The starter ships hosted preview deploys for Cloudflare Workers and Vercel, but the self-hosted Docker Compose on VPS path has no preview-deploy story. Branch pushes only produce a build artifact, not a reviewable URL. That gap kills one of the biggest review-workflow wins for anyone running the starter on their own infra.
What is needed: a per-branch URL like `.preview.example.com` that resolves on the self-hosted VPS, terminates TLS, and routes to a container spun up for that branch. The naive approach (one Let's Encrypt cert per subdomain via HTTP-01) hits the per-registered-domain rate limit fast and breaks for IPv6-only testers. The clean approach is a wildcard cert via DNS-01, served by Caddy or Traefik in front of branch-keyed containers.
Concrete shape the docs/template should provide:
- A wildcard A+AAAA record on the chosen DNS provider pointing all of `*.preview.` at the VPS, dual-stack so IPv6-only clients can reach previews too. The starter should list working DNS-01 providers (Cloudflare, Route53, Hetzner DNS, Porkbun) and link to the matching Caddy plugin or Traefik provider config.
- A Caddy or Traefik example config that holds one wildcard cert refreshed via DNS-01 and on-demand serves any `*.preview.` host, reverse-proxying to a container the GitHub Action provisioned.
- A GitHub Actions workflow that on PR open/sync builds an image, ships it to the VPS, runs `docker compose --project-name pr- up -d` with the branch slug as the routing key, and posts the preview URL as a PR comment. On PR close it tears the project down.
- Local-dev escape hatch in the docs: if a self-hoster has no DNS provider yet, mention nip.io / sslip.io as a quick-start option, with a clear note that those are not production-grade (third-party dependency, rate-limited CAs).
Out of scope for this issue (each its own follow-up if desired): ephemeral Convex per preview, email/queue isolation across previews, branch-aware seed data, garbage collection of stale preview containers older than N days.
Acceptance: someone forking the starter, pointing a wildcard subdomain at their VPS, and adding their DNS provider's API token as a secret should get clickable preview URLs on every PR without any further config.
The starter ships hosted preview deploys for Cloudflare Workers and Vercel, but the self-hosted Docker Compose on VPS path has no preview-deploy story. Branch pushes only produce a build artifact, not a reviewable URL. That gap kills one of the biggest review-workflow wins for anyone running the starter on their own infra.
What is needed: a per-branch URL like `.preview.example.com` that resolves on the self-hosted VPS, terminates TLS, and routes to a container spun up for that branch. The naive approach (one Let's Encrypt cert per subdomain via HTTP-01) hits the per-registered-domain rate limit fast and breaks for IPv6-only testers. The clean approach is a wildcard cert via DNS-01, served by Caddy or Traefik in front of branch-keyed containers.
Concrete shape the docs/template should provide:
Out of scope for this issue (each its own follow-up if desired): ephemeral Convex per preview, email/queue isolation across previews, branch-aware seed data, garbage collection of stale preview containers older than N days.
Acceptance: someone forking the starter, pointing a wildcard subdomain at their VPS, and adding their DNS provider's API token as a secret should get clickable preview URLs on every PR without any further config.