The Ultimate Deployment Cheatsheet

# ── Multi-stage Dockerfile (Node.js) ──

# Stage 1: Build
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production && npm cache clean --force
COPY . .
RUN npm run build

# Stage 2: Runtime
FROM gcr.io/distroless/nodejs20-debian12
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/package.json ./

USER nonroot:nonroot
EXPOSE 3000
HEALTHCHECK --interval=30s --timeout=3s CMD curl -f http://localhost:3000/health
ENTRYPOINT ["node", "dist/server.js"]

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-app
  labels:
    app: web-app
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: web-app
  template:
    metadata:
      labels:
        app: web-app
    spec:
      containers:
        - name: web-app
          image: registry.example.com/web-app:v1.2.0
          ports:
            - containerPort: 3000
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 512Mi
          livenessProbe:
            httpGet:
              path: /health
              port: 3000
            initialDelaySeconds: 15
            periodSeconds: 20
          readinessProbe:
            httpGet:
              path: /ready
              port: 3000
            initialDelaySeconds: 5
            periodSeconds: 10
          env:
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: app-secrets
                  key: db-url
      terminationGracePeriodSeconds: 30

# ── Serverless Framework config ──
service: my-api
frameworkVersion: '3'

provider:
  name: aws
  runtime: nodejs20.x
  architecture: arm64
  stage: production
  region: us-east-1
  environment:
    NODE_ENV: production
  httpApi:
    cors: true

functions:
  api:
    handler: src/handler.handler
    events:
      - httpApi:
          path: /{proxy+}
          method: ANY
    provisionedConcurrency: 5   # Reduce cold starts

resources:
  Resources:
    ApiLogGroup:
      Type: AWS::Logs::LogGroup
      Properties:
        RetentionInDays: 30

# ── Procfile (Heroku / Render / Railway) ──
web: npm start
worker: node worker.js
release: npx prisma migrate deploy
clock: node scheduler.js

// ── Next.js Deployment Configuration ──
/** @type {import('next').NextConfig} */
const nextConfig = {
  output: 'standalone',           // For Docker / bare metal
  images: {
    remotePatterns: [{
      protocol: 'https',
      hostname: 'cdn.example.com',
    }],
  },
  experimental: {
    serverActions: true,
  },
};

// For Vercel: git push → auto-detect & deploy
// For Docker: use output: 'standalone' with node:alpine
// For Netlify: use @netlify/plugin-nextjs

#!/bin/bash
# ── Bare Metal Deploy Script ──
set -euo pipefail

APP_DIR="/opt/myapp"
BRANCH="main"

echo ">>> Pulling latest code..."
cd $APP_DIR && git pull origin $BRANCH

echo ">>> Installing dependencies..."
npm ci --production

echo ">>> Running database migrations..."
npx prisma migrate deploy

echo ">>> Building application..."
npm run build

echo ">>> Restarting service..."
sudo systemctl restart myapp
sudo systemctl status myapp --no-pager

echo ">>> Health check..."
sleep 3 && curl -sf http://localhost:3000/health || exit 1
echo "Deploy successful!"

name: CI/CD Pipeline
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 20, cache: 'npm' }
      - run: npm ci
      - run: npm run lint
      - run: npm run test
      - run: npm run test:e2e

  build-push:
    needs: test
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@v5
        with:
          push: true
          tags: ghcr.io/org/app:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  deploy:
    needs: build-push
    runs-on: ubuntu-latest
    environment: production
    steps:
      - run: echo "Deploy image ${{ github.sha }} to production"

# ── Terraform: EC2 + RDS + VPC ──
terraform {
  required_version = ">= 1.5"
  required_providers {
    aws = { source = "hashicorp/aws", version = "~> 5.0" }
  }
  backend "s3" {
    bucket = "my-terraform-state"
    key    = "prod/terraform.tfstate"
    region = "us-east-1"
  }
}

provider "aws" { region = "us-east-1" }

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 5.0"
  cidr    = "10.0.0.0/16"
  azs     = ["us-east-1a", "us-east-1b"]
  public_subnets  = ["10.0.1.0/24", "10.0.2.0/24"]
  private_subnets = ["10.0.3.0/24", "10.0.4.0/24"]
}

resource "aws_db_instance" "app" {
  engine               = "postgres"
  engine_version       = "16"
  instance_class       = "db.t3.micro"
  allocated_storage    = 20
  db_name              = "appdb"
  username             = "admin"
  password             = var.db_password
  skip_final_snapshot  = true
}

apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: web-app
spec:
  replicas: 10
  strategy:
    canary:
      steps:
        - setWeight: 5
        - pause: { duration: 5m }
        - setWeight: 25
        - pause: { duration: 10m }
        - setWeight: 50
        - pause: { duration: 10m }
        - setWeight: 100
      canaryService: web-app-canary
      stableService: web-app-stable
      analysis:
        templates:
          - templateName: success-rate
        startingStep: 2
        args:
          - name: service-name
            value: web-app-canary