Deployment

Environment Variables

Environment variables keep configuration separate from code. Never hard-code secrets.

# .env file (never commit this!)
PORT=3000
NODE_ENV=production
DATABASE_URL=mongodb://...
JWT_SECRET=your-secret-key
API_KEY=abc123

// Install: npm install dotenv
// Load in code
require('dotenv').config();

console.log(process.env.PORT);
console.log(process.env.NODE_ENV);

.env.example (commit this)

PORT=3000
NODE_ENV=development
DATABASE_URL=your-database-url
JWT_SECRET=your-secret
API_KEY=your-api-key

Development vs Production

CI/CD Pipeline

A typical CI/CD pipeline for Node.js applications includes linting, testing, building, and deploying.

# .github/workflows/deploy.yml
name: Node.js CI/CD

on:
  push:
    branches: [ main ]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'
      - run: npm ci
      - run: npm run lint
      - run: npm test
      - run: npm run build --if-present

  deploy:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to production
        run: |
          # Deploy to your hosting provider
          echo "Deploying..."

Security Best Practices

• Use HTTPS: Never serve production over HTTP.
• Validate Input: Sanitize all user input to prevent injection attacks.
• Rate Limiting: Use express-rate-limit to prevent abuse.
• Helmet: Use the helmet middleware for security headers.
• Dependencies: Regularly audit with npm audit.
• Secrets: Never commit secrets. Use environment variables or secret manager.
• CORS: Restrict CORS to specific origins.

// Security setup example
const helmet = require('helmet');
const rateLimit = require('express-rate-limit');

app.use(helmet());
app.use(rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100,
  message: 'Too many requests, please try again later.'
}));

Deployment Strategies

• Platform as a Service (PaaS): Heroku, Render, Railway, Fly.io — quickest setup
• Virtual Machines: AWS EC2, DigitalOcean, Linode — full control
• Containers: Docker + Kubernetes — scalable, portable
• Serverless: AWS Lambda, Vercel, Netlify — auto-scaling, pay-per-use

# Example Dockerfile
FROM node:20-alpine

WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .

EXPOSE 3000
CMD ["node", "src/index.js"]