Managed-Hosting CMS Model — Agency Keeps the Infra (Cloudflare + Supabase)

Author: hermes • Date: 2026-07-15 • Tier: T-deep (decision-grade; every load-bearing claim verified against a primary source) This is ARM 2 of the CMS research arc. Arm 1 = build-and-handover on Vercel (research/cms-basketball-vercel-handover-2026-07-15/REPORT.md, verdict Payload v3). Sources: sources/T1-cms-cloudflare-supabase.md · sources/T2-auth-model.md · sources/T3-multitenancy-cloudflare-hosting.md · sources/T4-business-model-economics.md Model in scope: agency keeps the site permanently on its OWN Cloudflare + Supabase infra; client gets only login credentials; agency runs upkeep for a yearly fee.

TL;DR

The CMS decision comes down to which "native" axis you optimize — and the two candidates split it:
Directus is the most Supabase-data-native — it's an official Supabase partner integration, database-first: point it at your Supabase Postgres and it introspects existing tables as collections. Best turnkey editor UX (no-code Data Studio + granular roles). But it CANNOT run on Cloudflare compute — it needs a separate always-on VM (Fly/Railway) per site. — directus.com/features/existing-database, Directus×Supabase
Payload v3 is the most Cloudflare-compute-native — the only candidate with an official GA Cloudflare Workers deploy (connects to Supabase Postgres via Hyperdrive, R2 for media). So the whole site stays on Cloudflare Workers + Supabase + R2 with NO third host. Downside: Payload OWNS its schema (it's the app's DB, not a skin over your existing tables), and roles need dev setup. — blog.cloudflare.com/payload-cms-workers
Recommendation: Payload v3 for the managed model too — because for a managed fleet the deciding factor is minimum moving parts per site, and Payload is the only option that keeps you purely on Cloudflare+Supabase (no per-client VM). Directus is the strong alternative if turnkey editor UX + "Supabase Postgres as the canonical data layer" matter more to you than avoiding a VM. This corrects the T1 lane's single-axis "Directus wins" ranking — true on data-nativeness, but it under-weighted its own flagged Cloudflare-compute gap.
⭐ Cross-arm tie-breaker: Payload keeps BOTH business models open. Arm 1 (handover) → Payload on the client's Vercel. Arm 2 (managed) → Payload on your Cloudflare. Same CMS serves both offerings. Picking Directus would lock the agency into managed-only (it can't cleanly hand over and needs a VM). One skillset, two products.
You do NOT need Supabase Auth for "client just gets login codes." The CMS's own invite-and-role flow issues those logins — that IS the SaaS-style login. Keep Supabase for DB + storage (and reserve Supabase Auth only for a future public member audience, kept separate). CMS↔Supabase-Auth SSO reconciliation is paid/enterprise on all three — don't walk into it. — T2
Business model: lead with managed. Recurring revenue drives a 1.5–4× agency valuation premium (cited M&A data). Price yearly upkeep $600–1,200/yr; agency infra cost is ~$12/mo marginal per site, so margins are healthy. Write a mandatory data-export / exit clause into the contract — it neutralizes the "held hostage" lock-in liability. — T4

The core decision: two native axes (surface the tension, don't hide it)

	Directus	Payload v3
Supabase-Postgres fit	✅✅ database-first — introspects your existing Supabase tables (official partner integration; stays in `public` schema, can't touch `auth`/`storage`)	✅ connects via Hyperdrive, but OWNS/migrates its own schema (drops-recreates by default — it's the app's DB, not a skin over existing tables)
Cloudflare compute	❌ needs a VM (Fly/Railway) fronted by CF DNS/CDN/Access/R2 — Containers billing favors sleep-capable, unproven always-on for Directus	✅✅ official GA Cloudflare Workers deploy — no extra host
Editor UX for non-tech client	✅✅ turnkey Data Studio + no-code granular roles	✅ good, but roles = custom `role` field + access fns (dev setup)
Moving parts per site (managed fleet)	Supabase + VM + Cloudflare(CDN/R2) = 3 hosts	Cloudflare Worker + Supabase + R2 = 2 hosts, 1 compute
Strategic lock-in	managed-only (can't hand over cleanly)	handover OR managed (both arms)

Deciding question for you: does "our stack" mean "minimize infra + keep both business models open" (→ Payload) or "Supabase Postgres is the canonical data layer and the CMS is a thin admin over it, VM is fine" (→ Directus)? For a managed fleet you want cheap + low-ops, Payload's single-compute model wins total cost of ownership.

Auth: the simplest correct answer (T2)

The operator's phrase — "client just gets login codes, as they would from any other service" — is satisfied by the CMS's own auth. All three CMSs ship their own user store + scoped roles; you invite the coach/admins/players and hand them credentials. Done.

Do NOT stand up Supabase Auth for content editors. Supabase Auth (GoTrue) and CMS-native auth are separate identity systems with no free reconciliation — SSO deferral is paid/enterprise on all three (Directus Team+, Strapi SSO add-on, Payload Enterprise) or a DIY plugin. Merging them buys complexity you don't need. — Directus SSO, Strapi SSO
Keep Supabase for what it's good at here: Postgres + Storage. Reserve Supabase Auth only if the public site later needs member/fan logins — a deliberately separate audience from content editors.
⚠ One unconfirmed claim flagged by the lane: "Directus Open Innovation Grant includes SSO free" — secondary sources only, no first-party quote. Don't rely on it.
Security note (Directus-on-Supabase path): Directus connects with a role that bypasses Supabase RLS — Directus's own permission layer becomes the gate. Fine, but it means RLS isn't your safety net on that DB; design accordingly.

Hosting + multi-tenancy for the managed fleet (T3)

Tenancy: one Supabase project + one isolated CMS instance PER client — not shared multi-tenancy. These CMSs are single-tenant by design; per-client isolation keeps blast radius small and exit clean. — T3
Payload path: one Cloudflare Worker + Supabase Postgres (Hyperdrive) + R2 per site. Directus/Strapi path: one small VM (Fly.io/Railway) + Supabase + R2, Cloudflare in front (DNS/CDN/Access free <50 users to gate admin).
Cloudflare Containers hit GA 2026-04-13 but bill for bursty/sleep workloads — not cost-effective for always-on Directus/Strapi. — CF Containers GA, pricing
Media: Cloudflare R2 — no egress fees, fits the CF-native stack. — R2 pricing

Agency infra cost (what YOU pay to run the fleet)

Sites	Model (Payload/CF-Workers)	Model (Directus/VM)
Base	~$25/mo Supabase Pro (org-wide)	~$25/mo Supabase Pro
+1 site	~$5–12/mo marginal (Worker + DB compute + R2)	~$12/mo marginal (VM + DB + R2)
10 sites	~$85–145/mo	~$145/mo
20 sites	~$150–265/mo	~$265/mo

(Ranges from T3; Payload-on-Workers trims the per-site VM. Supabase Pro is org-level; free-tier projects pause on inactivity — not viable for live client sites, so Pro is the floor.)

Business model: managed vs handover (T4)

	Model A — Handover (arm 1)	Model B — Managed (this arm)
Revenue	one-time build fee	build fee + recurring yearly upkeep
Agency ongoing cost	~$0	~$12/mo per site infra + support labor
Recurring revenue	none	yes → 1.5–4× valuation premium (cited M&A data)
Liability	transfers to client	agency owns uptime + patching + SLA
Lock-in risk	none	"held hostage" unless exit clause written
Client control	full	login only

Market benchmark: small-business website care/maintenance plans converge at $75–200/mo ($900–2,400/yr) (WebFX, ManyRequests, Claremont, websitemaintenanceservices.org — all 2025-26, cited in T4). No direct comp for the CF+Supabase login-only pattern → extrapolated, flagged.
Suggested pricing: $600–1,200/yr upkeep for a small team site. Against ~$12/mo (~$144/yr) infra, that's a ~60–80% gross margin before labor.
Non-negotiable contract term: a data-export / exit clause (client can take their content + data on departure). Kills the lock-in reputational risk while keeping the revenue upside.
The two models are not mutually exclusive — offer both, tiered. Which is exactly why the CMS pick should keep both doors open (→ Payload).

Recommendation

CMS: Payload v3 for the managed model — it's the only option that keeps you purely on Cloudflare Workers + Supabase + R2 (no per-site VM), and it keeps the handover model open too (one CMS, both products). Directus is the strong alternative if turnkey editor UX + Supabase-as-canonical-data-layer outweigh running a VM per site.
Auth: CMS-native logins for the client. No Supabase Auth for editors. Keep Supabase for Postgres + Storage.
Infra: one Supabase project + one Payload Worker + R2 per client, Cloudflare in front, Cloudflare Access gating admin.
Business: lead with managed, price $600–1,200/yr, mandatory data-export clause, offer handover as a higher one-time tier.

Confidence + flagged gaps

Verified from primary sources: Payload-on-Workers (Cloudflare blog), Directus database-first + Supabase partner integration, Cloudflare Containers GA/pricing, R2 pricing, Supabase Pro model, care-plan market pricing.
Flagged, not load-bearing: Directus OIG-includes-SSO (unconfirmed, secondary only); Payload-on-Workers production maturity (GA but young — pilot before committing a fleet); exact per-site compute cost varies with traffic. None gates the recommendation.

§Cross-arm summary (both reports)

	Arm 1 — Handover (Vercel)	Arm 2 — Managed (Cloudflare)
Winner	Payload v3	Payload v3
Why	only Vercel-native CMS, clean handover	only Cloudflare-compute-native CMS, fewest moving parts
Alt	—	Directus (best Supabase-data fit + editor UX, costs a VM)
Strategic takeaway	Payload is robust across BOTH business models — choosing it does not lock the agency into either. That is the single most valuable finding of the whole arc.