Modules

Each module is small, opinionated, and independently usable.

modules/vercel

Provisions:

• A Vercel project linked to a GitHub repo (Next.js framework)
• A Vercel project domain
• Environment variables set from a map(string) input

Inputs:

Variable	Type	Description
project_name	string	Vercel project slug
domain	string	Custom domain (added to project)
github_repo	string	owner/repo
env_vars	map(string)	Project env vars (applied to production, preview, development)

Outputs: project_id, project_name.

modules/supabase

Provisions:

• A Supabase project in the requested region under your organisation
• A 32-character random database password (treat as sensitive)
• Auth configuration through supabase_settings: site URL, redirect allow-list, signup policy, JWT lifetime
• A deployed health edge function (Deno), gated by enable_edge_functions
• Reads the project's real anon and service-role keys via the supabase_apikeys data source

Inputs:

Variable	Type	Default	Description
project_name	string	-	Project name
org_id	string	-	Supabase organisation id
region	string	-	One of Supabase's supported regions (e.g. eu-west-2)
site_url	string	http://localhost:3000	Allowed site URL for the auth redirect flow
additional_redirect_urls	list(string)	[]	Extra redirect URLs accepted by the auth server
enable_signup	bool	true	Whether new users may sign up
jwt_expiry	number	3600	Access token (JWT) lifetime in seconds
enable_edge_functions	bool	true	Deploy the bundled edge functions

Outputs: project_id, api_url, anon_key (sensitive), service_role_key (sensitive), database_password (sensitive), edge_function_slugs. Make sure your remote state is encrypted because the sensitive outputs land in state.

modules/cloudflare

Provisions:

• DNS A and CNAME records pointing at Vercel's anycast IP and CNAME
• An R2 bucket named after the domain (dots replaced by hyphens)
• A Workers KV namespace named <domain>-kv
• An edge Worker (worker.js) bound to R2 as ASSETS and KV as CACHE, with a route mapping assets.<domain>/* to it, gated by enable_worker

Inputs:

Variable	Type	Default	Description
domain	string	-	Existing Cloudflare zone for the domain
enable_worker	bool	true	Deploy the edge Worker bound to R2 and KV
worker_name	string	<domain>-edge	Worker script name
worker_route_pattern	string	assets.<domain>/*	Route pattern mapped to the Worker

Outputs: zone_id, account_id, r2_bucket, kv_namespace, worker_name, worker_route.

modules/digitalocean (optional)

Provisions a single droplet for workloads that do not fit on Vercel (long-running jobs, non-HTTP services, anything that needs persistent disk state). The droplet runs Ubuntu 24.04 with Docker pre-installed and monitoring on, behind a firewall that allows only SSH, HTTP and HTTPS inbound.

Inputs:

Variable	Type	Default	Description
project_name	string	-	Base name for the droplet and firewall
region	string	lon1	DigitalOcean region
size	string	s-1vcpu-1gb	Droplet size slug
ssh_key_id	string	-	DO SSH key id for access

Outputs: droplet_id, ipv4.

How modules are wired in main.tf

module "supabase" {
  source       = "./modules/supabase"
  project_name = var.project_name
  region       = var.supabase_region
  org_id       = var.supabase_org_id

  site_url                 = "https://${var.domain}"
  additional_redirect_urls = ["https://www.${var.domain}", "http://localhost:3000"]
  enable_signup            = var.supabase_enable_signup
  jwt_expiry               = var.supabase_jwt_expiry
  enable_edge_functions    = var.supabase_enable_edge_functions
}

module "cloudflare" {
  source        = "./modules/cloudflare"
  domain        = var.domain
  enable_worker = var.cloudflare_enable_worker
}

module "vercel" {
  source       = "./modules/vercel"
  project_name = var.project_name
  domain       = var.domain
  github_repo  = var.github_repo
  env_vars = {
    NEXT_PUBLIC_SUPABASE_URL      = module.supabase.api_url
    NEXT_PUBLIC_SUPABASE_ANON_KEY = module.supabase.anon_key
    SUPABASE_SERVICE_ROLE_KEY     = module.supabase.service_role_key
    R2_BUCKET                     = module.cloudflare.r2_bucket
    KV_NAMESPACE_ID               = module.cloudflare.kv_namespace
  }
}

The Vercel project is created last so its env vars resolve from the Supabase and Cloudflare outputs. Terraform's dependency graph handles the ordering automatically.

Extending

To add a provider (for example Resend or Stripe), copy one of the existing modules. Keep the inputs minimal and the outputs explicit. Wire it into main.tf like any other module. The pattern stays the same.