{"slug":"operations/DOPPLER_MIGRATION","title":"Doppler Infrastructure Migration","section":"operations","sectionLabel":"Operations","status":"unclassified","type":"document","path":"operations/DOPPLER_MIGRATION.mdx","bytes":5431,"description":null,"updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n\n> **Tier C — Historical.** This document is a point-in-time snapshot preserved for reference. For current architecture, see [CANONICAL_PLATFORM_ARCHITECTURE.md](../architecture/CANONICAL_PLATFORM_ARCHITECTURE.md).\n\n**Date:** February 27, 2026  \n**Purpose:** Standardize secrets management on Doppler, remove .env file confusion\n\n---\n\n## Changes Made\n\n### 1. Removed Local .env Workflow\n\n**Deleted:**\n- `scripts/setup-env.sh` — No longer needed\n- `apps/web/.env.example` — Not used with Doppler\n\n**Reason:** Doppler manages all secrets centrally. No local .env files.\n\n### 2. Updated Documentation\n\n**Modified Files:**\n- `AGENTS.md` — Added Doppler to infrastructure stack\n- `DEPLOYMENT_GUIDE.md` — Complete Doppler-based deployment workflow\n- `scripts/deploy-check.sh` — Checks Doppler instead of .env files\n\n### 3. Updated Source Code Comments\n\n**Modified:**\n- `apps/web/src/lib/api/supabase.ts` — Added Doppler workflow note\n- `apps/web/src/test/setup.ts` — Added note about Doppler\n\n---\n\n## New Doppler Workflow\n\n### Development\n\n```bash\n# Start dev server with Doppler\ncd integratewise-complete/apps/web\ndoppler run -- npm run dev\n\n# Or configure once\ndoppler setup  # Select: integratewise → dev\ndoppler run -- npm run dev\n```\n\n### Build\n\n```bash\n# Build with production secrets\ndoppler run -- npm run build\n```\n\n### Deploy\n\n```bash\n# Deploy to Cloudflare Pages with Doppler\ndoppler run -- wrangler pages deploy dist\n```\n\n---\n\n## Required Doppler Secrets\n\nConfigure these in your Doppler project (dev/staging/prod):\n\n| Secret | Description | Example |\n|--------|-------------|---------|\n| `VITE_SUPABASE_URL` | Supabase project URL | `https://abc123.supabase.co` |\n| `VITE_SUPABASE_ANON_KEY` | Supabase anon key | `eyJhbG...` |\n| `SUPABASE_SERVICE_KEY` | Service role key | `eyJhbG...` (backend only) |\n| `OPENROUTER_API_KEY` | AI inference | Optional |\n| `N8N_WEBHOOK_SECRET` | Workflow auth | Optional |\n\n---\n\n## Doppler Project Structure\n\n```\nintegratewise (Doppler Project)\n├── dev environment\n│   ├── VITE_SUPABASE_URL=https://dev-project.supabase.co\n│   └── VITE_SUPABASE_ANON_KEY=...\n├── staging environment\n│   ├── VITE_SUPABASE_URL=https://staging-project.supabase.co\n│   └── VITE_SUPABASE_ANON_KEY=...\n└── prod environment\n    ├── VITE_SUPABASE_URL=https://prod-project.supabase.co\n    └── VITE_SUPABASE_ANON_KEY=...\n```\n\n---\n\n## Migration from .env to Doppler\n\n### For Developers\n\n1. **Install Doppler CLI:**\n   ```bash\n   brew install doppler\n   # or\n   scoop install doppler  # Windows\n   ```\n\n2. **Login:**\n   ```bash\n   doppler login\n   ```\n\n3. **Setup Project:**\n   ```bash\n   cd integratewise-complete/apps/web\n   doppler setup\n   # Select: integratewise → dev\n   ```\n\n4. **Migrate Secrets:**\n   If you have an existing .env file:\n   ```bash\n   # Add each secret to Doppler\n   doppler secrets set VITE_SUPABASE_URL \"value\"\n   doppler secrets set VITE_SUPABASE_ANON_KEY \"value\"\n   ```\n\n5. **Delete .env:**\n   ```bash\n   rm .env .env.local .env.*.local\n   ```\n\n6. **Update .gitignore:**\n   ```bash\n   # Already done - .env files are ignored\n   ```\n\n---\n\n## Benefits of Doppler\n\n| Feature | Benefit |\n|---------|---------|\n| **Centralized Secrets** | One source of truth for all environments |\n| **No .env Files** | No risk of committing secrets |\n| **Environment Switching** | Easy dev/staging/prod switching |\n| **Secret Rotation** | Automatic rotation support |\n| **Audit Logs** | Track who accessed what secrets |\n| **Team Sharing** | Secure team secret sharing |\n| **CI/CD Integration** | Native GitHub Actions, etc. support |\n\n---\n\n## CI/CD Integration\n\n### GitHub Actions\n\n```yaml\n- name: Deploy with Doppler\n  uses: dopplerhq/secrets-fetch-action@v1\n  with:\n    doppler-token: ${{ secrets.DOPPLER_TOKEN }}\n    inject-env-vars: true\n- name: Build\n  run: npm run build\n```\n\n### Cloudflare Pages\n\n1. Doppler Dashboard → Integrations\n2. Connect Cloudflare Pages\n3. Secrets auto-sync on deploy\n\n---\n\n## Security Improvements\n\n| Before (.env) | After (Doppler) |\n|---------------|-----------------|\n| Files scattered on dev machines | Centralized vault |\n| Risk of committing secrets | No local files to commit |\n| Manual sync across team | Automatic sync |\n| No audit trail | Full access logging |\n| Hard to rotate | One-click rotation |\n\n---\n\n## Commands Reference\n\n```bash\n# Login\ndoppler login\n\n# Setup project\ndoppler setup\n\n# View secrets\ndoppler secrets\n\n# Set secret\ndoppler secrets set KEY value\n\n# Run command with secrets\ndoppler run -- npm run dev\ndoppler run -- npm run build\ndoppler run -- wrangler pages deploy dist\n\n# Switch environment\ndoppler configure set config=staging\ndoppler configure set config=prod\n\n# View activity\ndoppler activity\n```\n\n---\n\n## Verification\n\nRun the deployment check to verify Doppler setup:\n\n```bash\ncd /Users/nirmal/Github/integratewise-live\n./scripts/deploy-check.sh\n```\n\nExpected output:\n```\n✓ Doppler CLI installed\n✓ Doppler authenticated\n✓ Doppler project configured\n✓ VITE_SUPABASE_URL configured in Doppler\n✓ VITE_SUPABASE_ANON_KEY configured in Doppler\n✓ Build succeeds with Doppler secrets\n...\n🎉 All critical checks passed! Ready for deployment.\n```\n\n---\n\n## Questions?\n\nSee:\n- `DEPLOYMENT_GUIDE.md` — Full deployment instructions\n- `AGENTS.md` — Architecture documentation\n- [Doppler Docs](https://docs.doppler.com)\n"}