Skip to main content
This guide assumes an existing CockroachDB Cloud cluster, AWS account, Vercel project, DNS control for trystash.xyz, and administrative credentials held outside Git.
1

Store the protected database connection

Create separate migration and restricted runtime SQL principals. Store the runtime connection URL in AWS Secrets Manager and record only its secret ARN in deployment parameters.
2

Apply database migrations

Export the administrative DATABASE_URL and COCKROACH_SQL_CLUSTER_ID, then run:
Confirm all files in db/migrations/ apply and the vector index job reaches a ready state before serving production retrieval.
3

Validate and build AWS infrastructure

Keep the production SAM parameter file ignored. It contains secret references and protected runtime values.
4

Deploy the AWS stack

The template provisions the API, API/outbox/sandbox Lambdas, Cognito pool, versioned S3 bucket, EventBridge bus, CloudWatch logs and alarms, X-Ray tracing, and least-responsibility IAM roles.
5

Configure the Vercel gateway

Set STASH_API_BASE_URL, STASH_BOOTSTRAP_KEY, STASH_SESSION_SECRET, and STASH_TRUSTED_SOURCE_KEYS as server-only production variables. Set NEXT_PUBLIC_APP_URL=https://trystash.xyz as the sole browser-visible runtime setting.
6

Generate and audit production evidence

Treat any missing, malformed, mismatched, or stale evidence as failure. Publish only the redacted receipt.
The deployment is complete when the live onboarding flow creates a persisted workspace, the full release lifecycle succeeds, the vector index is visible and ready, and the redacted evidence audit passes.