Skip to main content
Current production runs on Vercel. This guide describes the target AWS topology for EC2 deployment. The full export version (for AWS Solutions Architects) lives in the repo at docs/aws-deployment-architecture.md.
Do not commit .env.production or real secrets to Git. Inject secrets at deploy time from Secrets Manager.

​
Docker quick start

From the repository root on EC2:
Production compose (docker-compose.yml) runs the app only — point MONGODB_URI at Atlas or an external MongoDB host. Local stack with MongoDB (docker-compose.dev.yml):
Files in the repo: Dockerfile, .dockerignore, docker-compose.yml, docker-compose.dev.yml.

​
Required environment variables

​
Optional

​
Networking

Security groups (summary)
  • ALB: inbound 443 from org IP range or 0.0.0.0/0; outbound to app EC2 on 3000
  • App EC2: inbound 3000 from ALB SG; outbound 27017 to MongoDB, 443 for external APIs
  • MongoDB EC2 (if self-hosted): inbound 27017 from app EC2 SG only

​
ALB health check

Use /api/health/deep for monitoring and paging — it returns 503 when MongoDB or core env is unhealthy (avoid using it as the ALB check if optional integrations cause flapping).

​
EC2 sizing (starting point)

Current MongoDB footprint is ~2–3 MB — compute matters more than storage.

​
Migration from Vercel

1

Deploy on staging EC2

Build and run Docker with the same MONGODB_URI (Atlas) or a restored dump.
2

Copy secrets

Move env vars from Vercel to AWS Secrets Manager. Set NEXTAUTH_URL to the new HTTPS domain.
3

Validate

Sign in, intake, print, and sync smoke test: GET /api/sync/v1/students?limit=1 with Bearer token.
4

Update Power Automate

Change stlabel_SyncApiBaseUrl to the new AWS URL. Rotate SYNC_API_KEY if needed.
5

Cut over DNS

Point Route 53 to ALB or Elastic IP. Decommission Vercel after soak period.
Database move (if leaving Atlas):

​
MongoDB on AWS — options

​
Open questions for AWS

  1. Atlas + VPC peering vs self-managed MongoDB?
  2. ALB + ACM vs Nginx on EC2?
  3. Single EC2 vs Auto Scaling Group (min 2)?
  4. WAF / IP allowlisting for DOE networks?
  5. CI/CD: GitHub Actions → ECR → EC2?

System architecture

Stack, modules, and integration overview.

Architecture export (repo)

Full architecture markdown for AWS Solutions Architects (docs/aws-deployment-architecture.md).

​
Production reference