Deployment

A. Environment Variables for a Release#

1. 1

   Set NODE_ENV=production — this single value changes everything

   dev-only OTP exposure (console print + API response) switches off; cookies gain secure + SameSite=strict; morgan switches to combined logging; helmet HSTS stays fully active.

2. 2

   Generate brand-new secrets — never ship development values

   Run this (brew/Node) for each of JWT_SECRET, JWT_REFRESH_SECRET, COOKIE_SECRET:

   node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
   # → 64 hex chars; one output per secret store, never reuse

   Secrecy rules: 32+ characters, unique per environment, and rotated on any leak suspicion.

3. 3

   Point the endpoints at production domains

   NODE_ENV=production
   PORT=5000
   API_PREFIX=/api/v1
   MONGO_URI=your_atlas_connection_string
   JWT_SECRET=your_new_random_32_char_secret
   JWT_EXPIRES_IN=7d
   JWT_REFRESH_SECRET=your_other_new_random_32_char_secret
   JWT_REFRESH_EXPIRES_IN=30d
   COOKIE_SECRET=your_cookie_secret
   RESEND_API_KEY=re_your_api_key
   RESEND_FROM="Your Brand <noreply@yourdomain.com>"
   RESEND_REPLY_TO=support@yourdomain.com
   FRONTEND_URL=https://yourapp.com
   GOOGLE_CLIENT_ID=your_google_client_id
   GOOGLE_CLIENT_SECRET=your_google_client_secret
   GOOGLE_CALLBACK_URL=https://api.yourapp.com/api/v1/auth/google/callback

   FRONTEND_URL=https://yourapp.com — one origin only (it's the CORS allow-list). Sub-domains count as separate origins.

4. 4

   Frontend env (deploy host's dashboard)

   On Vercel/Render/hosting, set:

   NEXT_PUBLIC_API_URL=https://api.yourapp.com/api/v1

B. Deploy the Backend#

1. 1

   Pick any Node host (Railway, Render, Fly.io, a VPS)

   Start command: pnpm start (runs node server.js). Node ≥ 18; a persistent disk for the uploads folder if you later add uploads.

2. 2

   Set every backend variable in the host dashboard

   Enter the production values from section A. Do NOT copy real .env values from your laptop into tickets/screenshots.

3. 3

   HTTPS at the edge

   Cookies require secure=true only if the domain is HTTPS — terminate HTTPS at your load balancer (Railway/Render provide certificates automatically). Keep the trust-proxy count matching your setup.

4. 4

   Verification checks

   GET /api/v1/health must return 200 from the deployed domain; register a user through the deployed FRONTEND_URL and see the user appear in the database; Google login must send an OTP email, land on https://yourapp.com/auth/verify-otp, and reach the dashboard only after the code is accepted.

C. Deploy the Frontend#

1. 1

   Import the frontend folder as its own project

   Build command and start from the package.json scripts: build (Next.js production build, TypeScript + Turbopack) and start. The hosting framework auto-detects Next.js.

2. 2

   Set NEXT_PUBLIC_API_URL (build-time!)

   The value is inlined at build time — changing it later requires a re-deploy (not just a restart).

3. 3

   Close the cross-origin loop

   backend FRONTEND_URL must equal the deployed frontend origin character-for-character, or CORS and the JWT cookies will fail.

D. Database & Email in Production#

• Use Atlas with a lone IP allow-list entry: your backend host's outbound IP.
• A dedicated database user with least privileges; rotate if anyone with access leaves.
• Email is sent through Resend's HTTP API, so no SMTP ports are needed. Verify the sender domain in Resend, set RESEND_API_KEY/RESEND_FROM on the host, then run pnpm test:email from the deployed backend to confirm delivery.
• Cron/host-level backups: Atlas handles snapshots; verify retention for your tier.

E. Security Checklist#

F. Safe Credential Rotation#

1. Generate a new value (random 32+ chars).
2. Update it wherever it lives (host env vars, .env, secret manager) — no code change needed.
3. JWT secrets: rotating access secret invalidates live sessions → users re-login; rotate refresh secret too in the same window.
4. Database password: change in Atlas → update MONGO_URI → restart (no migrations required).
5. Google client secret: rotate inside Google Cloud Console (Goto Credential details → regenerate) then update .env + restart.
6. Email credentials: rotate in the provider dashboard, update .env, re-run test-email.js.

Rotation works the same for every secret: generate → replace → restart → verify. Nothing here requires code changes because every secret is read from the environment.