SEOBase
Back to Docs

Cloudflare Self-Hosting

Deploy SEOBase to your own Cloudflare account for internet-facing, multi-device, or team use.

Host SEOBase on Cloudflare for internet-facing self-hosting across multiple devices or with your team. One deploy command provisions everything, including the Cloudflare Access login gate. Works on Cloudflare's free plan.

Prerequisites

  • Node 22.6 or newer and pnpm (corepack enable sets it up).
  • A Cloudflare account with R2 enabled. Activating R2 requires a payment method on file, even within its free tier — if you have never used R2, open R2 in the Cloudflare dashboard once.
  • A DataForSEO account — see DataForSEO API key setup.

1) Clone your SEOBase repo

Fork every-app/open-seo on GitHub if you want a repo you control, then clone it locally:

git clone https://github.com/YOUR_GITHUB_USER/open-seo.git
cd open-seo
corepack enable
pnpm install

If you do not need a fork, clone the upstream repo instead:

git clone https://github.com/every-app/open-seo.git
cd open-seo
corepack enable
pnpm install

2) Log in to Cloudflare (once)

pnpm alchemy login                # answer yes to "Customize OAuth scopes?" and enable access:write
pnpm alchemy cloudflare bootstrap # deploys alchemy's state-store Worker to your account

Already logged in from before without the access:write scope? Run pnpm alchemy login --configure — a plain repeat login doesn't re-ask about scopes.

3) Create .env.selfhost

Copy the template and fill in the required values:

cp .env.selfhost.example .env.selfhost

4) Deploy

pnpm deploy:selfhost --yes

This provisions the D1 database, KV namespaces, and R2 bucket, applies the database migrations, deploys the Worker, and creates the Cloudflare Access application protecting it (allowing exactly ACCESS_ALLOWED_EMAILS). If the account has no Zero Trust team yet, one is created for you, named after your workers.dev subdomain.

5) Validate setup

  1. Open the Worker URL printed at the end of the deploy.
  2. Sign in with Cloudflare Access.
  3. SEOBase should load after login.

If login fails, re-check ACCESS_ALLOWED_EMAILS and redeploy.

Connect the MCP server through Cloudflare Access

Use the same Cloudflare Access application that protects your SEOBase Worker. Managed OAuth is required for MCP clients and is not enabled by default.

  1. Open Cloudflare Zero Trust.
  2. Go to Access controls -> Applications.
  3. Find your SEOBase application, then select Edit.
  4. Go to Additional settings -> OAuth.
  5. Turn on Managed OAuth.
  6. In Managed OAuth settings, allow the redirect URIs your MCP clients use:
    • Allow localhost / loopback clients for CLI and desktop agents (Codex CLI, Claude Code) that register http://localhost:PORT/callback.
    • Add HTTPS redirect URIs for web connectors (a path may end in /*).
    • Without this, clients can't finish Dynamic Client Registration and log in but expose no tools.
  7. Save.

MCP clients should connect to:

https://YOUR_WORKER_HOSTNAME/mcp

Give teammates access to SEOBase

Add the teammate to ACCESS_ALLOWED_EMAILS in .env.selfhost and redeploy. Everyone allowed through shares one SEOBase workspace.

Updating to the latest SEOBase version

git pull        # or: git fetch upstream && git merge upstream/main, if you forked
pnpm install
pnpm deploy:selfhost --yes
  • Operations: telemetry and other day-to-day tasks.
  • Legacy deployments: maintenance for installs created with the retired Deploy-button or manual Wrangler flows.