ZeroDowntime Deploys with PM2 + Git Hooks ProductionReady Playbook

/var/www/example-app/
├── repo.git/            # bare repo you push to
├── releases/            # one folder per deploy
│   ├── 20260924110907-b4c1e2a/
│   └── 20260924111530-f7d9a01/
├── shared/.env          # secrets, kept outside releases
└── current -> releases/20260924111530-f7d9a01

// server.js
const http = require('node:http');
const fs = require('node:fs');

try { process.loadEnvFile('.env'); } catch { /* no .env: use real env vars */ }
const REVISION = fs.readFileSync('REVISION', 'utf8').trim();
const PORT = Number(process.env.PORT) || 3000;

const server = http.createServer((req, res) => {
  if (req.url === '/healthz') {
    res.setHeader('content-type', 'application/json');
    return res.end(JSON.stringify({ ok: true, revision: REVISION }));
  }
  res.end('Hello from example-app\n');
});

server.listen(PORT, '127.0.0.1', () => {
  if (process.send) process.send('ready');   // tells PM2 this worker can take traffic
});

function shutdown() {
  server.close(() => process.exit(0));        // finish in-flight requests
  setTimeout(() => process.exit(1), 7000).unref();
}
process.on('SIGINT', shutdown);
process.on('SIGTERM', shutdown);

// ecosystem.config.js
module.exports = {
  apps: [{
    name: 'example-app',
    cwd: '/var/www/example-app/current',
    script: 'server.js',
    exec_mode: 'cluster',
    instances: 2,
    wait_ready: true,
    listen_timeout: 10000,
    kill_timeout: 8000,
    max_memory_restart: '400M',
    env_production: { NODE_ENV: 'production', PORT: 3000 },
  }],
};

mkdir -p /var/www/example-app/{releases,shared}
git init --bare /var/www/example-app/repo.git
nano /var/www/example-app/shared/.env      # secrets, chmod 600
chmod 600 /var/www/example-app/shared/.env

#!/usr/bin/env bash
set -euo pipefail

APP=/var/www/example-app
REPO="$APP/repo.git"
BRANCH=main
PORT=3000
SMOKE_PORT=3100
KEEP=5
export PATH="/usr/local/bin:/usr/bin:/bin:$PATH"

while read -r oldrev newrev ref; do
  [ "$ref" = "refs/heads/$BRANCH" ] || continue
  [ "$newrev" = "0000000000000000000000000000000000000000" ] && continue

  REL="$APP/releases/$(date +%Y%m%d%H%M%S)-${newrev:0:7}"
  PREV=$(readlink -f "$APP/current" || true)
  echo "Building $REL"

  # 1. Unpack the pushed commit into a new release folder
  mkdir -p "$REL"
  git --git-dir="$REPO" archive "$newrev" | tar -x -C "$REL"
  echo "$newrev" > "$REL/REVISION"
  ln -sfn "$APP/shared/.env" "$REL/.env"

  # 2. Install and build. If this fails, the live release is untouched.
  cd "$REL"
  npm ci
  npm run build --if-present
  npm prune --omit=dev

  # 3. Smoke test: run the new release on a spare port before it goes live
  PORT=$SMOKE_PORT node server.js > "$REL/smoke.log" 2>&1 &
  SMOKE_PID=$!
  smoke=0
  for i in $(seq 1 10); do
    if curl -fsS "http://127.0.0.1:$SMOKE_PORT/healthz" | grep -q "$newrev"; then smoke=1; break; fi
    sleep 1
  done
  kill "$SMOKE_PID" 2>/dev/null || true
  wait "$SMOKE_PID" 2>/dev/null || true
  if [ "$smoke" -ne 1 ]; then
    echo "Smoke test failed, see $REL/smoke.log. The live release is unchanged." >&2
    exit 1
  fi

  # 4. Switch the current symlink atomically, then reload the workers
  ln -sfn "$REL" "$APP/current.tmp"
  mv -Tf "$APP/current.tmp" "$APP/current"
  pm2 startOrReload "$APP/current/ecosystem.config.js" --env production

  # 5. Health check: the NEW revision must be answering
  ok=0
  for i in $(seq 1 15); do
    if curl -fsS "http://127.0.0.1:$PORT/healthz" | grep -q "$newrev"; then ok=1; break; fi
    sleep 2
  done
  if [ "$ok" -ne 1 ]; then
    echo "Health check failed, rolling back to $PREV" >&2
    if [ -n "$PREV" ]; then
      ln -sfn "$PREV" "$APP/current.tmp"
      mv -Tf "$APP/current.tmp" "$APP/current"
      pm2 startOrReload "$APP/current/ecosystem.config.js" --env production
    fi
    exit 1
  fi

  pm2 save
  # 6. Keep the newest $KEEP releases, never the live one
  LIVE=$(readlink -f "$APP/current")
  ls -1dt "$APP"/releases/* | tail -n +$((KEEP + 1)) | while read -r old; do
    [ "$old" = "$LIVE" ] || rm -rf "$old"
  done
  echo "Deployed ${newrev:0:7}"
done

git remote add production deploy@your-server:/var/www/example-app/repo.git
git push production main

cd /var/www/example-app
ls -1t releases
ln -sfn releases/20260924110907-b4c1e2a current.tmp && mv -Tf current.tmp current
pm2 startOrReload current/ecosystem.config.js --env production
curl -s http://127.0.0.1:3000/healthz

pm2 install pm2-logrotate            # rotate logs so they don't fill the disk
pm2 set pm2-logrotate:max_size 10M
pm2 set pm2-logrotate:retain 7
pm2 ls                               # status of every worker
pm2 logs example-app                 # live logs
pm2 monit                            # CPU and memory per worker

server {
    server_name example.com;
    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}