Best practices

  1. Use Git for production — prefer deployon deploy --push or webhook auto-deploy so every release is tied to a commit.
  2. Keep secrets in Environment — never commit .env with production secrets; mark build-time vars as build args.
  3. Listen on 0.0.0.0 — bind your HTTP server to all interfaces and the port DeployON injects/expects.
  4. Set a health endpoint — make sure the start command keeps a process listening so healthchecks pass.
  5. Right-size packages — watch Usage; upgrade before OOM or disk failures.
  6. Pin Node/runtime — use .nvmrc, engines, or nixpacks.toml when auto-detect picks the wrong version.
  7. Separate build vs runtime env — only mark variables as build args when the build truly needs them.
  8. Use rollback — keep a known-good healthy deployment before risky changes.
  9. Custom domains after DNS — point DNS first, then verify, then wait for TLS ACTIVE.
  10. CLI tokens for CI — create dklt.* tokens as Team Owner; never commit them.