Hosting on Vercel

The app runs on Vercel, in Frankfurt. You create a project from the repository, fill in a handful of environment variables and deploy. Hardly any secrets go in: the anon key is public and Microsoft trusts Vercel through federation.

Create the project

New project from the repository
Vercel → Add New → Project → choose the repository, branch main. Leave Root Directory empty (the app is in the root folder).
Frankfurt region
Settings → Functions → Function Region: fra1 (Frankfurt). This is also in vercel.json.
Federation on
Settings → Security → Secure backend access with OIDC federation: on, mode Team. You already did this at step 3.
Pro plan
Hobby isn't for commercial use. Pro also gives you rollback and logs.

Environment variables

Settings → Environment Variables. Set them for Production only, and mark real secrets as Sensitive (then nobody can read them back later).

Vercel → project → Settings → Environment Variables

KeyValue

EnvironmentsProductionPreviewDevelopment

No variables saved yet

The full list:

Variable	Value	Secret?
`DATA_MODE`	`live`	no
`NEXT_PUBLIC_SUPABASE_URL`	Project URL from step 1	no
`NEXT_PUBLIC_SUPABASE_ANON_KEY`	anon key from step 1	no (public by design)
`APP_URL`	`https://<your-domain>`, no trailing slash	no
`TENANT_MODE`	`graph`	no
`GRAPH_CLIENT_ID`	application ID of Rollout – Readiness	no
`GRAPH_FEDERATION`	`vercel`	no
`GRAPH_ALLOWED_TENANTS`	your clients' tenant IDs, comma-separated	no
`ROLLOUT_LICENSE`	your license	no, but personal
`ROLLOUT_GATEWAY_SECRET`	see step 5	yes: Sensitive
`HEALTH_DETAILS`	`minimal`	no
`SECURITY_CONTACT`	e.g. `security@yourmsp.com`	no

Optional, for email from your own mailbox: MAIL_SENDER and MAIL_TENANT_ID.

NEXT_PUBLIC_ is baked in

Variables starting with NEXT_PUBLIC_ are included in the browser code at build time. After a change you need to redeploy. So never put anything secret in a NEXT_PUBLIC_ variable.

Check before deploying

Rollout has a script that reviews your configuration without showing values. Put the values in a local file that never goes into git (.env* is already in .gitignore). The output is in Dutch:

Terminal

If you see FOUT (error), don't deploy: the script says what's wrong. Then: Deployments → Redeploy (or push to main).

Check after deploying

Open https://<your-domain>/api/ready. You only see statuses, never addresses or error text:

"gateway": "not-enforced" is exactly right at this point: you turn on the server gateway in the next step.