This pack starts where framework output ends and stops where infrastructure-specific responsibility begins. It is deliberately small enough to audit and explicit about the work it does not perform.
Pick one runtime path
The Dockerfile builds standalone output in stages and runs server.js as a non-root user. Use it when the deployment system promotes immutable images and the team understands container storage, logs, networking, health checks, and image retention.
The systemd unit runs an unpacked standalone release from /srv/nextjs/current, reads runtime values from /etc/nextjs/production.env, sends SIGTERM, and waits up to 30 seconds. Use it when the server lifecycle is managed directly and release directories provide an atomic promotion and rollback boundary.
Do not place systemd around a separately supervised Docker container merely because both files are available.
Keep Nginx at the network boundary
The Nginx example binds public HTTP and proxies to a loopback-only Next.js listener. It forwards host and protocol context and disables proxy buffering for streamed responses. Replace the example domain and integrate the TLS automation, rate limits, payload limits, access logs, and security policy used by the actual environment.
The template does not expose port 3000 publicly. Provider and guest firewalls should enforce the same boundary.
Build once before deployment
The GitHub Actions workflow installs locked dependencies, runs tests when present, builds once, copies the public and static directories required by standalone output, and uploads a commit-addressed archive. It uses read-only repository permissions and contains no deployment credential.
Promote that exact artifact through a separately reviewed deployment process. Rebuilding on the production server weakens provenance and can produce a different dependency or environment result.
Validate the adapted pack
Replace every placeholder and confirm file ownership. Exercise representative routes, images, streaming, cache behavior, webhooks, jobs, shutdown, restart, logs, alerts, backup restoration, and rollback. For multiple instances, add the shared cache, invalidation, encryption-key, deployment-ID, and version-skew controls described in the compatibility matrix.