Skip to content

ADR-0008: Deploy the intranet to Vercel behind single-user auth

Guide

ADR-0008: Deploy the intranet to Vercel behind single-user auth

  • Status: Accepted · Date: 2026-05-30 · Approved by: Kevin Wong
  • Supersedes: the deploy and single-user login deferrals in ADR-0006 (the live chatter store stays deferred).

Context

The intranet (ADR-0006) was built static and local-first, with deployment and access deferred. The Principal now wants it live — visible to themselves only.

Decision

Deploy the static Astro site to Vercel, GitHub-connected to kevinvwong/klms with Root Directory = intranet/ (the build’s sync-content.mjs reads the whole repo via ../, so the full checkout must be present), framework Astro, npm run build → dist. Access is gated by Vercel Authentication (Deployment Protection) — no code, no shared secret; only the Principal’s Vercel account can view. Auto-redeploys on repo changes keep the portal truthful to the repo.

Chatter store remains deferred (kept as seeded chatter.json) until agents produce real traffic — standing up Supabase now would add cost, a client-side key, and infra for zero demand.

Consequences

  • A live, access-protected URL; the repo stays the source of truth.
  • GitHub→Vercel app authorization + enabling Deployment Protection are the Principal’s dashboard actions (see the runbook docs/sop/deploy-intranet.md).
  • Granted as AR-002 (Vercel hosting + GitHub-app, this repo only; no secret).
  • astro.config.mjs site is set to klms-intranet.vercel.app; update it if the project is named differently. Tag the first-product-slice milestone once live.
  • If single-user-by-Vercel-account ever needs to broaden, revisit with SSR + a login (the heavier option weighed and rejected here for leanness).