Migrate from Vercel to
DigitalOcean

# Pull all your Vercel env vars in one command:
npm i -g vercel
vercel login
vercel link
vercel env pull .env.local

# Your .env.local now has every var Vercel was injecting.
# Keep this file — you'll need it for the next steps.

I'm migrating my Next.js app from Vercel to DigitalOcean. I just ran "vercel env pull .env.local" and got all my environment variables. Help me: 1) Audit the .env.local file and identify which vars are NEXT_PUBLIC_ (baked at build time) vs server-only, 2) Create a .env.production file for the server with only the server-side vars, 3) Tell me which vars I'll need to pass to GitHub Actions as secrets for the build step.

# Add to .env.local (for reference)
DO_API_TOKEN=dop_v1_xxxx        # DigitalOcean API token
DO_DROPLET_IP=64.225.12.5       # your droplet IP

# SSH into server:
ssh root@64.225.12.5

I have a fresh Ubuntu 22.04 DigitalOcean droplet at [YOUR_IP]. Set up the server for a Next.js app: 1) Update all packages, 2) Configure UFW firewall — allow only 22, 80, 443, 3) Install Node.js 20 via NodeSource, 4) Install PM2 globally, 5) Install Nginx. Give me all commands in one block I can paste into the terminal.

# Create .env.local on server without exposing in bash history:
cat > /var/www/myapp/.env.local << 'EOF'
DATABASE_URL=postgresql://...
JWT_SECRET=...
RESEND_API_KEY=...
# paste all your vars here
EOF
chmod 600 /var/www/myapp/.env.local

# Build and start
cd /var/www/myapp
npm ci && npm run build
pm2 start npm --name "myapp" -- start
pm2 save && pm2 startup

I have a Next.js app at /var/www/myapp on Ubuntu 22.04. My .env.local has these variables: [PASTE YOUR VARS HERE - remove secret values].

Help me:
1) Create the .env.local on the server safely (without echoing secrets in bash history)
2) Run npm ci and npm run build
3) Start with PM2 and verify it's running
4) Configure PM2 to restart on server reboot
5) Check the app logs: pm2 logs myapp

The app should be accessible at http://localhost:3000 before I set up Nginx.

/etc/nginx/sites-available/myapp

server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;

    # Cache Next.js static assets (content-hashed, safe to cache forever)
    location /_next/static/ {
        proxy_pass http://localhost:3000;
        add_header Cache-Control "public, max-age=31536000, immutable";
    }

    location / {
        proxy_pass http://localhost:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
    }
}

Create a production-ready Nginx config for my Next.js app. Requirements: domain is yourdomain.com and www.yourdomain.com, Next.js runs on port 3000, proxy all requests with proper headers (X-Real-IP, X-Forwarded-For, X-Forwarded-Proto), cache _next/static files for 1 year (they have content hashes), handle WebSocket upgrades. Also show me how to test the config before reloading.

# Check DNS has propagated first:
dig yourdomain.com A +short
# Should return: YOUR_IP

# Get SSL certificate:
certbot --nginx -d yourdomain.com -d www.yourdomain.com

# Test auto-renewal:
certbot renew --dry-run

# Certbot automatically edits your Nginx config to add HTTPS
# and sets up HTTP → HTTPS redirect

I updated my domain DNS A record to point to [YOUR_IP] and DNS has propagated. Walk me through: 1) Running Certbot to get SSL for yourdomain.com and www.yourdomain.com, 2) Verifying the cert was issued correctly, 3) Setting up a HTTP → HTTPS redirect, 4) Testing auto-renewal works. My server is Ubuntu 22.04 with Nginx already installed.

# .github/workflows/deploy.yml
name: Deploy
on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
      - run: npm ci
      - run: npm run build
        env:
          NEXT_PUBLIC_APP_URL: ${{ secrets.NEXT_PUBLIC_APP_URL }}
          # add all your NEXT_PUBLIC_ vars here
      - uses: appleboy/ssh-action@v1.0.3
        with:
          host: ${{ secrets.DO_HOST }}
          username: ${{ secrets.DO_USER }}
          key: ${{ secrets.DO_SSH_KEY }}
          script: |
            cd /var/www/myapp
            git pull origin main
            npm ci --omit=dev
            npm run build
            pm2 restart myapp
      - name: Health check
        run: sleep 10 && curl -f https://yourdomain.com/ || exit 1

Create a GitHub Actions deploy workflow for my Next.js app on DigitalOcean. Requirements:
- Trigger on push to main branch
- Build Next.js on the CI runner (NOT on the 1GB RAM server)
- Pass these env vars to the build step from GitHub Secrets: [LIST YOUR NEXT_PUBLIC_ VARS]
- After build succeeds: SSH into server, git pull, npm ci --omit=dev, pm2 restart myapp
- Add health check: curl -f https://yourdomain.com/ || exit 1
- Use secrets: DO_HOST, DO_USER, DO_SSH_KEY

Show me the complete .github/workflows/deploy.yml

# NEXT_PUBLIC_ vars → GitHub Secrets (used at build time in Actions)
# Add to repo → Settings → Secrets → Actions:
NEXT_PUBLIC_APP_URL=https://yourdomain.com

# Server-only vars → .env.local on server (runtime, not in git)
# SSH in and edit:
nano /var/www/myapp/.env.local
# Then: pm2 restart myapp

# .gitignore — make sure this is there:
.env
.env.local
.env.production
.env*.local

I have a Next.js app with these environment variables (example structure, not real values):
- NEXT_PUBLIC_APP_URL=https://... (needed at build time)
- NEXT_PUBLIC_POSTHOG_KEY=phc_... (needed at build time)
- DATABASE_URL=postgresql://... (server only)
- JWT_SECRET=... (server only)
- RESEND_API_KEY=re_... (server only)

Help me: 1) Which vars go in GitHub Secrets vs server .env.local, 2) How to update the GitHub Actions workflow to pass NEXT_PUBLIC_ vars to the build step, 3) How to safely update server-only vars without redeploying the whole app.