Production Deployment

Envault is designed to be easily deployable to any platform that supports Next.js (Node.js).

Environment Variables

Before deploying, ensure you have the following environment variables configured in your production environment:

Variable	Description	Required
`NEXT_PUBLIC_SUPABASE_URL`	Your Supabase Project URL	Yes
`NEXT_PUBLIC_SUPABASE_ANON_KEY`	Your Supabase Anon Key	Yes
`SUPABASE_SERVICE_ROLE_KEY`	Supabase Service Role Key (for Admin tasks)	Yes
`ENCRYPTION_KEY`	32-byte hex string for Master Key	Yes
`NEXT_PUBLIC_APP_URL`	Public app URL used in callbacks and email links (e.g. `https://envault.app`)	Yes
`NEXT_PUBLIC_API_SIGNATURE_SALT`	HMAC secret used to verify mutation signatures	Strongly recommended
`UPSTASH_REDIS_REST_URL`	Upstash Redis REST URL for cache-backed access checks and metadata caching	Strongly recommended
`UPSTASH_REDIS_REST_TOKEN`	Token for `UPSTASH_REDIS_REST_URL`	Strongly recommended
`CRON_SECRET`	Secret used by `/api/cron/digest` email digest endpoint	For notification digests
`ACCOUNT_DELETION_CRON_SECRET`	Secret header validation for `process-account-deletions` Edge Function	Yes (recommended for production)
`ROTATE_KEYS_CRON_SECRET`	Secret header validation for `rotate-keys` Edge Function	Yes (recommended for production)
`ENVAULT_GITHUB_APP_CLIENT_ID`	GitHub App Client ID	For GitHub Integration
`ENVAULT_GITHUB_APP_PRIVATE_KEY`	RSA private key, single-line `\n`-escaped	For GitHub Integration
`ENVAULT_GITHUB_WEBHOOK_SECRET`	Secret to verify GitHub webhook payloads	For GitHub Integration
`NEXT_PUBLIC_GITHUB_APP_NAME`	Your GitHub App's slug name	For GitHub Integration
`RESEND_API_KEY`	Resend key for transactional + digest emails	For email delivery
`EMAIL_DOMAIN`	Sender domain for outgoing emails	Optional (defaults to `mail.envault.tech`)

Never check your SUPABASE_SERVICE_ROLE_KEY or ENCRYPTION_KEY into version control. Always set them in your deployment platform's dashboard.

Deployment Providers

Deploy to Vercel

Vercel is the creators of Next.js and offers the seamless deployment experience.

Push your code to a Git repository (GitHub, GitLab, Bitbucket).
Import the project into Vercel.
Add the Environment Variables listed above.
Click Deploy.

Docker Build

You can containerize Envault using the standard Next.js Dockerfile.

FROM node:18-alpine AS base

# Install dependencies only when needed
FROM base AS deps
WORKDIR /app
COPY package.json yarn.lock* package-lock.json* pnpm-lock.yaml* ./
RUN npm ci

# Rebuild the source code only when needed
FROM base AS builder
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY . .
RUN npm run build

# Production image, copy all the files and run next
FROM base AS runner
WORKDIR /app
ENV NODE_ENV production
COPY --from=builder /app/public ./public
COPY --from=builder /app/.next/standalone ./
COPY --from=builder /app/.next/static ./.next/static

EXPOSE 3000
CMD ["node", "server.js"]

Build and run:

docker build -t envault .

docker run -p 3000:3000 --env-file .env.production envault

Deploy to Railway

Railway requires zero configuration for Next.js apps.

Connect your GitHub repository.
Railway will automatically detect the package.json and build command.
Go to Variables and add the required environment variables.
Deployment will trigger automatically.

Post-Deployment Checklist

HTTPS: Ensure your domain is serving over HTTPS.
Database Backups: Enable Point-in-Time Recovery (PITR) on Supabase.
Key Backup: Securely back up your ENCRYPTION_KEY in a password manager. If you lose this, all data is lost.

Required Scheduled Jobs

Configure these recurring jobs after deploy:

Email Digest Cron (/api/cron/digest)

Send authenticated GET requests with Authorization: Bearer <CRON_SECRET>.

Account Deletion Purge (supabase/functions/v1/process-account-deletions)

Trigger daily with x-cron-secret: <ACCOUNT_DELETION_CRON_SECRET>.

Key Rotation / Scavenger (supabase/functions/v1/rotate-keys)

Trigger with x-cron-secret: <ROTATE_KEYS_CRON_SECRET> on your desired cadence.

For Supabase-hosted schedules, use the SQL migration templates under supabase/migrations and replace the placeholder cron secrets before applying in production.