Quickstart

Quick install

The installer checks and sets up every prerequisite automatically — Node.js 20+, pnpm, and the Supabase CLI. Then it clones your repo, installs dependencies, and copies .env.example to get you to your first pnpm dev in minutes.

Before running: purchase a licence, accept the GitHub invite Polar sends, and click "Use this template" on the private repo to create your own copy. You'll paste that URL when the installer asks.

curl -fsSL https://already-eu.wait-what.shop/install.sh | bash

The installer is a plain shell script — read it first if you prefer. No remote execution beyond Homebrew and npm.

What the script does

• Checks for Homebrew (macOS) — installs if missing
• Checks Node.js 20+ — installs or upgrades via Homebrew
• Checks pnpm 9+ — installs via npm if missing
• Checks Supabase CLI — installs via Homebrew if missing
• Asks for your GitHub repo URL and a local folder name
• Clones, runs pnpm install, copies .env.example → .env.local
• Prints the three commands to finish setup

After install

The installer leaves you at a working directory with dependencies installed and a blank .env.local. Three more steps to a running app:

pnpm setup

pnpm dev

If you'd rather control each step, skip the installer and follow the steps below. Same end result.

Prerequisites

You need these installed before you start. All free.

You'll also need accounts with Supabase (free tier), Mollie (test mode), and Vercel (free tier). None require billing information to start.

Step 1 — Purchase

Step 2 — Clone

git clone https://github.com/YOUR_USERNAME/YOUR_REPO_NAME
cd YOUR_REPO_NAME
pnpm install

Step 3 — Run setup

cp .env.example .env.local
# Edit .env.local — add your Supabase and Mollie keys
pnpm setup

pnpm setup:mollie

Step 4 — Local dev

pnpm dev

Step 5 — Deploy

vercel deploy --prod

Required env vars

All vars are documented in .env.example with inline comments. The minimum set for local dev:

# Supabase (local: run supabase start)
NEXT_PUBLIC_SUPABASE_URL=
NEXT_PUBLIC_SUPABASE_ANON_KEY=
SUPABASE_SERVICE_ROLE_KEY=
DATABASE_URL=
DATABASE_URL_DIRECT=

# Mollie (test mode keys from dashboard)
MOLLIE_SECRET_KEY=
MOLLIE_WEBHOOK_SECRET=
NEXT_PUBLIC_MOLLIE_PUBLISHABLE_KEY=

# Brevo (dev mode — emails logged, not sent)
BREVO_API_KEY=

# Webhook signing key — required. Generate with: openssl rand -base64 32
WEBHOOK_SIGNING_KEY=

# Cron secret — must match Vercel Cron's Authorization header
CRON_SECRET=

Keep secrets out of .env files

Optional but recommended once you go to production. Already ships a CLI that stores production credentials in your OS keychain (macOS Keychain or pass on Linux) instead of .env.local. A stolen laptop or an accidental git add .env can no longer leak a live Mollie key.

pnpm already secrets push        # interactive prompt → keychain
eval "$(pnpm already secrets export)"   # inject into the current shell
pnpm already secrets scan        # check .env files for live keys

The pre-commit hook runs secrets scan automatically. If a .env* file contains anything that looks like a real Mollie live key, a Brevo API key, or a Postgres URL with embedded credentials, the commit is blocked. Test-mode keys and explicit placeholders are allowlisted.

Full recipe: docs/recipes/keychain-secrets.md in your repo.

Useful commands

pnpm dev                     # start everything
pnpm db:seed                 # seed local DB with demo data
pnpm db:studio               # open Drizzle Studio (local DB UI)
pnpm reset                   # drop DB → migrate → seed (~5s)
pnpm email                   # React Email preview server
pnpm test                    # Vitest unit + integration tests
pnpm test:e2e                # Playwright E2E tests
pnpm already doctor          # health check: env, DB, Mollie, deps
pnpm already secrets push    # store credentials in macOS Keychain
pnpm already secrets export  # emit `export KEY=value` lines for shell eval
pnpm already secrets scan    # detect live keys in .env files (pre-commit hook)
pnpm already changelog       # compare your fork against the latest release

What's in the repo

Already ships 16 modules. Each has its own docs inside the repo. Here's the map:

• Auth — lib/auth/, app/(auth)/. Includes the owner-only org MFA mandate at /app/settings/security.
• Billing — lib/billing/, config/billing.ts, app/(billing)/
• Multi-tenant orgs — lib/orgs/, db/schema/orgs.ts. B2B and B2C mode toggle in config/app.ts.
• Messaging — messaging/, lib/messaging/
• Background jobs — lib/jobs/, app/api/cron/
• AI integration — lib/ai/, per-org credits ledger, per-org rate limits at lib/auth/rate-limit.ts
• Feature flags — lib/flags/, config/flags.ts
• Admin — app/(admin)/, impersonation, append-only audit log
• Security — lib/security/, anomaly detection, AES-256-GCM secret-at-rest, SSRF-guarded outbound webhooks
• SSO + SCIM (Enterprise add-on) — lib/auth/sso.ts, lib/scim/, endpoint at app/api/scim/v2/
• i18n — lib/i18n/, messages/ (en, de, es, it, fr)
• Secrets CLI — cli/commands/secrets.ts. Push to macOS Keychain, pre-commit scanner blocks live keys from .env files.

Full module reference docs are inside the repo at docs/recipes/, readable by Claude Code and Cursor out of the box. Two recipes worth flagging up front: docs/recipes/keychain-secrets.md (production-grade secret handling) and docs/recipes/scim-provisioning.md (Okta and Entra integration).