04 - Configuration & Deployment

Environment Variables

Environment variables are managed at multiple levels:

T3 Env Validation (Next.js App)

File: apps/app/src/env.mjs

The main frontend validates ~50 environment variables at build time using @t3-oss/env-nextjs with Zod schemas. Variables are split into server (secret) and client (public) categories.

Required variables:

• DATABASE_URL — PostgreSQL connection string
• AUTH_SECRET — Better Auth signing secret
• RESEND_API_KEY — Email delivery
• REVALIDATION_SECRET — Cache revalidation token
• NEXT_PUBLIC_PORTAL_URL — Portal app URL

Optional variables (features degrade gracefully when absent):

• OPENAI_API_KEY — AI features (chat, policy generation, embeddings)
• ANTHROPIC_API_KEY, GROQ_API_KEY — Alternative LLM providers
• FIRECRAWL_API_KEY — Web scraping for vendor research
• APP_AWS_* — S3 file storage
• UPSTASH_REDIS_REST_* — Caching
• UPSTASH_VECTOR_REST_* — Vector store for RAG
• TRIGGER_SECRET_KEY — Background job processing
• AUTH_GOOGLE_ID/SECRET, AUTH_GITHUB_ID/SECRET, AUTH_MICROSOFT_* — OAuth providers
• NEXT_PUBLIC_POSTHOG_* — Analytics
• FLEET_URL, FLEET_TOKEN — MDM device management
• STRIPE_SECRET_KEY — Billing

API Environment (apps/api/.env.example)

The NestJS API expects:

• BASE_URL, BETTER_AUTH_URL, PORT
• DATABASE_URL
• APP_AWS_* — S3 buckets (attachments, questionnaires, knowledge base, org assets)
• OPENAI_API_KEY, ANTHROPIC_API_KEY, GROQ_API_KEY
• UPSTASH_REDIS_*, UPSTASH_VECTOR_*
• RESEND_API_KEY
• NOVU_API_KEY — Notification service
• SECURITY_HUB_ROLE_ASSUMER_ARN — AWS SecurityHub scanning

Turbo Global Env

turbo.json declares 55+ environment variables as globalEnv, ensuring cache invalidation when any change:

{
  "globalEnv": [
    "DATABASE_URL",
    "OPENAI_API_KEY",
    "ANTHROPIC_API_KEY",
    "AUTH_SECRET",
    ...
  ]
}

Auth Configuration

File: apps/app/src/utils/auth.ts

Better Auth is configured with:

Trusted origins: localhost:3000, localhost:3002, *.trycomp.ai, plus custom via AUTH_TRUSTED_ORIGINS env var.

AWS Configuration

The platform uses multiple S3 buckets:

Additional AWS services:

• SecurityHub (@aws-sdk/client-securityhub) — Cloud security scanning via role assumption
• STS (@aws-sdk/client-sts) — Cross-account role assumption for customer AWS accounts
• Lambda (@aws-sdk/client-lambda) — Serverless function invocation

Docker Multi-Stage Build

File: Dockerfile (root)

The Dockerfile defines 6 build stages:

Stage 1: deps

FROM oven/bun:1.2.8 AS deps

• Copies workspace package.json files and lockfile
• Runs bun install with frozen lockfile

Stage 2: migrator

FROM oven/bun:1.2.8 AS migrator

• Minimal image for running Prisma migrations
• Installs only prisma, @prisma/client, @trycompai/db, zod
• Copies schema and migration files
• CMD: bunx prisma migrate deploy

Stage 3: app-builder

FROM deps AS app-builder

• Copies full source from deps stage
• Runs schema combination script
• Sets build-time args (NEXT_PUBLIC_* for PostHog, GTM, LinkedIn, etc.)
• Builds with SKIP_ENV_VALIDATION=true and 6GB Node heap

Stage 4: app (production)

FROM node:22-alpine AS app

• Copies standalone output from app-builder
• Copies static assets and public files
• Runs as node apps/app/server.js on port 3000

Stage 5: portal-builder

FROM deps AS portal-builder

• Same pattern as app-builder but for the portal app

Stage 6: portal (production)

FROM node:22-alpine AS portal

• Copies standalone portal output
• Runs as node apps/portal/server.js on port 3000

Docker Compose

File: docker-compose.yml (root)

Defines 4 services:

Common configuration:

• Health checks: HTTP GET to app endpoints
• Logging: JSON file driver, 10MB max size, 5 files, compression
• Restart: unless-stopped
• Environment: loaded from per-service .env files

Local database (packages/db/docker-compose.yml):

• PostgreSQL 17-alpine on port 5432
• Database name: comp
• Persistent volume: postgres_data

CI/CD

GitHub Actions Workflows

Release Process

File: release.config.js

Uses semantic-release on the release branch:

1. commit-analyzer — Determines version bump from conventional commits
2. release-notes-generator — Generates changelog entries
3. changelog — Updates CHANGELOG.md
4. git — Commits package.json, bun.lockb, CHANGELOG.md, packages/*/package.json
5. github — Creates GitHub release with notes

After release, the workflow merges the release branch back to main.

Pre-commit Hooks

Directory: .husky/

• commit-msg: Runs npx commitlint --edit $1 to enforce conventional commit messages

Root package.json also configures lint-staged for formatting staged files with Prettier.

Turbo Build Pipeline

File: turbo.json

db:generate → build → (deploy)
                ↑
              lint, typecheck (parallel)

The ^ prefix means "run this task in all dependency packages first" (topological ordering).

Package Publishing

Published packages use npm with public access: