infra-deploy

When This Skill Activates

• "Deploy this", "push to production", "setup server"
• "Docker", "containerize", "docker-compose"
• "VPS setup", "server configuration"
• "Coolify", "nginx", "reverse proxy"
• "SSL", "HTTPS", "Let's Encrypt"

Pre-Deployment Checklist

Before ANY Deployment:

# 1. Verify build works locally
npm run build  # or equivalent

# 2. Run tests
npm test

# 3. Check for env vars
cat .env.example  # Document required vars

# 4. Verify no secrets in code
grep -r "sk_live\|api_key\|password" --include="*.ts" --include="*.js" || echo "Clean"

Docker Deployment

Production Dockerfile (Node.js)

# Build stage
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
RUN npm run build

# Production stage
FROM node:20-alpine AS runner
WORKDIR /app
ENV NODE_ENV=production

# Non-root user for security
RUN addgroup --system --gid 1001 nodejs
RUN adduser --system --uid 1001 appuser

COPY --from=builder --chown=appuser:nodejs /app/dist ./dist
COPY --from=builder --chown=appuser:nodejs /app/node_modules ./node_modules
COPY --from=builder --chown=appuser:nodejs /app/package.json ./

USER appuser
EXPOSE 3000
CMD ["node", "dist/index.js"]

Docker Compose (Production)

version: '3.8'

services:
  app:
    build: .
    restart: unless-stopped
    environment:
      - NODE_ENV=production
      - DATABASE_URL=${DATABASE_URL}
    ports:
      - "3000:3000"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: '0.5'

  db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${DB_NAME}
      POSTGRES_USER: ${DB_USER}
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER}"]
      interval: 10s
      timeout: 5s
      retries: 5

volumes:
  postgres_data:

VPS Initial Setup

1. Security Hardening (Run First)

# Update system
apt update && apt upgrade -y

# Create deploy user
adduser deploy
usermod -aG sudo deploy

# Setup SSH keys (on local machine)
ssh-copy-id deploy@YOUR_SERVER_IP

# Disable password auth
sudo sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

# Setup firewall
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

# Install fail2ban
sudo apt install fail2ban -y
sudo systemctl enable fail2ban

2. Docker Installation

curl -fsSL https://get.docker.com | sh
sudo usermod -aG docker deploy
newgrp docker

3. Coolify (Self-Hosted PaaS)

curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash

Nginx Reverse Proxy

With SSL (Let's Encrypt)

server {
    listen 80;
    server_name yourdomain.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;

    location / {
        proxy_pass http://localhost:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
    }
}

Get SSL Certificate

sudo apt install certbot python3-certbot-nginx -y
sudo certbot --nginx -d yourdomain.com

Deployment Commands

Build and Deploy

# Build image
docker build -t myapp:latest .

# Stop old container
docker stop myapp || true
docker rm myapp || true

# Run new container
docker run -d \
  --name myapp \
  --restart unless-stopped \
  -p 3000:3000 \
  --env-file .env.production \
  myapp:latest

# Verify running
docker ps
docker logs myapp --tail 50

Zero-Downtime Deployment

# Start new container on different port
docker run -d --name myapp-new -p 3001:3000 myapp:latest

# Wait for health check
sleep 10
curl -f http://localhost:3001/health

# Switch nginx upstream
# Then remove old container
docker stop myapp-old && docker rm myapp-old

Monitoring

Basic Health Check Endpoint

app.get('/health', (req, res) => {
  res.json({
    status: 'healthy',
    timestamp: new Date().toISOString(),
    uptime: process.uptime()
  });
});

Log Commands

# Follow logs
docker logs -f myapp

# Last 100 lines
docker logs myapp --tail 100

# With timestamps
docker logs myapp -t --since 1h

Rollback Procedure

# List available images
docker images myapp

# Rollback to previous
docker stop myapp
docker run -d --name myapp -p 3000:3000 myapp:previous-tag

Security Checklist

• [ ] SSH key auth only (no passwords)
• [ ] Firewall enabled (ufw)
• [ ] Fail2ban running
• [ ] Non-root user for app
• [ ] Secrets in env vars, not code
• [ ] HTTPS with valid cert
• [ ] Security headers configured
• [ ] Regular security updates scheduled