Deploy it,from laptop to always on

npm ci && npm run build          # buildrsync -a dist/ server:/srv/app/   # shipssh server "pm2 reload app"       # release

#!/usr/bin/env bash# The whole idea of a deployment in twenty linesset -euo pipefail APP=apiHOST=deploy@203.0.113.10RELEASE=$(date +%Y%m%d%H%M%S) # 1. Build an artifact on a clean machine (CI or your laptop)npm cinpm run build                       # TypeScript -> dist/, React -> web/dist/ # 2. Ship it to a new, versioned folderrsync -az --delete dist/ package.json package-lock.json "$HOST:/srv/$APP/releases/$RELEASE/" # 3. Install production dependencies and switch atomicallyssh "$HOST" bash -s <<EOF  cd /srv/$APP/releases/$RELEASE && npm ci --omit=dev  ln -sfn /srv/$APP/releases/$RELEASE /srv/$APP/current  pm2 reload /srv/$APP/ecosystem.config.js --update-envEOF # 4. Verify, or roll back to the previous releasecurl -fsS https://api.example.com/health || echo "health check failed, roll back"

dig +short app.example.com          # DNScurl -vI https://app.example.com    # TLS + Nginx + app headers

# Walk the request path hop by hop when something breaks dig +short app.example.com                 # 1. DNS: does the name resolve to your IP?nc -zv app.example.com 443                 # 2. Network: is port 443 open?openssl s_client -connect app.example.com:443 -servername app.example.com </dev/null | head -20                                            # 3. TLS: valid certificate for this name?curl -sI https://app.example.com           # 4. Nginx: status and Server headercurl -s http://127.0.0.1:3000/health       # 5. On the server: is Node itself healthy?pm2 status                                 # 6. Process: online, restarts, memorysudo tail -n 50 /var/log/nginx/error.log   # 7. Proxy errors: upstream refused or timed out

const required = ["DATABASE_URL", "JWT_SECRET"];for (const k of required) if (!process.env[k]) throw new Error(`Missing ${k}`);

// config.js: validate once at startup, export a typed objectconst required = ["NODE_ENV", "PORT", "DATABASE_URL", "JWT_SECRET", "AWS_REGION"];const missing = required.filter((k) => !process.env[k]);if (missing.length) {  console.error(`Refusing to start, missing env: ${missing.join(", ")}`);  process.exit(1);} module.exports = Object.freeze({  env: process.env.NODE_ENV,  port: Number(process.env.PORT),  databaseUrl: process.env.DATABASE_URL,  jwtSecret: process.env.JWT_SECRET,  awsRegion: process.env.AWS_REGION,  logLevel: process.env.LOG_LEVEL || (process.env.NODE_ENV === "production" ? "info" : "debug"),  isProd: process.env.NODE_ENV === "production",});

example.com.      300  A      203.0.113.10www.example.com.  300  CNAME  example.com.

; A small production zoneexample.com.            300   A      203.0.113.10        ; Linode VPS running Nginxwww.example.com.        300   CNAME  example.com.api.example.com.        300   A      203.0.113.10        ; same box, Nginx routes by server_namestatic.example.com.     300   CNAME  d111111abcdef8.cloudfront.net.   ; frontend on S3 + CloudFrontexample.com.            300   CAA    0 issue "letsencrypt.org"        ; only this CA may issue certsexample.com.            300   TXT    "v=spf1 include:amazonses.com ~all" ; Check from anywhere; dig +short api.example.com; dig +trace example.com

linode-cli linodes create --region ap-south --type g6-standard-1 \  --image linode/ubuntu24.04 --authorized_keys "$(cat ~/.ssh/id_ed25519.pub)"

#!/usr/bin/env bash# Create a server from the terminal with the Linode CLIlinode-cli linodes create \  --label api-prod-1 \  --region ap-south \  --type g6-standard-1 \  --image linode/ubuntu24.04 \  --root_pass "$(openssl rand -base64 32)" \  --authorized_keys "$(cat ~/.ssh/id_ed25519.pub)" \  --backups_enabled true \  --private_ip true \  --tags production # Find its public IPlinode-cli linodes list --label api-prod-1 --format ipv4 --text --no-headers # First login with your key, never a passwordssh root@203.0.113.10

adduser deploy && usermod -aG sudo deploysed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config

#!/usr/bin/env bash# Run once as root on a fresh Ubuntu serverset -euo pipefail adduser --disabled-password --gecos "" deployusermod -aG sudo deploymkdir -p /home/deploy/.sshcp /root/.ssh/authorized_keys /home/deploy/.ssh/chown -R deploy:deploy /home/deploy/.ssh && chmod 700 /home/deploy/.ssh && chmod 600 /home/deploy/.ssh/authorized_keys # Keys only, no root, no passwordscat > /etc/ssh/sshd_config.d/10-hardening.conf <<'EOF'PermitRootLogin noPasswordAuthentication noKbdInteractiveAuthentication noMaxAuthTries 3AllowUsers deployEOFsshd -t && systemctl reload ssh      # test config before applying apt-get install -y fail2bansystemctl enable --now fail2ban

ufw default deny incoming && ufw allow OpenSSH && ufw allow "Nginx Full" && ufw enable

#!/usr/bin/env bashset -euo pipefailufw default deny incomingufw default allow outgoingufw allow from 198.51.100.0/24 to any port 22 proto tcp   # SSH only from office or VPNufw allow "Nginx Full"                                    # 80 and 443ufw --force enableufw status verbose # Prove the app port is NOT reachable from outside# From your laptop: nc -zv 203.0.113.10 3000   -> should time out # And make Node listen on loopback only# app.listen(3000, "127.0.0.1")

curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -sudo apt-get install -y nodejs git build-essential

#!/usr/bin/env bashset -euo pipefail# System wide Node 22 LTS from NodeSourcecurl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -sudo apt-get install -y nodejs git build-essential node -v && npm -v # PM2 for the deploy usersudo npm install -g pm2@latest # Pin the version in the repo so CI and servers agreeecho "22" > .nvmrcnpm pkg set engines.node=">=22 <23"

/srv/api/releases/20261006T1015/   /srv/api/shared/.env   /srv/api/current -> releases/20261006T1015

/srv/api/  releases/    20261004T0930/        older, kept for rollback    20261005T1802/    20261006T1015/        newest, fully installed before switch  shared/    .env                  secrets, chmod 600, owned by deploy    uploads/              user files that must survive deploys    logs/  current -> releases/20261006T1015     what PM2 and Nginx point at  ecosystem.config.js     cwd: /srv/api/current # Switch atomically: rename over the old symlink in one stepln -sfn /srv/api/releases/20261006T1015 /srv/api/current.tmpmv -Tf /srv/api/current.tmp /srv/api/current

pg_dump "$DATABASE_URL" -Fc -f /tmp/app.dump && aws s3 cp /tmp/app.dump s3://acme-backups/db/

#!/usr/bin/env bash# Nightly logical backup in addition to RDS automated backupsset -euo pipefailSTAMP=$(date +%F)pg_dump "$DATABASE_URL" --format=custom --no-owner -f "/tmp/app-$STAMP.dump"aws s3 cp "/tmp/app-$STAMP.dump" "s3://acme-backups/db/app-$STAMP.dump" --storage-class STANDARD_IArm "/tmp/app-$STAMP.dump" # Restore drill (into a scratch database, never production)# aws s3 cp s3://acme-backups/db/app-2026-10-05.dump .# createdb app_restore_test# pg_restore --no-owner -d app_restore_test app-2026-10-05.dump# psql app_restore_test -c "select count(*) from users;"

http {  server { listen 80; server_name example.com; location / { root /srv/web/current; } }}

# /etc/nginx/nginx.conf (trimmed)user www-data;worker_processes auto;                 # one per CPU coreevents { worker_connections 4096; } http {    include       /etc/nginx/mime.types;    sendfile      on;    tcp_nopush    on;    keepalive_timeout 65;    server_tokens off;                 # hide the version number    client_max_body_size 10m;          # upload limit     include /etc/nginx/conf.d/*.conf;    include /etc/nginx/sites-enabled/*;} # Commands you will use every day#   sudo nginx -t                 test config#   sudo systemctl reload nginx   graceful reload#   sudo ln -s /etc/nginx/sites-available/app /etc/nginx/sites-enabled/

location /api/ {  proxy_pass http://127.0.0.1:3000;  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;}

# /etc/nginx/sites-available/apiupstream node_api {    server 127.0.0.1:3000;    keepalive 64;                         # reuse connections to Node} server {    listen 443 ssl http2;    server_name api.example.com;    # ssl_certificate lines added by certbot     location / {        proxy_pass http://node_api;        proxy_http_version 1.1;        proxy_set_header Connection "";        proxy_set_header Host $host;        proxy_set_header X-Real-IP $remote_addr;        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;        proxy_set_header X-Forwarded-Proto $scheme;        proxy_set_header X-Request-Id $request_id;         proxy_connect_timeout 5s;        proxy_read_timeout 60s;        proxy_next_upstream error timeout http_502;    }} # In Express: app.set("trust proxy", 1);

root /srv/web/current;location / { try_files $uri $uri/ /index.html; }

server {    listen 443 ssl http2;    server_name example.com www.example.com;    root /srv/web/current;                 # output of npm run build    index index.html;     # Hashed assets: cache forever    location /assets/ {        expires 1y;        add_header Cache-Control "public, max-age=31536000, immutable";        try_files $uri =404;    }     # The HTML shell: always revalidate so new deploys show up    location = /index.html {        add_header Cache-Control "no-cache";    }     # API on the same origin, no CORS needed    location /api/ {        proxy_pass http://127.0.0.1:3000/;        proxy_set_header Host $host;        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;        proxy_set_header X-Forwarded-Proto $scheme;    }     # Client side routes fall back to the SPA    location / {        try_files $uri $uri/ /index.html;    }}

sudo certbot --nginx -d example.com -d www.example.com --redirect

#!/usr/bin/env bashset -euo pipefailsudo snap install --classic certbotsudo ln -sf /snap/bin/certbot /usr/bin/certbot # Get and install certificates, and add the HTTP -> HTTPS redirectsudo certbot --nginx \  -d example.com -d www.example.com -d api.example.com \  --redirect --agree-tos -m ops@example.com --no-eff-email # Renewal is automatic; prove it workssudo certbot renew --dry-runsystemctl list-timers | grep certbot # Check the result from outsidecurl -sI http://example.com | head -3        # 301 to https

gzip on; gzip_types application/json text/css application/javascript;

# In the http blockgzip on;gzip_comp_level 5;gzip_min_length 1024;gzip_proxied any;gzip_vary on;gzip_types text/plain text/css application/json application/javascript text/xml image/svg+xml; open_file_cache max=10000 inactive=60s; # Micro cache for a hot, public API responseproxy_cache_path /var/cache/nginx/api levels=1:2 keys_zone=api_cache:10m max_size=1g inactive=10m; server {    location /api/catalog {        proxy_pass http://node_api;        proxy_cache api_cache;        proxy_cache_valid 200 30s;                 # 30 seconds is plenty to absorb a spike        proxy_cache_use_stale error timeout updating;        add_header X-Cache $upstream_cache_status;    }}

proxy_set_header Upgrade $http_upgrade;proxy_set_header Connection "upgrade";

map $http_upgrade $connection_upgrade {    default upgrade;    ''      close;} server {    listen 443 ssl http2;    server_name api.example.com;     location /socket.io/ {        proxy_pass http://node_api;        proxy_http_version 1.1;        proxy_set_header Upgrade $http_upgrade;        proxy_set_header Connection $connection_upgrade;        proxy_set_header Host $host;        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;        proxy_read_timeout 1h;          # idle sockets stay open        proxy_send_timeout 1h;    }}

upstream api { least_conn; server 10.0.0.2:3000; server 10.0.0.3:3000; }

upstream api_pool {    least_conn;    server 192.168.130.10:3000 max_fails=3 fail_timeout=15s;   # Linode private IPs    server 192.168.130.11:3000 max_fails=3 fail_timeout=15s;    server 192.168.130.12:3000 weight=2;                        # bigger box    server 192.168.130.20:3000 backup;                          # only if all fail    keepalive 64;} server {    listen 443 ssl http2;    server_name api.example.com;    location / {        proxy_pass http://api_pool;        proxy_http_version 1.1;        proxy_set_header Connection "";        proxy_next_upstream error timeout http_502 http_503;        proxy_next_upstream_tries 2;    }}

limit_req_zone $binary_remote_addr zone=api:10m rate=20r/s;location /api/ { limit_req zone=api burst=40 nodelay; }

# http blocklimit_req_zone  $binary_remote_addr zone=api:10m   rate=20r/s;limit_req_zone  $binary_remote_addr zone=login:10m rate=5r/m;limit_conn_zone $binary_remote_addr zone=perip:10m;limit_req_status 429;limit_conn_status 429; server {    client_max_body_size 10m;    limit_conn perip 50;     location /api/auth/login {        limit_req zone=login burst=5;           # brute force protection        proxy_pass http://node_api;    }     location /api/ {        limit_req zone=api burst=40 nodelay;    # allow short bursts        proxy_pass http://node_api;    }}

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;add_header X-Content-Type-Options nosniff always;

# /etc/nginx/snippets/security-headers.conf, included in every server blockadd_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;add_header X-Content-Type-Options "nosniff" always;add_header Referrer-Policy "strict-origin-when-cross-origin" always;add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;add_header Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; connect-src 'self' https://api.example.com; frame-ancestors 'none'" always; # Never serve dotfiles such as .env or .gitlocation ~ /\.(?!well-known) {    deny all;    return 404;} # Check: curl -sI https://example.com | grep -i -E "strict|content-security|x-content"

sudo nginx -t && sudo systemctl reload nginx

#!/usr/bin/env bash# Safe Nginx config deployset -euo pipefailsudo cp nginx/app.conf /etc/nginx/sites-available/app.conf.newsudo mv /etc/nginx/sites-available/app.conf.new /etc/nginx/sites-available/app.conf if sudo nginx -t; then    sudo systemctl reload nginx                 # graceful: no dropped connections    echo "nginx reloaded"else    echo "config test failed, running config untouched" >&2    exit 1fi # What happens on reload:#   master reads new config -> starts new workers#   old workers stop accepting, finish in flight requests, exit

log_format json escape=json '{"time":"$time_iso8601","status":$status,"rt":$request_time}';access_log /var/log/nginx/access.json json;

# http blocklog_format json escape=json  '{"time":"$time_iso8601","request_id":"$request_id","ip":"$remote_addr",'  '"method":"$request_method","uri":"$request_uri","status":$status,'  '"bytes":$body_bytes_sent,"rt":$request_time,"urt":"$upstream_response_time",'  '"upstream":"$upstream_addr","ua":"$http_user_agent"}'; access_log /var/log/nginx/access.json json;error_log  /var/log/nginx/error.log warn; # Quick answers from the shell# Slowest requests:   jq -r 'select(.rt > 1) | "\(.rt) \(.uri)"' /var/log/nginx/access.json | sort -rn | head# 5xx in last file:   jq -r 'select(.status >= 500) | .uri' /var/log/nginx/access.json | sort | uniq -c | sort -rn# Proxy failures:     grep -E "upstream|refused|timed out" /var/log/nginx/error.log | tail

pm2 start dist/main.js --name api && pm2 status && pm2 logs api

pm2 start dist/main.js --name api        # start and name itpm2 status                               # table: status, cpu, memory, restarts, uptimepm2 logs api --lines 100                 # tail stdout and stderrpm2 describe api                         # script, cwd, node version, env, log pathspm2 restart api                          # hard restart (brief downtime)pm2 reload api                           # zero downtime reload (cluster mode)pm2 stop api                             # stop but keep in the listpm2 delete api                           # remove from the listpm2 monit                                # live terminal dashboardpm2 save                                 # remember the current list for reboots

module.exports = { apps: [{ name: "api", script: "dist/main.js", instances: "max", exec_mode: "cluster" }] };

// /srv/api/ecosystem.config.jsmodule.exports = {  apps: [    {      name: "api",      cwd: "/srv/api/current",               // follows the release symlink      script: "dist/main.js",      instances: "max",                      // one worker per CPU core      exec_mode: "cluster",      node_args: "--enable-source-maps",      max_memory_restart: "600M",            // recycle a leaking worker      wait_ready: true,                      // wait for process.send("ready")      listen_timeout: 10000,      kill_timeout: 8000,                    // time to finish in flight requests      out_file: "/srv/api/shared/logs/api.out.log",      error_file: "/srv/api/shared/logs/api.err.log",      merge_logs: true,      time: true,                            // timestamp every log line      env_production: {        NODE_ENV: "production",        PORT: 3000,        DOTENV_CONFIG_PATH: "/srv/api/shared/.env",      },    },    {      name: "worker",      cwd: "/srv/api/current",      script: "dist/worker.js",      instances: 1,      env_production: { NODE_ENV: "production" },    },  ],};// pm2 start ecosystem.config.js --env production

pm2 start dist/main.js -i max --name api && pm2 scale api 3

pm2 start dist/main.js -i max --name api   # one worker per corepm2 scale api 3                             # set exactly 3 workerspm2 scale api +1                            # add one more # Prove the load spreadsfor i in $(seq 1 8); do curl -s localhost:3000/whoami; echo; done# {"pid":4211} {"pid":4218} {"pid":4225} ... different workers # In the app, run scheduled jobs on one worker only# if (process.env.NODE_APP_INSTANCE === "0") startCronJobs();

server.listen(3000, () => process.send?.("ready"));process.on("SIGINT", () => server.close(() => db.end().then(() => process.exit(0))));

const http = require("node:http");const app = require("./app");const db = require("./db"); const server = http.createServer(app);server.keepAliveTimeout = 65_000;            // longer than Nginx keepalive_timeout async function start() {  await db.connect();  server.listen(process.env.PORT || 3000, "127.0.0.1", () => {    process.send?.("ready");                 // tells PM2 this worker can take traffic  });} let shuttingDown = false;async function shutdown(signal) {  if (shuttingDown) return;  shuttingDown = true;  console.log(`${signal}: draining`);  server.close(async () => {                 // stop accepting, finish in flight    await db.end();                          // close the pool cleanly    process.exit(0);  });  setTimeout(() => process.exit(1), 7_000).unref();   // just under kill_timeout} process.on("SIGINT", shutdown);              // PM2 sends SIGINT on reload and stopprocess.on("SIGTERM", shutdown);start();

pm2 install pm2-logrotate && pm2 set pm2-logrotate:max_size 50M && pm2 set pm2-logrotate:retain 14

pm2 install pm2-logrotatepm2 set pm2-logrotate:max_size 50M          # rotate when a file reaches 50 MBpm2 set pm2-logrotate:retain 14             # keep 14 rotated filespm2 set pm2-logrotate:compress true         # gzip old filespm2 set pm2-logrotate:rotateInterval '0 0 * * *'   # and daily at midnight pm2 logs api --lines 200 --raw | grep '"level":50'   # errors only (pino level 50)pm2 flush api                                         # empty the current files df -h /srv                                            # keep an eye on disk space

pm2 startup systemd -u deploy --hp /home/deploy && pm2 save

# As the deploy userpm2 startup systemd# PM2 prints a command like this; run it once:sudo env PATH=$PATH:/usr/bin pm2 startup systemd -u deploy --hp /home/deploy pm2 start /srv/api/ecosystem.config.js --env productionpm2 save                                    # snapshot the list to ~/.pm2/dump.pm2 # Verify with a real reboot in a quiet windowsudo reboot# ...after it comes backpm2 statussystemctl status pm2-deploy

const h = monitorEventLoopDelay(); h.enable();app.get("/metrics", (_, res) => res.json({ rss: process.memoryUsage().rss, lagMs: h.mean / 1e6 }));

const { monitorEventLoopDelay } = require("node:perf_hooks");const loop = monitorEventLoopDelay({ resolution: 20 });loop.enable(); app.get("/internal/metrics", (req, res) => {  const mem = process.memoryUsage();  res.json({    pid: process.pid,    worker: process.env.NODE_APP_INSTANCE,    uptimeS: Math.round(process.uptime()),    rssMb: Math.round(mem.rss / 1e6),    heapUsedMb: Math.round(mem.heapUsed / 1e6),    loopLagP99Ms: +(loop.percentile(99) / 1e6).toFixed(1),   // above ~100 ms: something blocks  });  loop.reset();});

ln -sfn "$NEW" current.tmp && mv -Tf current.tmp current && pm2 reload apicurl -fsS localhost:3000/health || rollback

#!/usr/bin/env bash# Runs on the server: ./release.sh <artifact.tgz>set -euo pipefailBASE=/srv/apiNEW="$BASE/releases/$(date +%Y%m%dT%H%M%S)"PREV=$(readlink -f "$BASE/current" || true) mkdir -p "$NEW" && tar -xzf "$1" -C "$NEW"ln -s "$BASE/shared/.env" "$NEW/.env"ln -s "$BASE/shared/uploads" "$NEW/uploads"(cd "$NEW" && npm ci --omit=dev --no-audit --no-fund) switch_to() { ln -sfn "$1" "$BASE/current.tmp" && mv -Tf "$BASE/current.tmp" "$BASE/current"; } switch_to "$NEW"pm2 reload "$BASE/ecosystem.config.js" --env production --update-env for i in $(seq 1 10); do  if curl -fsS http://127.0.0.1:3000/health >/dev/null; then    echo "release ok: $NEW"    ls -1dt "$BASE"/releases/* | tail -n +6 | xargs -r rm -rf   # keep five    exit 0  fi  sleep 2done echo "health check failed, rolling back to $PREV" >&2switch_to "$PREV"pm2 reload "$BASE/ecosystem.config.js" --env production --update-envexit 1

echo "server 127.0.0.1:$GREEN_PORT;" > /etc/nginx/conf.d/api_active.inc && nginx -t && systemctl reload nginx

#!/usr/bin/env bash# blue = 3001, green = 3002; the active one is in /etc/nginx/conf.d/api_active.incset -euo pipefailACTIVE=$(grep -oE '[0-9]{4}' /etc/nginx/conf.d/api_active.inc)if [ "$ACTIVE" = "3001" ]; then IDLE=3002; COLOR=green; else IDLE=3001; COLOR=blue; fi pm2 reload "api-$COLOR" --update-env           # deploy to the idle colourfor i in $(seq 1 15); do curl -fsS "http://127.0.0.1:$IDLE/health" && break; sleep 2; donecurl -fsS "http://127.0.0.1:$IDLE/health" >/dev/null || { echo "idle colour unhealthy"; exit 1; } echo "server 127.0.0.1:$IDLE;" | sudo tee /etc/nginx/conf.d/api_active.incsudo nginx -t && sudo systemctl reload nginxecho "live on $COLOR ($IDLE); previous colour stays up for rollback" # nginx: upstream api { include /etc/nginx/conf.d/api_active.inc; keepalive 32; }

SET lock_timeout = '3s';ALTER TABLE users ADD COLUMN display_name text;          -- expandCREATE INDEX CONCURRENTLY users_display_name_idx ON users (display_name);

-- Release 1: expand (safe with old and new code)SET lock_timeout = '3s';                 -- fail fast instead of blocking writesSET statement_timeout = '15min';ALTER TABLE users ADD COLUMN display_name text;       -- nullable, instantCREATE INDEX CONCURRENTLY IF NOT EXISTS users_display_name_idx ON users (display_name); -- Backfill in batches from a script, not one giant UPDATEUPDATE users SET display_name = first_name || ' ' || last_nameWHERE id IN (SELECT id FROM users WHERE display_name IS NULL LIMIT 5000); -- Release 2: code reads and writes display_name only -- Release 3: contract (after release 2 is stable everywhere)ALTER TABLE users ALTER COLUMN display_name SET NOT NULL;ALTER TABLE users DROP COLUMN first_name, DROP COLUMN last_name;

- run: npm ci && npm test && npm run build- run: scp api.tgz deploy@$HOST:/tmp/ && ssh deploy@$HOST "/srv/api/release.sh /tmp/api.tgz"

name: deployon:  push:    branches: [main]concurrency: production            # never two deploys at once jobs:  build:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v4      - uses: actions/setup-node@v4        with: { node-version-file: .nvmrc, cache: npm }      - run: npm ci      - run: npm run lint && npm test      - run: npm run build      - run: tar -czf api.tgz dist package.json package-lock.json ecosystem.config.js      - uses: actions/upload-artifact@v4        with: { name: api, path: api.tgz }   deploy:    needs: build    runs-on: ubuntu-latest    environment: production         # optional manual approval    steps:      - uses: actions/download-artifact@v4        with: { name: api }      - name: Ship and release        env:          SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}          HOST: ${{ vars.PROD_HOST }}        run: |          install -m 600 /dev/null key && echo "$SSH_KEY" > key          scp -i key -o StrictHostKeyChecking=accept-new api.tgz deploy@$HOST:/tmp/api.tgz          ssh -i key deploy@$HOST "/srv/api/release.sh /tmp/api.tgz"      - run: curl -fsS https://api.example.com/health

ln -sfn "$(ls -1dt /srv/api/releases/* | sed -n 2p)" /srv/api/current && pm2 reload api

#!/usr/bin/env bash# One command back to the previous releaseset -euo pipefailBASE=/srv/apiPREV=$(ls -1dt "$BASE"/releases/* | sed -n 2p)     # second newestecho "rolling back to $PREV"ln -sfn "$PREV" "$BASE/current.tmp" && mv -Tf "$BASE/current.tmp" "$BASE/current"pm2 reload "$BASE/ecosystem.config.js" --env production --update-envcurl -fsS http://127.0.0.1:3000/health && echo "rolled back" # Lambda: point the live alias at the previous version# aws lambda update-alias --function-name orders-api --name live --function-version 41 # Frontend on S3: re-sync the previous build and invalidate# aws s3 sync builds/2026-10-05/ s3://acme-web/ --delete# aws cloudfront create-invalidation --distribution-id E123 --paths "/index.html"

app.get("/health", (_, res) => res.send("ok"));app.get("/ready", async (_, res) => (await db.ping(1000)) ? res.send("ready") : res.status(503).end());

let ready = false;let draining = false; app.get("/health", (req, res) => res.type("text").send("ok"));    // liveness: no dependencies app.get("/ready", async (req, res) => {  if (!ready || draining) return res.status(503).json({ ready: false });  try {    await Promise.race([      db.query("select 1"),      new Promise((_, reject) => setTimeout(() => reject(new Error("db timeout")), 1000)),    ]);    res.json({ ready: true, version: process.env.GIT_SHA });  } catch (err) {    res.status(503).json({ ready: false, reason: err.message });  }}); // set ready = true after startup, draining = true in the SIGINT handler

npm ci && npm run build && ls dist/assets

npm cinpm run build                     # vite build -> dist/ # dist/#   index.html                    short cache, references hashed files#   assets/index-3f9c1a2b.js      long cache, name changes when content changes#   assets/index-8d02e4f1.css#   favicon.svg du -sh dist && find dist -name "*.js" -size +300k   # flag large bundles # Ship to your serverrsync -az --delete dist/ deploy@203.0.113.10:/srv/web/releases/$(date +%Y%m%dT%H%M%S)/

aws s3 sync dist/ s3://acme-web --delete && aws cloudfront create-invalidation --distribution-id E123 --paths "/index.html"

#!/usr/bin/env bashset -euo pipefailBUCKET=s3://acme-webDIST_ID=E1ABCDEF2GHIJK # 1. Hashed assets: cache for a yearaws s3 sync dist/ "$BUCKET" --delete \  --exclude index.html \  --cache-control "public, max-age=31536000, immutable" # 2. The HTML shell: always revalidateaws s3 cp dist/index.html "$BUCKET/index.html" \  --cache-control "no-cache" --content-type "text/html" # 3. Only the shell needs invalidating, assets have new namesaws cloudfront create-invalidation --distribution-id "$DIST_ID" --paths "/index.html" # Keep a copy for rollbackaws s3 sync dist/ "s3://acme-web-builds/$(git rev-parse --short HEAD)/"