[SaaS #1] Infrastructure: wildcard domain, Vercel, Supabase Auth, Resend

[macwilling]

Overview

Manual infrastructure steps required before any code changes. Must be completed first — all subsequent SaaS issues depend on this.

Context

Moving TaskFlow to a true multi-tenant SaaS on billabledesk.com. Each tenant will get their own subdomain: {slug}.billabledesk.com (admin) and {slug}.billabledesk.com/portal (client portal). This issue covers all the infra/DNS/service configuration — no code changes.

Checklist

Domain

• Purchase billabledesk.com
• Point nameservers to Cloudflare (or add to existing Cloudflare account)

DNS (Cloudflare)

• Add A / CNAME record: billabledesk.com → Vercel
• Add wildcard CNAME: *.billabledesk.com → Vercel (proxied or grey-cloud for SSL)

Vercel

• Add billabledesk.com as a custom domain on the project
• Add *.billabledesk.com as a wildcard custom domain (Vercel Pro supports wildcard domains)
• Verify SSL provisioned for both

Supabase Auth

• Auth → URL Configuration → Site URL: set to https://billabledesk.com
• Auth → URL Configuration → Redirect URLs: add https://*.billabledesk.com/auth/callback
  • Supabase supports wildcard redirect URLs for subdomains

Resend

• Add and verify billabledesk.com as a sending domain in Resend
• Update RESEND_DOMAIN environment variable in Vercel to billabledesk.com
• Update local .env accordingly

Environment Variables (Vercel dashboard)

• Add NEXT_PUBLIC_BASE_DOMAIN=billabledesk.com
• Add NEXT_PUBLIC_COOKIE_DOMAIN=.billabledesk.com (leading dot = all subdomains)
• Remove ALLOW_REGISTRATION (will be removed in code too)
• Keep NEXT_PUBLIC_APP_URL temporarily during transition; remove after [SaaS #5] URL construction: replace NEXT_PUBLIC_APP_URL with NEXT_PUBLIC_BASE_DOMAIN #93 is merged

Depends On

Nothing — this is first.

Blocks

All other SaaS issues (#88 - #96)

[macwilling]

Blocks: #88 (and transitively all downstream SaaS issues)