Crunu and Vercel: host the server, push env variables

Two ways Crunu works with Vercel

• Host the Crunu server on Vercel. If your team already deploys there, the Crunu server has a Vercel build that uses Postgres on Neon. This part is built in: one script deploys it.
• Push values into your own Vercel projects. Crunu has no built-in sync into Vercel environment variables. A pipeline can push them with a short recipe, shown below.

Crunu itself runs in the cloud at app.crunu.com, so you need the first part only if you want your own server.

Host the server on Vercel

You need Node.js 24, the vercel CLI with vercel login done, a Neon database with its pooled address in DATABASE_URL, and a .env file created by server-init. The commands run from the Crunu server's directory, where the deploy scripts live.

node scripts/server-init.mjs --origin https://vault.company.example --database-url env:DATABASE_URL
sh deploy/vercel/deploy.sh --project vault-company --prod

The script checks .env, builds the server with the web client inside, creates the project if needed, writes the environment variables with values passed through stdin, and deploys the prebuilt output. The server applies schema migrations to its database by itself.

Without --prod, the script deploys a preview with its own database and its own server key, set as PREVIEW_DATABASE_URL and PREVIEW_SERVER_KEY. A preview build would run its migrations against whatever database it's connected to, so the script refuses to point a preview at production data unless you pass --preview-with-production-db.

Cleanup schedule

Cleanup of expired records runs on a Vercel cron job, only for production deployments with CRON_SECRET set. The default is once a day, because the Hobby plan doesn't allow a more frequent schedule; check Vercel's current plan limits. Expiry of sessions, links and break-glass access doesn't depend on it, because every request checks them. Some alerts do. If you use network restrictions with machine passes, run cleanup every minute or at least every 5 minutes, which needs Vercel Pro, and pass the schedule on every deploy:

sh deploy/vercel/deploy.sh --project vault-company --prod --cron "* * * * *"

Push values into Vercel from CI

If a Vercel project of yours keeps its variables in Vercel, a pipeline can copy them from Crunu. Use a separate production token with a CI binding (OIDC) to the main branch and the production deployment environment, so the token works only in that one job. An owner approves production access for it.

crunu run --env web-app/production -- sh -c 'printf "%s" "$DATABASE_URL" | vercel env add DATABASE_URL production --force'

crunu run decrypts the environment in memory and passes DATABASE_URL to the command, which hands it to vercel env add through stdin, never as an argument. Every run is recorded in Crunu's audit log: who, when, from which address and which version.

Related

• Self-hosting
• Vercel in the docs
• CI/CD in Crunu
• GitHub Actions