Deployment

• Set DATABASE_URL, APP_URL, APP_ENV, and every enabled provider secret.
• Use a unique BETTER_AUTH_SECRET of at least 32 characters when accounts are enabled.
• Configure RESEND_API_KEY, EMAIL_FROM, and CONTACT_EMAIL for production mail.
• Review legal-page starters, retention requirements, CSP, and rate limiting for the product.
• Back up PostgreSQL before destructive migrations.

Run database migrations once as a release step, not from every horizontally scaled application process. Keep the migration and application rollout observable and reversible.

pnpm install --frozen-lockfile
pnpm build
pnpm db:migrate
pnpm start

The included multi-stage image runs as a non-root user and exposes live and ready health routes. Apply migrations before starting the release image.

docker build -t my-product .
docker run --rm -p 3000:3000 \
  -e DATABASE_URL=... \
  -e APP_URL=https://example.com \
  -e APP_ENV=production \
  my-product

Build from the repository root using the checked-in lockfile. Configure runtime environment values in the host, provision PostgreSQL separately, and use a dedicated release command or job for migrations.

The generated baseline includes same-origin contact submission, Zod validation, security headers, a non-root container, and account safeguards. Distributed rate limiting, full CSP tuning, provider validation, audit workflows, and retention policy remain product responsibilities.