Designed and operated a SHA-pinned GitHub Actions → GHCR → self-hosted-VPS CI/CD pipeline that ships zero-downtime blue-green Docker deploys of Unifixz, a Next.js multimedia-studio commerce platform.
I own the deployment layer of Unifixz (a Next.js 15 studio commerce platform built by the team). The pipeline builds once, ships everywhere: a single SHA-pinned image is promoted from dev to prod, with environment-specific values injected at container start. Releases are blue-green container swaps gated on an in-container health check, with automatic rollback, a manual approval gate on production, and Prisma migrations run in a one-shot container ahead of the swap.
Owned the deployment side only — the application (a Next.js 15 multimedia-studio commerce platform) was built by teammates. I designed and operate the CI/CD pipeline, Docker packaging, environment-aware configuration, secret management, and the zero-downtime self-hosted release process. Live at unifixz.lk (dev at dev.unifixz.lk).
Unifixz needed reliable, environment-aware releases on a self-hosted Linux VPS (cost / data-residency; PaaS rejected). Four concrete problems followed: a single Docker image had to serve both dev and prod even though Next.js inlines NEXT_PUBLIC_* at build time (the wrong domain leaked into prod emails and PayHere callbacks); 13 Prisma migrations had to apply in front of live traffic without racing the app container; SMTP from the VPS IP had a deliverability gap; and PayHere is a live payment integration, so every prod release had to be approval-gated and instantly rollback-able.
ChallengeNEXT_PUBLIC_APP_URL is statically inlined by Next.js at build time, and the same image was promoted dev → prod — so production password-reset emails, receipts, SEO tags, and PayHere return/cancel/notify URLs all pointed at dev.unifixz.lk.
FixRefactored the URL-reading sites (email, payhere, seo) to read the runtime NEXTAUTH_URL (injected per-environment from GitHub Secrets) ahead of the build-time NEXT_PUBLIC_* value — one image, two environments, correct URLs everywhere.
ChallengeOutbound SMTP from the VPS IP was rate-limited / flagged, so password-reset and order-confirmation emails were silently undelivered.
FixMigrated the email path from nodemailer/SMTP to the Resend API: removed SMTP_* from both deploy workflows, threaded RESEND_API_KEY / RESEND_FROM through the development and production GitHub Environments and into the .env heredoc, and kept the .env.example files in lockstep.