// Public (exposed to browser) — NEXT_PUBLIC_ prefix:
NEXT_PUBLIC_API_URL=https://api.example.com

// Server-only (never sent to browser):
DATABASE_URL=postgres://...
STRIPE_SECRET_KEY=sk_live_...

// Static assets with content hash — cache forever
"Cache-Control": "public, max-age=31536000, immutable"

// HTML pages — serve from cache, revalidate in background
"Cache-Control": "public, s-maxage=60, stale-while-revalidate=3600"

// API responses — short cache
"Cache-Control": "public, s-maxage=10, stale-while-revalidate=30"

// Private/authenticated — never cache at CDN
"Cache-Control": "private, no-store"

# Root domain (example.com)
Vercel:     A record → 76.76.21.21, or CNAME flattening
Cloudflare: CNAME → project.pages.dev (proxied)
Netlify:    ALIAS/ANAME → site.netlify.app
Fly.io:     A record → allocated IP, AAAA for IPv6

# Subdomain (app.example.com) — always CNAME
Vercel:     CNAME → cname.vercel-dns.com
Cloudflare: managed automatically if DNS on Cloudflare
Netlify:    CNAME → site.netlify.app
Fly.io:     CNAME → app-name.fly.dev

my-monorepo/
  apps/
    web/          # Next.js → Vercel
    api/          # Express → Fly.io
    marketing/    # Static → Netlify
  packages/
    ui/           # Shared components
    db/           # Shared database schema

{
  "$schema": "https://openapi.vercel.sh/vercel.json",
  "framework": "nextjs",
  "buildCommand": "pnpm turbo build --filter=web",
  "installCommand": "pnpm install",
  "ignoreCommand": "npx turbo-ignore",
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        { "key": "X-Frame-Options", "value": "DENY" },
        { "key": "X-Content-Type-Options", "value": "nosniff" },
        { "key": "Referrer-Policy", "value": "strict-origin-when-cross-origin" }
      ]
    }
  ],
  "redirects": [
    { "source": "/blog/:slug", "destination": "/posts/:slug", "permanent": true }
  ],
  "rewrites": [
    { "source": "/api/v1/:path*", "destination": "https://api.example.com/:path*" }
  ],
  "crons": [
    { "path": "/api/cron/sync-data", "schedule": "0 */6 * * *" }
  ]
}

// app/api/heavy-task/route.ts
import { NextRequest, NextResponse } from "next/server";

export const maxDuration = 60; // seconds (Pro plan for >10s)
export const dynamic = "force-dynamic";

export async function POST(request: NextRequest): Promise<NextResponse> {
  const body = await request.json();
  const result = await processHeavyTask(body);

  return NextResponse.json({ data: result }, {
    headers: { "Cache-Control": "private, no-store" },
  });
}

// app/api/geo/route.ts
import { NextRequest, NextResponse } from "next/server";

export const runtime = "edge"; // V8 isolate, not Lambda

export async function GET(request: NextRequest): Promise<NextResponse> {
  return NextResponse.json({
    country: request.headers.get("x-vercel-ip-country") ?? "US",
    city: request.headers.get("x-vercel-ip-city") ?? "Unknown",
  });
}

// app/posts/[slug]/page.tsx
import { notFound } from "next/navigation";

export async function generateStaticParams(): Promise<{ slug: string }[]> {
  const posts = await fetch("https://api.example.com/posts").then((r) => r.json());
  return posts.map((post: { slug: string }) => ({ slug: post.slug }));
}

export default async function PostPage({ params }: { params: Promise<{ slug: string }> }) {
  const { slug } = await params;
  const post = await fetch(`https://api.example.com/posts/${slug}`, {
    next: { revalidate: 3600 }, // Revalidate every hour
  }).then((r) => r.json());

  if (!post) notFound();
  return <article><h1>{post.title}</h1></article>;
}

vercel link                   # Link project
vercel env pull .env.local    # Pull env vars locally
vercel                        # Deploy to preview
vercel --prod                 # Deploy to production
vercel rollback               # Rollback to previous

name = "my-api"
main = "src/index.ts"
compatibility_date = "2025-12-01"
compatibility_flags = ["nodejs_compat"]

routes = [
  { pattern = "api.example.com/*", zone_name = "example.com" }
]

[[kv_namespaces]]
binding = "CACHE"
id = "abc123def456"
preview_id = "789ghi012jkl"

[[d1_databases]]
binding = "DB"
database_name = "my-app-db"
database_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

[[r2_buckets]]
binding = "STORAGE"
bucket_name = "my-app-uploads"

[vars]
ENVIRONMENT = "production"

[env.staging]
routes = [{ pattern = "staging-api.example.com/*", zone_name = "example.com" }]
[env.staging.vars]
ENVIRONMENT = "staging"

// src/index.ts
export interface Env {
  DB: D1Database;
  CACHE: KVNamespace;
  STORAGE: R2Bucket;
  ENVIRONMENT: string;
  API_KEY: string; // via `wrangler secret put API_KEY`
}

export default {
  async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
    const url = new URL(request.url);

    if (url.pathname === "/api/posts" && request.method === "GET") {
      return handleGetPosts(env, ctx);
    }
    if (url.pathname === "/api/upload" && request.method === "POST") {
      return handleUpload(request, env);
    }
    return new Response("Not Found", { status: 404 });
  },
};

async function handleGetPosts(env: Env, ctx: ExecutionContext): Promise<Response> {
  // Check KV cache first
  const cached = await env.CACHE.get("posts:all", "json");
  if (cached) return Response.json(cached, { headers: { "X-Cache": "HIT" } });

  // Query D1
  const { results } = await env.DB.prepare(
    "SELECT id, title, slug, created_at FROM posts WHERE status = ? ORDER BY created_at DESC LIMIT 20"
  ).bind("published").all();

  // Cache in KV for 5 minutes
  ctx.waitUntil(env.CACHE.put("posts:all", JSON.stringify(results), { expirationTtl: 300 }));

  return Response.json(results, { headers: { "X-Cache": "MISS" } });
}

async function handleUpload(request: Request, env: Env): Promise<Response> {
  const formData = await request.formData();
  const file = formData.get("file") as File | null;
  if (!file) return Response.json({ error: "No file provided" }, { status: 400 });

  const key = `uploads/${Date.now()}-${file.name}`;
  await env.STORAGE.put(key, file.stream(), {
    httpMetadata: { contentType: file.type },
    customMetadata: { originalName: file.name },
  });

  return Response.json({ key, url: `https://cdn.example.com/${key}` });
}

-- migrations/0001_init.sql
CREATE TABLE IF NOT EXISTS posts (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  title TEXT NOT NULL,
  slug TEXT NOT NULL UNIQUE,
  content TEXT NOT NULL,
  status TEXT NOT NULL DEFAULT 'draft',
  created_at TEXT NOT NULL DEFAULT (datetime('now'))
);
CREATE INDEX idx_posts_status ON posts(status);

wrangler d1 migrations apply my-app-db --local   # Local
wrangler d1 migrations apply my-app-db --remote  # Production

// functions/api/posts.ts
interface Env { DB: D1Database; }

export const onRequestGet: PagesFunction<Env> = async (context) => {
  const { results } = await context.env.DB.prepare(
    "SELECT * FROM posts WHERE status = ? LIMIT 20"
  ).bind("published").all();
  return Response.json(results);
};

wrangler login                          # Authenticate
wrangler dev                            # Local development
wrangler deploy                         # Deploy
wrangler deploy --env staging           # Deploy to staging
wrangler secret put API_KEY             # Set secret (prompts for value)
wrangler tail                           # Tail logs in real time

[build]
  base = "apps/marketing"
  command = "npm run build"
  publish = "dist"
  functions = "netlify/functions"
  edge_functions = "netlify/edge-functions"

[build.environment]
  NODE_VERSION = "20"

[context.production]
  command = "npm run build"
  [context.production.environment]
    API_URL = "https://api.example.com"

[context.deploy-preview]
  command = "npm run build:preview"
  [context.deploy-preview.environment]
    API_URL = "https://staging-api.example.com"

[[headers]]
  for = "/*"
  [headers.values]
    X-Frame-Options = "DENY"
    X-Content-Type-Options = "nosniff"

[[headers]]
  for = "/assets/*"
  [headers.values]
    Cache-Control = "public, max-age=31536000, immutable"

[[redirects]]
  from = "/old-path"
  to = "/new-path"
  status = 301
  force = true

# SPA fallback
[[redirects]]
  from = "/*"
  to = "/index.html"
  status = 200

# API proxy
[[redirects]]
  from = "/api/*"
  to = "https://api.example.com/:splat"
  status = 200
  force = true

# Country-based redirect
[[redirects]]
  from = "/*"
  to = "/uk/:splat"
  status = 302
  conditions = { Country = ["GB"] }

[[edge_functions]]
  path = "/api/geo"
  function = "geolocation"

[[plugins]]
  package = "@netlify/plugin-nextjs"

// netlify/functions/create-checkout.ts
import type { Handler, HandlerEvent } from "@netlify/functions";

const handler: Handler = async (event: HandlerEvent) => {
  if (event.httpMethod !== "POST") {
    return { statusCode: 405, body: JSON.stringify({ error: "Method not allowed" }) };
  }

  const body = JSON.parse(event.body ?? "{}") as { priceId: string; successUrl: string; cancelUrl: string };
  const stripe = await import("stripe").then((m) => new m.default(process.env.STRIPE_SECRET_KEY!));

  const session = await stripe.checkout.sessions.create({
    mode: "subscription",
    line_items: [{ price: body.priceId, quantity: 1 }],
    success_url: body.successUrl,
    cancel_url: body.cancelUrl,
  });

  return {
    statusCode: 200,
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ sessionId: session.id, url: session.url }),
  };
};

export { handler };

// netlify/edge-functions/geolocation.ts
import type { Context } from "@netlify/edge-functions";

export default async (request: Request, context: Context) => {
  return Response.json({
    country: context.geo.country?.code ?? "Unknown",
    city: context.geo.city ?? "Unknown",
    timezone: context.geo.timezone,
  });
};

export const config = { path: "/api/geo" };

<form name="contact" method="POST" data-netlify="true" netlify-honeypot="bot-field">
  <p class="hidden"><label>Don't fill this out: <input name="bot-field" /></label></p>
  <input type="text" name="name" required />
  <input type="email" name="email" required />
  <textarea name="message" required></textarea>
  <button type="submit">Send</button>
</form>

netlify login                   # Authenticate
netlify link                    # Link project
netlify dev                     # Local dev with functions
netlify deploy                  # Deploy to preview
netlify deploy --prod           # Deploy to production
netlify env:set API_KEY "val"   # Set env var

app = "my-app"
primary_region = "lhr"

[build]
  # Uses Dockerfile in project root

[env]
  NODE_ENV = "production"
  PORT = "3000"

[http_service]
  internal_port = 3000
  force_https = true
  auto_stop_machines = "stop"
  auto_start_machines = true
  min_machines_running = 1
  processes = ["app"]

  [http_service.concurrency]
    type = "requests"
    hard_limit = 250
    soft_limit = 200

  [[http_service.checks]]
    interval = "15s"
    timeout = "5s"
    grace_period = "10s"
    method = "GET"
    path = "/api/health"

[mounts]
  source = "app_data"
  destination = "/data"

[[vm]]
  size = "shared-cpu-1x"
  memory = "512mb"

FROM node:20-alpine AS base
RUN corepack enable && corepack prepare pnpm@latest --activate
WORKDIR /app

FROM base AS deps
COPY package.json pnpm-lock.yaml ./
RUN pnpm install --frozen-lockfile --prod=false

FROM base AS builder
COPY --from=deps /app/node_modules ./node_modules
COPY . .
ARG NEXT_PUBLIC_API_URL
ENV NEXT_PUBLIC_API_URL=$NEXT_PUBLIC_API_URL
RUN pnpm build

FROM node:20-alpine AS runner
WORKDIR /app
ENV NODE_ENV=production PORT=3000
RUN addgroup --system --gid 1001 nodejs && adduser --system --uid 1001 nextjs

COPY --from=builder /app/public ./public
COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static

USER nextjs
EXPOSE 3000
CMD ["node", "server.js"]

import type { NextConfig } from "next";
const nextConfig: NextConfig = { output: "standalone" };
export default nextConfig;

fly postgres create --name my-app-db --region lhr --initial-cluster-size 1
fly postgres attach my-app-db --app my-app  # Sets DATABASE_URL automatically
fly proxy 15432:5432 --app my-app-db         # Local proxy for dev
fly ssh console --app my-app -C "npx prisma migrate deploy"  # Run migrations

fly scale count 1 --region lhr   # London (primary)
fly scale count 1 --region iad   # Virginia
fly scale count 1 --region nrt   # Tokyo

import Database from "better-sqlite3";

const db = new Database(process.env.DATABASE_PATH ?? "/data/app.db");
db.pragma("journal_mode = WAL");
db.pragma("busy_timeout = 5000");
db.pragma("synchronous = NORMAL");
db.pragma("foreign_keys = ON");

export { db };

// app/api/health/route.ts
import { NextResponse } from "next/server";

export async function GET(): Promise<NextResponse> {
  const checks: Record<string, "ok" | "error"> = { server: "ok" };

  try {
    await db.prepare("SELECT 1").get();
    checks.database = "ok";
  } catch {
    checks.database = "error";
  }

  const healthy = Object.values(checks).every((v) => v === "ok");
  return NextResponse.json(
    { status: healthy ? "healthy" : "degraded", checks },
    { status: healthy ? 200 : 503 }
  );
}

fly auth login                    # Authenticate
fly launch                        # Init app (generates fly.toml + Dockerfile)
fly deploy                        # Deploy
fly secrets set DB_URL="pg://..."  # Set secrets
fly logs                          # View logs
fly ssh console                   # SSH into machine
fly scale count 3                 # Horizontal scale
fly scale vm shared-cpu-2x        # Vertical scale
fly volumes create data --region lhr --size 10  # Create volume

# .github/workflows/deploy-fly.yml
name: Deploy to Fly.io
on:
  push:
    branches: [main]
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: superfly/flyctl-actions/setup-flyctl@master
      - run: flyctl deploy --remote-only
        env:
          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}