deploy-stack-nextjs-example ☁️🚀

A production-ready Next.js (Standalone) application deployed to AWS ECS Fargate with zero-secret GitHub Actions CI/CD, auto-generated by deploy-stack.

---

🎮 The Trust Engine (Pre-Flight Check)

Preview the complete architecture topology and dynamic cloud cost breakdown before deploying:

npx deploy-stack apply --dry-run

---

💰 Architecture & Cost Estimate

This configuration provisions an Application Load Balancer (ALB) and an ECS Fargate service (Micro: 0.25 vCPU, 512MB RAM).

• Estimated Baseline: ~$31.28 / month (ALB base + Fargate compute)
• Hourly Rate: ~$0.043 / hour
• Testing for an afternoon costs less than $0.20 before tearing down.

⚠️ Note: Cloud costs vary by usage, ingress/egress, and region. Always set up AWS Budget Alerts for active workloads.

---

🚀 Deployment Guide

1. Provision AWS Infrastructure

Generate and apply the cloud stack directly from your project root:

npx deploy-stack apply --yes

Review the pre-flight topology tree and type y to confirm.

2. Push Secrets (Optional)

If your Next.js application requires environment variables, push a local .env file directly to encrypted AWS Secrets Manager vaults:

npx deploy-stack secrets push .env

3. Automated Keyless CI/CD (OIDC)

Commit and push your repository to GitHub:

git add .
git commit -m "feat: deploy to aws via deploy-stack"
git push origin main

The workflow utilizes the official deploy-stack GitHub Action and AWS IAM OpenID Connect (OIDC) to deploy keylessly with temporary security credentials. No long-lived AWS keys are stored in GitHub Secrets.

---

⚠️ Critical Next.js Requirement: Standalone Output

Next.js must produce a minimal self-contained server bundle for containerization. Ensure next.config.js or next.config.mjs contains output: 'standalone':

/** @type {import('next').NextConfig} */
const nextConfig = {
  output: 'standalone',
};

export default nextConfig;

---

🛡️ DevSecOps & Security Scanning

Every push triggers automated container and infrastructure scanning via Trivy:

1. Navigate to the Actions tab in GitHub.
2. Select the latest deployment workflow run.
3. Review the Summary tab to inspect automated vulnerability and misconfiguration audits.

---

🛑 Safe Teardown

To tear down all provisioned resources (ALB, ECS, networking, and S3 state bucket) and halt AWS billing:

npx deploy-stack destroy --yes