Production Checklist

NEXT_PUBLIC_APP_URL=https://yourdomain.com

ALLOWED_ORIGINS=https://yourdomain.com

UPSTASH_REDIS_REST_URL=https://your-redis.upstash.io
UPSTASH_REDIS_REST_TOKEN=your-token

CRON_SECRET=your-random-32-char-string

cd apps/boilerplate && npx prisma migrate deploy

// Security Headers
  async headers() {
    return [
      {
        source: '/:path*',
        headers: [
          {
            key: 'X-DNS-Prefetch-Control',
            value: 'on',
          },
          {
            key: 'X-Frame-Options',
            value: 'SAMEORIGIN',
          },
          {
            key: 'X-Content-Type-Options',
            value: 'nosniff',
          },
          {
            key: 'X-XSS-Protection',
            value: '1; mode=block',
          },
          {
            key: 'Referrer-Policy',
            value: 'strict-origin-when-cross-origin',
          },
          {
            key: 'Permissions-Policy',
            value: 'camera=(), microphone=(self), geolocation=(), interest-cohort=(), payment=(), usb=()',
          },
          {
            key: 'Content-Security-Policy',
            value: ContentSecurityPolicy.replace(/\s{2,}/g, ' ').trim(),
          },
        ],
      },
    ]
  },

curl https://yourdomain.com/api/health

https://yourdomain.com/api/webhooks/clerk

https://yourdomain.com/api/webhooks/lemonsqueezy

# Subscription-based pricing
NEXT_PUBLIC_LEMONSQUEEZY_BASIC_MONTHLY_VARIANT_ID=...
NEXT_PUBLIC_LEMONSQUEEZY_BASIC_YEARLY_VARIANT_ID=...
NEXT_PUBLIC_LEMONSQUEEZY_PRO_MONTHLY_VARIANT_ID=...
NEXT_PUBLIC_LEMONSQUEEZY_PRO_YEARLY_VARIANT_ID=...
NEXT_PUBLIC_LEMONSQUEEZY_ENTERPRISE_MONTHLY_VARIANT_ID=...
NEXT_PUBLIC_LEMONSQUEEZY_ENTERPRISE_YEARLY_VARIANT_ID=...

# Credit-based pricing (if using NEXT_PUBLIC_PRICING_MODEL=credit_based)
NEXT_PUBLIC_CREDIT_BASIC_MONTHLY_VARIANT_ID=...
NEXT_PUBLIC_CREDIT_PRO_MONTHLY_VARIANT_ID=...
NEXT_PUBLIC_CREDIT_ENTERPRISE_MONTHLY_VARIANT_ID=...

# Bonus credit packages (if NEXT_PUBLIC_BONUS_CREDITS_ENABLED=true)
NEXT_PUBLIC_BONUS_BASIC_PACKAGE1_VARIANT_ID=...
NEXT_PUBLIC_BONUS_BASIC_PACKAGE2_VARIANT_ID=...
NEXT_PUBLIC_BONUS_PRO_PACKAGE1_VARIANT_ID=...
NEXT_PUBLIC_BONUS_PRO_PACKAGE2_VARIANT_ID=...
NEXT_PUBLIC_BONUS_ENTERPRISE_PACKAGE1_VARIANT_ID=...
NEXT_PUBLIC_BONUS_ENTERPRISE_PACKAGE2_VARIANT_ID=...

NEXT_PUBLIC_LEMONSQUEEZY_CUSTOMER_PORTAL_URL=https://your-store.lemonsqueezy.com/billing

ANALYZE=true pnpm build:boilerplate

images: {
    remotePatterns: [
      {
        protocol: 'https',
        hostname: 'images.unsplash.com',
        port: '',
        pathname: '/**',
      },
      {
        protocol: 'https',
        hostname: 'images.clerk.dev',
        port: '',
        pathname: '/**',
      },
      {
        protocol: 'https',
        hostname: 'img.clerk.com',
        port: '',
        pathname: '/**',
      },
      {
        protocol: 'https',
        hostname: '*.clerkstatic.com',
        port: '',
        pathname: '/**',
      },
      {
        protocol: 'https',
        hostname: 'lh3.googleusercontent.com',
        port: '',
        pathname: '/**',
      },
      {
        protocol: 'https',
        hostname: 'avatars.githubusercontent.com',
        port: '',
        pathname: '/**',
      },
    ],
    formats: ['image/avif', 'image/webp'],
  },

import { MetadataRoute } from 'next'

/**
 * robots.txt Generator
 *
 * Blocks search engines from accessing protected routes:
 * - /api/* - API endpoints (internal)
 * - /dashboard/* - Authenticated app pages
 * - /(auth)/* - Authentication flow pages
 * - /admin/* - Admin pages
 * - /_next/* - Next.js internals
 * - /private/* - Private resources
 *
 * AI Crawlers: llms.txt available at /llms.txt per llmstxt.org standard.
 */
export default function robots(): MetadataRoute.Robots {
  const baseUrl = process.env.NEXT_PUBLIC_APP_URL || 'https://localhost:3000'

  return {
    rules: [
      {
        userAgent: '*',
        allow: '/',
        disallow: [
          '/api/',
          '/dashboard/',
          '/(dashboard)/',
          '/(auth)/',
          '/admin/',
          '/_next/',
          '/private/',
        ],
      },
    ],
    sitemap: `${baseUrl}/sitemap.xml`,
    host: baseUrl,
  }
}

import { MetadataRoute } from 'next'

export default function sitemap(): MetadataRoute.Sitemap {
  const baseUrl = process.env.NEXT_PUBLIC_APP_URL || 'https://localhost:3000'

  // Static pages
  const staticPages = [
    '',
    '/login',
    '/register',
    '/privacy',
    '/terms',
    '/imprint',
  ].map((route) => ({
    url: `${baseUrl}${route}`,
    lastModified: new Date().toISOString(),
    changeFrequency: (route === '' ? 'daily' : 'weekly') as 'daily' | 'weekly',
    priority: route === '' ? 1 : 0.8,
  }))

  return [...staticPages]
}

/**
 * ============================================================================
 * llms.txt Route Handler
 * ============================================================================
 *
 * Generates a Markdown file following the llmstxt.org standard.
 * Provides AI crawlers (ChatGPT, Claude, Perplexity) with structured
 * access to your site's public content.
 *
 * CUSTOMIZATION AFTER PURCHASE:
 * 1. Update the description text to match your product
 * 2. Add your public pages/features to the "Pages" section
 * 3. Add a "## Docs" section if you have public documentation
 * 4. Add a "## API" section if you have a public API
 *
 * @see https://llmstxt.org
 * ============================================================================
 */

import { siteConfig } from '@/config/site'

export const dynamic = 'force-static'

export async function GET() {
  const baseUrl = process.env.NEXT_PUBLIC_APP_URL || 'https://localhost:3000'

  const lines: string[] = []

  // Title (H1) — per llmstxt.org spec
  lines.push(`# ${siteConfig.name}`)
  lines.push('')

  // Blockquote description
  lines.push(`> ${siteConfig.tagline} — ${siteConfig.description}`)
  lines.push('')

  // Detailed description
  lines.push(
    `${siteConfig.name} is a SaaS application built with Next.js.`
  )
  lines.push('')

  // Public pages
  lines.push('## Pages')
  lines.push('')
  lines.push(`- [Login](${baseUrl}/login): Sign in to your account`)
  lines.push(`- [Register](${baseUrl}/register): Create a new account`)
  lines.push(
    `- [Privacy Policy](${baseUrl}/privacy): Privacy policy and data handling`
  )
  lines.push(
    `- [Terms of Service](${baseUrl}/terms): Terms and conditions`
  )
  lines.push(
    `- [Legal Notice](${baseUrl}/imprint): Legal notice and company information`
  )
  lines.push('')

  const content = lines.join('\n')

  return new Response(content, {
    headers: {
      'Content-Type': 'text/plain; charset=utf-8',
      'Cache-Control':
        'public, s-maxage=86400, stale-while-revalidate=604800',
    },
  })
}

import { NextResponse } from 'next/server'
import { prisma } from '@/lib/db'

export const runtime = 'nodejs'
export const dynamic = 'force-dynamic'

interface HealthCheck {
  status: 'healthy' | 'unhealthy'
  timestamp: string
  version: string
  environment: string
  checks: {
    database: 'healthy' | 'unhealthy' | 'unknown'
    memory: {
      used: number
      limit: number
      percentage: number
    }
  }
  error?: string
}

export async function GET() {
  const startTime = Date.now()

  try {
    // Check database connection
    let databaseStatus: 'healthy' | 'unhealthy' | 'unknown' = 'unknown'

    try {
      await prisma.$queryRaw`SELECT 1`
      databaseStatus = 'healthy'
    } catch (dbError) {
      console.error('Database health check failed:', dbError)
      databaseStatus = 'unhealthy'
    }

    // Memory usage
    const memoryUsage = process.memoryUsage()
    const memoryLimit = 512 * 1024 * 1024 // 512MB default for Vercel
    const memoryPercentage = (memoryUsage.heapUsed / memoryLimit) * 100

    const healthCheck: HealthCheck = {
      status: databaseStatus === 'healthy' ? 'healthy' : 'unhealthy',
      timestamp: new Date().toISOString(),
      version: process.env.NEXT_PUBLIC_APP_VERSION || '1.0.0',
      environment: process.env.NODE_ENV || 'development',
      checks: {
        database: databaseStatus,
        memory: {
          used: Math.round(memoryUsage.heapUsed / 1024 / 1024),
          limit: Math.round(memoryLimit / 1024 / 1024),
          percentage: Math.round(memoryPercentage),
        },
      },
    }

    const responseTime = Date.now() - startTime

    return NextResponse.json(
      {
        ...healthCheck,
        responseTime: `${responseTime}ms`,
      },
      {
        status: healthCheck.status === 'healthy' ? 200 : 503,
        headers: {
          'Cache-Control': 'no-cache, no-store, must-revalidate',
        },
      }
    )
  } catch (error) {
    console.error('Health check error:', error)

    return NextResponse.json(
      {
        status: 'unhealthy',
        timestamp: new Date().toISOString(),
        version: process.env.NEXT_PUBLIC_APP_VERSION || '1.0.0',
        environment: process.env.NODE_ENV || 'development',
        error: error instanceof Error ? error.message : 'Unknown error',
        responseTime: `${Date.now() - startTime}ms`,
      },
      {
        status: 503,
        headers: {
          'Cache-Control': 'no-cache, no-store, must-revalidate',
        },
      }
    )
  }
}

curl https://yourdomain.com/api/health

{
  "status": "healthy",
  "timestamp": "2026-01-15T10:30:00.000Z",
  "version": "1.0.0",
  "environment": "production",
  "checks": {
    "database": "healthy",
    "memory": {
      "used": 85,
      "limit": 512,
      "percentage": 17
    }
  },
  "responseTime": "45ms"
}

# Health check
curl https://yourdomain.com/api/health

# Verify HTTPS redirect
curl -I http://yourdomain.com
# Should return 301/308 redirect to https://