Production Deployment

The production checklist, hosting options, and what the Express layer already protects.

ngXpress is a single Node SSR app — there's no separate build for a frontend host and an API host. Build once, run pnpm start behind TLS.

Vercel, Netlify, and Docker adapters aren't first-class yet. A VPS, VM, or any Node 20+ host works — DigitalOcean, Linode, Hetzner, AWS EC2, GCP Compute, Azure VMs, and similar. Use a process manager such as PM2 in production.

Production checklist

  1. Copy .env.example → .env and set a strong BETTER_AUTH_SECRET.
  2. Set BETTER_AUTH_URL to your public HTTPS origin.
  3. Set BETTER_AUTH_TRUSTED_ORIGINS to those exact origins — no trailing-slash mismatches.
  4. Set NODE_ENV=production.
  5. Terminate TLS at a reverse proxy; run Node on an internal port (PORT, default 4000).
  6. Replace the dev email logger (src/api/lib/email.ts) before sending real password-reset mail — in production it throws until a provider is wired up.
Terminal
pnpm build
pnpm start

pnpm build only generates the Prisma client and compiles the app. pnpm start runs prisma migrate deploy before the Node server starts, so an empty production database gets the auth and task tables. If your host has a separate release command, point that at pnpm db:deploy — you can still use pnpm start as the run command, since a second migrate deploy is a no-op once everything is applied.

.env
DATABASE_URL="postgresql://USER:PASS@HOST:5432/ngxpress"
BETTER_AUTH_SECRET="your_secret_key"
BETTER_AUTH_URL="https://yourdomain.com"
BETTER_AUTH_TRUSTED_ORIGINS="https://yourdomain.com"
NODE_ENV="production"
PORT=4000

What the Express layer already does

  • Stricter rate limits on /api/auth
  • General rate limits on /api
  • A 100kb JSON body size limit on non-auth API routes

Rate limiting is in-memory

Rate limiting lives in a single Node process — it doesn't share state across instances. Don't enable a naive trust proxy setting unless you understand spoofed X-Forwarded-For headers; doing so can let clients bypass rate limits entirely.

Hosting

Any host that can run Angular SSR plus Node works: DigitalOcean, Linode, Hetzner, AWS EC2, GCP Compute, Azure VMs, and similar. Run the process under PM2 (or an equivalent supervisor) so it restarts on crash and on deploy.

Related

PreviousScripts Reference