Topic

Deploy Next.js

Definition

A Next.js deployment builds the application into a production artifact with environment-specific configuration and runtime constraints.

In simpler words

Production is a separate environment: it needs the right build, public values, cookies, and API connection—not just a working local server.

The deployed web app must communicate safely with the separately deployed Nest API without exposing secrets.

Open official example (opens in new tab)

After this you can

Prepare production configuration
Distinguish public and server-only environment variables
Verify cookie and API-origin behavior

Build for the target environment

Run the production build before release to catch route, type, and bundling failures that development mode may not surface. The host must support the Next runtime capabilities that the application uses.

Variables prefixed NEXT_PUBLIC are embedded for browser use at build time. Never place database credentials, JWT signing values, or internal service secrets behind that prefix.

Public versus server-only configuration

// Safe for browser exposure
NEXT_PUBLIC_API_ORIGIN=https://api.example.com

// Server-only — never NEXT_PUBLIC
JWT_SECRET=...
DATABASE_URL=...

The naming convention signals whether a value becomes visible in the client bundle.

Mistake: trusting local cookies in production

// Wrong conclusion: “cookie auth worked on localhost, so deployment is ready”

// Right: verify HTTPS, SameSite, Secure, domain, credentials, and Nest CORS in staging.

Cookie behavior depends on the deployed origins and browser security context.

Release the web and API as a system

Definition

The Next deployment and Nest deployment have separate artifacts but one user journey.

In simpler words

Validate their origins, credential policy, and failure behavior together before calling the release complete.

Use deployment-specific environment configuration rather than committing environment files.

Check the deployed app with a real browser to confirm login, ticket reads, ticket writes, and logout.

Live playground

Deploying playground

Classify each environment variable as browser-safe or server-only.

Verify cookie + API origin settings in production.

next-deploying

Keep in mind

Run the production build before deploying.
Expose only deliberate NEXT_PUBLIC values.
Test cookie-JWT flows against the deployed web and Nest origins.

Test

Check your understanding

At least 10 questions — mix of concept, syntax, practical, and logic. Score ≥80% (enforced by the API) to save progress.

Checking your session…

15 questions · concept 5 · syntax 3 · practical 4 · logic 3

1. Common Next deploy target?

Concept

Any static file host, since next build outputs plain HTMLA plain CDN bucket serving the .next folder directlyPlatforms that understand Next (Vercel/Node servers/containers)A PHP-style shared host running the pages on request

2. Build command typically?

Syntax

next dev then next export for productionnext compile then next servenext build then next start (or platform build)next build then next dev to serve the build

3. Environment variables in prod?

Practical

Configure in the host/secrets manager — not committedCommit .env.production so the build picks them upInline them into next.config so they ship with the buildSet them as NEXT_PUBLIC_ so the server can read them in prod

4. Standalone output option?

Logic

Produces a fully static export with no Node serverBundles the app into a single client-side JavaScript fileHelps containerize a minimal server bundleRemoves node_modules so the image ships only source

5. Health checks?

Concept

Expose a simple health route for orchestratorsRely on the home page returning 200 as the health signalEnable Next’s built-in /_health endpointConfigure the health check inside next.config

6. Image optimization in containers?

Practical

Set unoptimized in production so containers skip image workImage optimization is disabled automatically inside DockerMay need sharp/dependencies — verify runtimeMount the host’s image cache into the container to enable it

7. CI pipeline tip?

Syntax

Run next dev in CI to confirm the app bootsDeploy first, then run typecheck against productionSkip the build in CI since the host rebuilds anywaylint/typecheck/build before deploy

8. Monorepo deploy?

Logic

Deploy apps/web and apps/api from a single next buildBuild apps/web with its env pointing at the Nest URLPoint apps/web at localhost since prod resolves itBundle the Nest server into the web image so they deploy together

9. Caching at CDN after deploy?

Concept

The CDN purges itself whenever you run next buildBump the app version so the CDN treats every asset as newPurge/revalidate as needed when content changesDisable the CDN in production to avoid stale content

10. Which deploy mistake is worst?

Practical

Shipping NEXT_PUBLIC_ secrets that are actually private keysForgetting to purge the CDN after a content updateRunning next build twice in the CI pipelineDeploying apps/web before apps/api is ready

11. What is the standard production sequence?

Conceptintermediate

next build && next start

Start the server, then build it in the backgroundBuild the app, then export it to static HTMLBuild the app, then start the production serverBuild twice — once for the server and once for the client

12. When is standalone output useful?

Syntaxadvanced

// next.config.js
output: 'standalone'

To produce a static export deployable to any file hostTo ship the app as a single browser bundle with no serverTo exclude the Next runtime so the image is smallerTo containerize a minimal self-contained server bundle

13. What is the deployment risk here?

Practicaladvanced

// .env committed with production secrets

.env files are ignored by next build, so the secrets do nothingSecrets should live in the host/secret manager, not committedCommitted secrets are safe as long as the repo is privateNext encrypts committed .env files during the build

14. What is wrong with this variable?

Logicintermediate

NEXT_PUBLIC_STRIPE_SECRET=sk_live_...

The value must be quoted or the build will reject itStripe keys must be prefixed with STRIPE_, not NEXT_PUBLIC_NEXT_PUBLIC_ vars ship to the browser — a secret key must not be publicNEXT_PUBLIC_ vars are server-only, so the key won’t be read

15. Why run these before deploying?

Conceptintermediate

# CI pipeline
pnpm lint && pnpm typecheck && pnpm build

To catch lint, type, and build failures before shippingTo warm the production cache before the first requestBecause the host won’t build unless CI does it firstTo generate the .env file the deploy needs

Checking your session…