From 93c2ecf48dc0262849a0bb94e704b792d5a67f9e Mon Sep 17 00:00:00 2001 From: Ben Senescu Date: Sun, 28 Jun 2026 16:50:16 -0400 Subject: [PATCH] fix knip + reorganize self hosting docs --- docs/SELF_HOSTING_CLOUDFLARE.md | 132 +++++++++++----------- docs/self-host-auth-mode-spec.md | 0 knip.jsonc | 66 +++++------ src/client/features/keywords/locations.ts | 1 - 4 files changed, 96 insertions(+), 103 deletions(-) create mode 100644 docs/self-host-auth-mode-spec.md diff --git a/docs/SELF_HOSTING_CLOUDFLARE.md b/docs/SELF_HOSTING_CLOUDFLARE.md index a699eb4..d0ca0c5 100644 --- a/docs/SELF_HOSTING_CLOUDFLARE.md +++ b/docs/SELF_HOSTING_CLOUDFLARE.md @@ -56,6 +56,72 @@ Without a lifecycle rule, cached objects under `dataforseo-cache/` will accumula If login fails, re-check the three secrets and Access toggle. +## Connect the MCP server through Cloudflare Access + +Use the same Cloudflare Access application that protects your OpenSEO Worker. +Managed OAuth is required for MCP clients and is not enabled by default. + +1. Open Cloudflare Zero Trust. +2. Go to `Access controls` -> `Applications`. +3. Find your OpenSEO application, then select `Edit`. +4. Go to `Additional settings` -> `OAuth`. +5. Turn on `Managed OAuth`. +6. Save. + +MCP clients should connect to: + +```text +https://YOUR_WORKER_HOSTNAME/mcp +``` + +## How to update to the latest OpenSEO version + +If your repo was created from the Cloudflare Deploy button, use this flow. + +### One-time setup + +Run this once in your local repo: + +```bash +git remote add upstream https://github.com/every-app/open-seo.git +git fetch upstream +``` + +### Update steps (use every time) + +```bash +git fetch upstream +cp wrangler.jsonc wrangler.local.backup.jsonc +git checkout main +git reset --hard upstream/main +cp wrangler.local.backup.jsonc wrangler.jsonc +git add wrangler.jsonc +git commit -m "restore Cloudflare settings" || true +git push --force-with-lease origin main +``` + +Why this is needed: + +- `wrangler.jsonc` has your Cloudflare resource IDs. +- The update step keeps your IDs while pulling the newest OpenSEO code. + +## Give teammates access to OpenSEO + +1. Open Cloudflare Zero Trust. +2. Go to Access -> Applications. +3. Open your OpenSEO application. +4. Edit the `Allow` policy. +5. Add teammate emails (or your company email domain / group). +6. Save. + +Screenshots from the setup flow: + +- [Edit the Access policy](https://github.com/user-attachments/assets/c7bbc7b4-a18e-4ae4-9fe5-3b33c72048a7) +- [Add teammate emails to the allow list](https://github.com/user-attachments/assets/fa4ecaf2-31f7-4a64-9001-210cf729747b) + +After saving, teammates can open your OpenSEO URL and sign in through Cloudflare +Access. OpenSEO will use a shared workspace for everyone allowed by the policy. + ## Manual deploy with Wrangler Use this flow if the Deploy to Cloudflare button fails with `Cannot provision a KV Namespace with the title "open-seo" because it already exists`. The reliable path is to create Cloudflare resources yourself, put their IDs into `wrangler.jsonc`, then deploy with Wrangler. @@ -177,69 +243,3 @@ pnpm exec wrangler r2 bucket lifecycle add open-seo-YOUR_SUFFIX dataforseo-cache 3. OpenSEO should load after login. If login fails, re-check the three secrets, the Access toggle, and the binding values in `wrangler.jsonc`. - -## Connect the MCP server through Cloudflare Access - -Use the same Cloudflare Access application that protects your OpenSEO Worker. -Managed OAuth is required for MCP clients and is not enabled by default. - -1. Open Cloudflare Zero Trust. -2. Go to `Access controls` -> `Applications`. -3. Find your OpenSEO application, then select `Edit`. -4. Go to `Additional settings` -> `OAuth`. -5. Turn on `Managed OAuth`. -6. Save. - -MCP clients should connect to: - -```text -https://YOUR_WORKER_HOSTNAME/mcp -``` - -## How to update to the latest OpenSEO version - -If your repo was created from the Cloudflare Deploy button, use this flow. - -### One-time setup - -Run this once in your local repo: - -```bash -git remote add upstream https://github.com/every-app/open-seo.git -git fetch upstream -``` - -### Update steps (use every time) - -```bash -git fetch upstream -cp wrangler.jsonc wrangler.local.backup.jsonc -git checkout main -git reset --hard upstream/main -cp wrangler.local.backup.jsonc wrangler.jsonc -git add wrangler.jsonc -git commit -m "restore Cloudflare settings" || true -git push --force-with-lease origin main -``` - -Why this is needed: - -- `wrangler.jsonc` has your Cloudflare resource IDs. -- The update step keeps your IDs while pulling the newest OpenSEO code. - -## Give teammates access to OpenSEO - -1. Open Cloudflare Zero Trust. -2. Go to Access -> Applications. -3. Open your OpenSEO application. -4. Edit the `Allow` policy. -5. Add teammate emails (or your company email domain / group). -6. Save. - -Screenshots from the setup flow: - -- [Edit the Access policy](https://github.com/user-attachments/assets/c7bbc7b4-a18e-4ae4-9fe5-3b33c72048a7) -- [Add teammate emails to the allow list](https://github.com/user-attachments/assets/fa4ecaf2-31f7-4a64-9001-210cf729747b) - -After saving, teammates can open your OpenSEO URL and sign in through Cloudflare -Access. OpenSEO will use a shared workspace for everyone allowed by the policy. diff --git a/docs/self-host-auth-mode-spec.md b/docs/self-host-auth-mode-spec.md new file mode 100644 index 0000000..e69de29 diff --git a/knip.jsonc b/knip.jsonc index 3ea780a..eda3ff7 100644 --- a/knip.jsonc +++ b/knip.jsonc @@ -1,38 +1,32 @@ { - "entry": [ - // Detect Tanstack Start Routes - "cli-auth.ts", - "src/start.ts", - "src/server.ts", - "src/router.tsx", - "src/routes/**/*.ts", - "src/routes/**/*.tsx", - // Drizzle config (plugin disabled due to cloudflare:workers import issues) - "drizzle.config.ts", - // Package script entrypoints - "scripts/backlinks-cost-profile.ts", - "scripts/brand-lookup-cost-profile.ts", - "scripts/d1-default-project-cleanup.ts", - "scripts/release-notes.mjs", - "scripts/seed-rank-tracking.ts", - // DB schema — exports consumed via `import * as schema` / drizzle() - "src/db/index.ts", - "src/db/app.schema.ts", - "src/db/better-auth-schema.ts", - // Package scripts and one-off maintenance utilities - "scripts/backlinks-cost-profile.ts", - "scripts/brand-lookup-cost-profile.ts", - "scripts/d1-default-project-cleanup.ts", - "scripts/release-notes.mjs", - "scripts/seed-rank-tracking.ts", - ], - "project": ["**/*.{js,mjs,ts,tsx}", "!src/routeTree.gen.ts", "!web/**"], - "ignore": ["drizzle-prod.config.ts"], - // Disable Drizzle plugin - it tries to load drizzle.config.ts which imports cloudflare:workers - "drizzle": false, - "ignoreDependencies": [ - // Tailwindcss used via @tailwindcss/vite plugin - "tailwindcss", - "daisyui", - ], + "entry": [ + // Detect Tanstack Start Routes + "cli-auth.ts", + "src/start.ts", + "src/server.ts", + "src/router.tsx", + "src/routes/**/*.ts", + "src/routes/**/*.tsx", + // Drizzle config (plugin disabled due to cloudflare:workers import issues) + "drizzle.config.ts", + // DB schema — exports consumed via `import * as schema` / drizzle() + "src/db/index.ts", + "src/db/app.schema.ts", + "src/db/better-auth-schema.ts", + ], + "project": [ + "**/*.{js,mjs,ts,tsx}", + "!src/routeTree.gen.ts", + "!web/**" + ], + "ignore": [ + "drizzle-prod.config.ts" + ], + // Disable Drizzle plugin - it tries to load drizzle.config.ts which imports cloudflare:workers + "drizzle": false, + "ignoreDependencies": [ + // Tailwindcss used via @tailwindcss/vite plugin + "tailwindcss", + "daisyui", + ], } diff --git a/src/client/features/keywords/locations.ts b/src/client/features/keywords/locations.ts index cdee9a9..df3c5f8 100644 --- a/src/client/features/keywords/locations.ts +++ b/src/client/features/keywords/locations.ts @@ -3,7 +3,6 @@ export { DEFAULT_LOCATION_CODE, LABS_LOCATION_OPTIONS, - LOCATION_OPTIONS, LOCATIONS, getLanguageCode, isLabsLocationCode,