Strapi Production Setup — PostgreSQL, NODE_ENV, and Process Management

# Install PostgreSQL (Ubuntu/Debian)
sudo apt update
sudo apt install postgresql postgresql-contrib

# Create a database and user for Strapi
sudo -u postgres psql

CREATE DATABASE strapi_production;
CREATE USER strapi_user WITH ENCRYPTED PASSWORD 'secure_password';
GRANT ALL PRIVILEGES ON DATABASE strapi_production TO strapi_user;
\q

// config/database.js
module.exports = ({ env }) => ({
  connection: {
    client: "postgres",
    connection: {
      host: env("DATABASE_HOST", "localhost"),
      port: env.int("DATABASE_PORT", 5432),
      database: env("DATABASE_NAME", "strapi_production"),
      user: env("DATABASE_USERNAME", "strapi_user"),
      password: env("DATABASE_PASSWORD", "secure_password"),
      ssl: env.bool("DATABASE_SSL", true),
      schema: "public",
    },
    pool: {
      min: 2,
      max: 10,
      acquireTimeoutMillis: 30000,
      createTimeoutMillis: 30000,
      idleTimeoutMillis: 30000,
      reapIntervalMillis: 1000,
    },
    debug: false,
  },
});

// NODE_ENV=production causes:
// 1. Admin panel served from built files (not development server)
// 2. Error messages are less verbose (no stack traces)
// 3. Logger outputs JSON format (for log aggregation)
// 4. Performance optimizations enabled

// Set in .env.production:
NODE_ENV=production

// config/server.js — Production server configuration
module.exports = ({ env }) => ({
  host: env("HOST", "0.0.0.0"),
  port: env.int("PORT", 1337),
  app: {
    keys: env.array("APP_KEYS"),
  },
  admin: {
    auth: {
      secret: env("ADMIN_JWT_SECRET"),
    },
    // In production, disable auto-open
    autoOpen: false,
    // Custom admin URL path
    url: env("ADMIN_URL", "/admin"),
    // Serve admin panel from built files
    serveAdminPanel: true,
  },
  // URL that the API is accessible from
  url: env("PUBLIC_URL", "https://api.example.com"),
  // Proxy support (if behind nginx or Cloudflare)
  proxy: env.bool("IS_PROXY", true),
  // Cron jobs configuration
  cron: {
    enabled: env.bool("CRON_ENABLED", false),
  },
});

# Build the admin panel (compiles React app to static files)
NODE_ENV=production npm run build

# Output:
# ✔ Building admin panel...
# ✔ Admin panel built successfully
# The admin panel is served at /admin

# Start the production server
NODE_ENV=production npm run start

# Install PM2 globally
npm install -g pm2

# Start Strapi with PM2
pm2 start npm --name "strapi" -- run start

# With ecosystem.config.js
// ecosystem.config.js
module.exports = {
  apps: [
    {
      name: "strapi",
      script: "npm",
      args: "start",
      env: {
        NODE_ENV: "production",
        PORT: 1337,
      },
      // Cluster mode (run multiple instances)
      exec_mode: "cluster",
      instances: 4,  // Number of CPU cores
      // Memory limit — restart if exceeds 500MB
      max_memory_restart: "500M",
      // Logging
      error_file: "./logs/strapi-error.log",
      out_file: "./logs/strapi-out.log",
      merge_logs: true,
      log_date_format: "YYYY-MM-DD HH:mm:ss",
      // Auto-restart on crash
      autorestart: true,
      // Watch for file changes (disable in production)
      watch: false,
      // Max restarts within 10 seconds
      max_restarts: 10,
      restart_delay: 4000,
      // Graceful shutdown
      kill_timeout: 5000,
      // Environment variables file
      env_file: ".env.production",
    },
  ],
};

# Start with ecosystem file
pm2 start ecosystem.config.js

# Save the PM2 process list (survives reboot)
pm2 save

# Auto-start PM2 on server reboot
pm2 startup

# Monitor processes
pm2 monit

# View logs
pm2 logs strapi

# Restart
pm2 restart strapi

# Stop
pm2 stop strapi

# /etc/nginx/sites-available/strapi
server {
    listen 80;
    server_name api.example.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name api.example.com;

    ssl_certificate /etc/letsencrypt/live/api.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/api.example.com/privkey.pem;

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;

    # Max upload size
    client_max_body_size 10M;

    # Strapi API
    location /api/ {
        proxy_pass http://127.0.0.1:1337;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
    }

    # Admin panel
    location /admin {
        proxy_pass http://127.0.0.1:1337;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }

    # Uploads (serve directly with caching)
    location /uploads/ {
        proxy_pass http://127.0.0.1:1337;
        proxy_cache STATIC;
        proxy_cache_valid 200 30d;
        add_header Cache-Control "public, max-age=2592000, immutable";
    }
}

[ ] PostgreSQL configured and connected
[ ] JWT secrets set in environment variables
[ ] Admin panel built with NODE_ENV=production
[ ] PM2 configured for process management
[ ] Reverse proxy (nginx) configured
[ ] SSL certificates installed
[ ] Database backups configured
[ ] Logging configured (logs rotated)
[ ] Monitoring set up (health checks)
[ ] Firewall configured (only ports 80, 443 open)
[ ] Rate limiting enabled
[ ] CORS configured for frontend domains
[ ] Upload provider configured (S3/Cloudinary)
[ ] Redis configured for caching (optional)