.ts uses @cloudflare/vite-plugin with viteEnvironment: { name: "ssr" } and vite-plugin-lean-worker-bundle.ts to create a minified Workers bundle.
• Resource Provisioning: The Alchemy CLI handles D1, KV, R2, and Access policy creation through pnpm alchemy cloudflare bootstrap and pnpm alchemy deploy --stage selfhost.
• Single-Command Deploy: pnpm deploy:selfhost --yes executes pre-flight checks, builds the bundle, provisions resources, and deploys to Cloudflare Workers.
• Security: Cloudflare Access protects the deployment using values from .env.selfhost, with optional MCP client support via Managed OAuth at /mcp.

Frequently Asked Questions

What is Alchemy and why does Open SEO use it?

Alchemy is an infrastructure-as-code CLI tool that automates Cloudflare resource provisioning. Open SEO uses Alchemy to eliminate manual configuration of D1 databases, KV namespaces, R2 buckets, and Access policies, ensuring reproducible deployments defined in code rather than manual click-ops.

How does the Vite plugin prepare the Worker bundle?

The @cloudflare/vite-plugin in vite.config.ts targets the SSR environment with viteEnvironment: { name: "ssr" } to bundle the application for the Workers runtime. The custom leanWorkerBundle helper in vite-plugin-lean-worker-bundle.ts further optimizes the output into a minified script specifically designed for Alchemy's deployment process.

What Cloudflare resources are provisioned during deployment?

The deployment creates a D1 database for structured data storage, KV namespaces for key-value caching, an R2 bucket for object storage, and a Cloudflare Access application for zero-trust authentication. These resources are defined in the Alchemy configuration and provisioned automatically when running pnpm deploy:selfhost --yes.

How do I update Open SEO to the latest version?

Pull the latest changes from the repository, reinstall dependencies, and rerun the deployment command. Execute git pull, pnpm install, and pnpm deploy:selfhost --yes to update your production instance while preserving your existing data in D1, KV, and R2.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}