English | 中文

Single-user personal startpage on TanStack Start, Cloudflare Workers, and D1.

1. Quick sign-in with a passkey
2. Fast migration from a legacy sui2 instance
3. Optional Tailscale service entries

1. Fork this repository on GitHub.

2. Create the D1 database

   wrangler d1 create sui3

   Note the returned database_id.

3. Configure repository secrets

   Under Settings → Secrets and variables → Actions, add:

   Secret	Purpose
   CLOUDFLARE_API_TOKEN	API token with Cloudflare Workers Admin, D1 Edit, and Zone Edit permissions
   CLOUDFLARE_ACCOUNT_ID	Your Cloudflare account ID
   SUI3_DOMAIN_PRODUCTION	Custom domain, e.g. start.example.com
   SUI3_D1_DATABASE_ID_PRODUCTION	The database_id from step 2

4. Push to master

   The included GitHub Actions workflow auto-generates wrangler.production.jsonc, builds, deploys to Cloudflare Workers, and applies D1 migrations on every push.

5. Configure Worker runtime values

   Set these in the Cloudflare dashboard (Workers & Pages → sui3 → Settings → Variables and Secrets), or generate the config locally and use the Wrangler CLI:

   SUI3_DOMAIN_PRODUCTION=start.example.com \
   SUI3_D1_DATABASE_ID_PRODUCTION=<database_id> \
   node scripts/generate-wrangler-config.js production
   
   wrangler secret put SETUP_TOKEN --config wrangler.production.jsonc
   wrangler secret put CREDENTIAL_ENCRYPTION_KEY --config wrangler.production.jsonc
   wrangler secret put WEBAUTHN_RP_ID --config wrangler.production.jsonc
   wrangler secret put WEBAUTHN_ORIGIN --config wrangler.production.jsonc

   Value	Example	Purpose
   SETUP_TOKEN	random string	One-time passkey enrollment secret
   CREDENTIAL_ENCRYPTION_KEY	openssl rand -base64 32	Encrypts integration credentials in D1
   WEBAUTHN_RP_ID	start.example.com	Must match the hostname used in the browser
   WEBAUTHN_ORIGIN	https://start.example.com	Origin used for WebAuthn

   wrangler.production.jsonc is generated by scripts/generate-wrangler-config.js from secrets and is gitignored. The base wrangler.jsonc contains no account-specific values so it can safely live in version control.

1. Open https://your-domain/setup, enter SETUP_TOKEN, and enroll your passkey. This only works once.
2. Open /admin and import your sui2 data.json (apps only; overwrites all existing categories and apps).
3. Optional: to enable Tailscale Services, create a Tailscale OAuth client with the read-only all:read scope, then enter its client ID and client secret in Admin → Tailscale. SUI3 derives the tailnet MagicDNS suffix from internal device FQDNs returned by the Tailscale API and refreshes it on every sync. If discovery fails during setup, Admin reveals an optional manual DNS fallback.

pnpm install
pnpm db:migrate:local
pnpm dev

Copy .dev.vars values as needed:

• SETUP_TOKEN — used once on /setup
• WEBAUTHN_RP_ID=localhost
• WEBAUTHN_ORIGIN=http://localhost:8333
• CREDENTIAL_ENCRYPTION_KEY — base64-encoded 32-byte key used to encrypt integration credentials

Generate a local encryption key with openssl rand -base64 32. Keep the same value between restarts or re-enter the Tailscale credential in Admin.

1. Open http://localhost:8333/setup and enroll your passkey
2. Open /admin and import your sui2 data.json

See AGENTS.md for architecture and auth details.