create-nexst-monorepo 0.1.0

package/template/.github/workflows/publish.yaml

@@ -0,0 +1,148 @@
+name: Publish Images
+
+on:
+  push:
+    branches: [main]
+
+concurrency:
+  group: publish-images-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      web: ${{ steps.filter.outputs.web }}
+      api: ${{ steps.filter.outputs.api }}
+      # @if worker
+      worker: ${{ steps.filter.outputs.worker }}
+      # @endif
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            shared: &shared
+              - 'package.json'
+              - 'bun.lock'
+              - 'bunfig.toml'
+              - 'turbo.json'
+              - '.dockerignore'
+              - 'Dockerfile.base'
+              - 'docker-bake.hcl'
+              - 'packages/**'
+            web:
+              - *shared
+              - 'apps/web/**'
+              - '!apps/web/kustomize/**'
+            api:
+              - *shared
+              - 'apps/api/**'
+              - '!apps/api/kustomize/**'
+            # @if worker
+            worker:
+              - *shared
+              - 'apps/worker/**'
+              - '!apps/worker/kustomize/**'
+            # @endif
+
+  web:
+    needs: changes
+    if: needs.changes.outputs.web == 'true'
+    uses: ./.github/workflows/publish-app.yaml
+    with:
+      app: web
+    secrets: inherit
+
+  api:
+    needs: changes
+    if: needs.changes.outputs.api == 'true'
+    uses: ./.github/workflows/publish-app.yaml
+    with:
+      app: api
+    secrets: inherit
+
+  api-migrate:
+    needs: changes
+    if: needs.changes.outputs.api == 'true'
+    uses: ./.github/workflows/publish-app.yaml
+    with:
+      app: api-migrate
+    secrets: inherit
+  # @if worker
+
+  worker:
+    needs: changes
+    if: needs.changes.outputs.worker == 'true'
+    uses: ./.github/workflows/publish-app.yaml
+    with:
+      app: worker
+    secrets: inherit
+  # @endif
+
+  # Pins the freshly pushed sha-* tags in the prod overlays so GitOps (Flux/Argo)
+  # rolls them out.
+  rewind:
+    if: >-
+      always() &&
+      needs.changes.result == 'success' &&
+      !contains(needs.*.result, 'failure') &&
+      !contains(needs.*.result, 'cancelled') &&
+      contains(needs.*.result, 'success')
+    # @if worker
+    needs: [changes, web, api, api-migrate, worker]
+    # @endif
+    # @if !worker
+    # needs: [changes, web, api, api-migrate]
+    # @endif
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          ref: main
+
+      - name: Set up Kustomize
+        working-directory: ${{ runner.temp }}
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh | bash
+          sudo mv kustomize /usr/local/bin/
+
+      - name: Update image tags in prod overlays
+        env:
+          API_CHANGED: ${{ needs.changes.outputs.api }}
+          WEB_CHANGED: ${{ needs.changes.outputs.web }}
+          WORKER_CHANGED: ${{ needs.changes.outputs.worker }} # @if worker
+        run: |
+          TAG="sha-${GITHUB_SHA::7}"
+          REGISTRY="ghcr.io/${GITHUB_REPOSITORY_OWNER,,}"
+
+          pin() { # <app dir> <image>
+            (cd "apps/$1/kustomize/overlays/prod" && kustomize edit set image "$2=$REGISTRY/$2:$TAG")
+          }
+
+          if [ "$WEB_CHANGED" = "true" ]; then pin web nexst-web; fi
+          if [ "$API_CHANGED" = "true" ]; then
+            pin api nexst-api
+            pin api nexst-api-migrate
+          fi
+          if [ "$WORKER_CHANGED" = "true" ]; then pin worker nexst-worker; fi # @if worker
+
+      - name: Commit and push
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add apps/*/kustomize/overlays/prod/kustomization.yaml
+          if git diff --cached --quiet; then
+            echo "No image tag changes to commit."
+            exit 0
+          fi
+          git commit -m "chore: rewind images to sha-${GITHUB_SHA::7} [skip ci]"
+          git push origin HEAD:main

package/template/.github/workflows/snyk.yaml

@@ -0,0 +1,34 @@
+name: Snyk Scan
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '0 0 * * *'
+
+permissions:
+  contents: read
+
+jobs:
+  security:
+    permissions:
+      contents: read
+      security-events: write
+
+    runs-on: ubuntu-latest
+    env:
+      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+
+    steps:
+      - uses: actions/checkout@v6
+      - uses: snyk/actions/setup@master
+
+      - name: Snyk Code test
+        run: snyk code test --sarif-file-output=snyk.sarif || true
+
+      - name: Upload result to GitHub Code Scanning
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: snyk.sarif

package/template/.vscode/settings.json

@@ -0,0 +1,8 @@
+{
+  "css.lint.unknownAtRules": "ignore",
+  "editor.defaultFormatter": "oxc.oxc-vscode",
+  "editor.formatOnSave": true,
+  "editor.codeActionsOnSave": {
+    "source.fixAll.oxc": "explicit"
+  }
+}

package/template/AGENTS.md

@@ -0,0 +1,42 @@
+# Nexst
+
+Bun workspace: one `package.json`, one lockfile (`bun.lock`), one CI (root
+`.github/workflows/`). `apps/*/AGENTS.md` add app-specific rules.
+
+- **web** — Next.js 16, next-intl (en, de), Tailwind 4, React Query.
+- **api** — NestJS 12 on Fastify (REST + GraphQL), Prisma 7 on Postgres.
+<!-- @if worker -->
+- **worker** — BullMQ worker for background jobs the API enqueues; shared queue
+  contracts in `packages/queues`.
+<!-- @endif -->
+- **packages/lint**, **packages/tsconfig** — shared oxlint/oxfmt/knip and TS configs.
+
+## Local dev
+
+`bun dev` starts the infra from `compose.yaml` and runs all apps in watch mode.
+The backend apps have no build step; bun runs `src/*.ts` directly, also in production.
+Secrets live in each app's `.env`/`.env.development` (see `.env.example`); bun loads
+them itself. Run TypeScript with bun (`bun <file>`, `bunx --bun prisma`), not node.
+
+## Docker
+
+`docker buildx bake <api|api-migrate|web> --load` (arm64, needs `docker login dhi.io`).
+Images are DHI bun Alpine and must stay small: pruned lockfile +
+`--production --omit=peer`, prisma only in the `prisma` stage, system packages via
+`apk add --root`. Kustomize manifests per app in `apps/*/kustomize`; the publish
+workflow pins new `sha-*` tags into the prod overlays.
+
+## Rules
+
+- Check the installed version (`package.json`, `bun.lock`) and use the docs for exactly
+  that version, not training knowledge.
+- Superpowers skills (`.agents/plugins/marketplace.json`): `brainstorming` before
+  behavior-changing features, then `writing-plans`; `systematic-debugging` before bug
+  fixes; `test-driven-development` for app code; `requesting-code-review` for larger
+  changes; `verification-before-completion` before claiming done.
+- After every TS/JS change, in the affected app: `bun run lint` (Oxlint, no ESLint),
+  `bun run lint:ts`, and the smallest relevant Vitest run (`bun run vitest run <path>`).
+  Visible web UI changes also need Playwright (`bun run test`) and browser verification;
+  api changes to external interfaces, DB or auth need the affected E2E tests.
+- Touch `bun.lock` only with an intentional dependency change. Fix root causes; new
+  lint-disable comments need a narrow, documented reason.

package/template/Dockerfile.base

@@ -0,0 +1,9 @@
+ARG BUN_VERSION
+
+FROM dhi.io/bun:${BUN_VERSION}-alpine-dev
+ENV PATH="/root/.bun/bin:${PATH}"
+WORKDIR /app
+COPY package.json ./
+RUN --mount=type=cache,id=bun-turbo-install,sharing=locked,target=/root/.bun/install/cache \
+    bun add -g turbo@$(bun -p 'require("./package.json").devDependencies.turbo')
+COPY . .

package/template/README.md

@@ -0,0 +1,54 @@
+# Nexst
+
+Monorepo generated with `create-nexst-monorepo`:
+
+- `apps/web` — Next.js frontend
+- `apps/api` — NestJS backend (REST + GraphQL, Prisma)
+- `apps/worker` — BullMQ worker <!-- @if worker -->
+
+## Getting started
+
+```bash
+cp apps/api/.env.example apps/api/.env.development   # fill in secrets
+cp apps/web/.env.example apps/web/.env
+<!-- @if worker -->
+cp apps/worker/.env.example apps/worker/.env
+<!-- @endif -->
+bun install
+(cd apps/api && bun run db:generate && bunx --bun prisma migrate deploy)
+bun dev
+```
+
+- Web: http://localhost:3000
+- API: http://localhost:3001 (GraphiQL `/graphql`, Swagger `/api`, health `/health`)
+<!-- @if auth -->
+- Mail (MailHog): http://localhost:8025
+
+Google sign-in (button + One Tap) stays hidden until it is configured: create an OAuth
+client (type "Web application") in the Google Cloud console with the redirect URI
+`http://localhost:3001/api/auth/callback/google` and the JavaScript origin
+`http://localhost:3000`, then set `GOOGLE_CLIENT_ID`/`GOOGLE_CLIENT_SECRET` in
+`apps/api/.env.development` and `NEXT_PUBLIC_GOOGLE_CLIENT_ID` in `apps/web/.env`.
+<!-- @endif -->
+
+## Scripts (root, via turbo)
+
+| Script | What it does |
+| --- | --- |
+| `bun dev` | Infra via docker compose + all apps in watch mode |
+| `bun run lint` / `lint:fix` | Oxlint (type-aware) |
+| `bun run fmt` / `fmt:check` | Oxfmt |
+| `bun run lint:ts` | TypeScript (tsgo) |
+| `bun run test:unit` | Vitest in every app |
+| `bun run unused` | knip |
+
+## Deployment
+
+- Images: `docker buildx bake` (targets in `docker-bake.hcl`), pushed to ghcr.io by
+  `.github/workflows/publish.yaml`, which also pins the new tags in
+  `apps/*/kustomize/overlays/prod`.
+- Secrets: `apps/api/scripts/seal-secret.sh` seals the keys listed in
+  `apps/api/kustomize/secret.keys` into a SealedSecret.
+- CI secrets: `DHI_REGISTRY_USERNAME`/`DHI_REGISTRY_PASSWORD` (image builds),
+  optional `SONAR_TOKEN`/`SONAR_HOST_URL`, `SNYK_TOKEN`. Repository variables
+  `NEXT_PUBLIC_API_URL`/`NEXT_PUBLIC_HOST_URL` are baked into the web image.

package/template/_gitignore

@@ -0,0 +1,10 @@
+node_modules/
+.DS_Store
+.turbo/
+*.tsbuildinfo
+coverage/
+dist/
+
+# env
+.env
+.env.development

package/template/apps/api/.env.example

@@ -0,0 +1,32 @@
+# Copy to .env.development (bun loads it automatically in dev) and fill in.
+NODE_ENV=development
+LOG_LEVEL=debug
+PORT=3001
+
+DATABASE_URL=postgresql://nexst_user:test-pw@localhost:5432/nexst_db?schema=nexst_user
+# @if auth
+
+# openssl rand -base64 32
+BETTER_AUTH_SECRET=change-me-change-me-change-me-change-me
+BETTER_AUTH_URL=http://localhost:3001
+# Mail goes to MailHog (http://localhost:8025) outside production.
+MAIL_SMTP_HOST=localhost
+# RESEND_API_KEY=
+# Google sign-in: OAuth client (Web application) from https://console.cloud.google.com/apis/credentials
+# with redirect URI http://localhost:3001/api/auth/callback/google. Disabled while unset.
+# GOOGLE_CLIENT_ID=
+# GOOGLE_CLIENT_SECRET=
+# @endif
+# @if r2
+
+R2_ACCESS_KEY_ID=
+R2_SECRET_ACCESS_KEY=
+R2_BUCKET=nexst
+R2_ENDPOINT=https://<account-id>.r2.cloudflarestorage.com
+# R2_PUBLIC_URL=https://cdn.example.com
+# @endif
+# @if worker
+
+REDIS_HOST=localhost
+REDIS_PORT=6379
+# @endif

package/template/apps/api/AGENTS.md

@@ -0,0 +1,44 @@
+# api (NestJS)
+
+This project uses NestJS 12 with ESM (`"type": "module"` in `package.json`,
+`module`/`moduleResolution: nodenext` in `tsconfig.json`) — not the CommonJS setup most
+NestJS tutorials, examples, and training data assume. Import paths, dynamic `import()`
+usage, decorator/metadata behavior, and module interop can differ under ESM. When in
+doubt, read the official NestJS documentation for the installed version
+(`@nestjs/core` in `package.json`) rather than relying on memory.
+
+## Conventions
+
+- Imports use the `#src/*` / `#tests/*` subpath aliases with a `.js` suffix.
+- Prisma client always from `#src/generated/prisma/client.js` (`bun run db:generate`
+  after schema changes), never `@prisma/client`.
+- Codes-only errors: throw `new AppException(ErrorCode.X, HttpStatus.Y, params?)`
+  (`src/errors/`), never a free-text `HttpException`. `bun run lint:error-codes` and
+  oxlint's `no-restricted-imports` enforce it; add new codes to `error-code.enum.ts`.
+- Loggers: inject `ContextLogger`, not `nestjs-pino` directly.
+- Config: static defaults in `src/config/resources/app.yaml`, secrets/env in
+  `src/config/app.config.ts` (zod-validated at startup).
+- The global `ValidationPipe` runs with `whitelist: true`: every input field needs a
+  class-validator decorator (`@IsOptional()`/`@Allow()` for JSON fields) or it is
+  silently stripped.
+- Auth (if present): every route needs a session unless marked `@AllowAnonymous()`;
+  `@IsEmailVerified()` and `@Roles(...)` are enforced by `src/auth/auth.guard.ts`.
+
+## Local dev
+
+- Schema changes: `bun run db:migrate` (creates a migration) or `bun run db:push`
+  against the local dev Postgres (`DATABASE_URL` from `.env.development`).
+- Swagger UI at `/api`, GraphiQL at `/graphql` when `NODE_ENV=development`.
+
+## Tests
+
+- Unit: `bun run test:unit` (co-located `*.spec.ts`, no services needed).
+- E2E: `bun run test:e2e` against a running API (`API_URL`, default
+  `http://localhost:3001`); start it with `NODE_ENV=test` so sign-up skips mail.
+
+## Docker image testing
+
+Separate path, not the regular dev loop. Build with `docker buildx bake api --load`
+(`api-migrate` for the migrator), then run it against the local infra from `bun dev`
+(env from `.env`, `DATABASE_URL` pointing at `host.docker.internal`) and check
+`/health` plus the container logs.

package/template/apps/api/Dockerfile

@@ -0,0 +1,69 @@
+ARG BUN_VERSION
+
+# ---------------------------------------------------
+# Stage 1: Pruner
+# ---------------------------------------------------
+FROM toolchain AS pruner
+RUN turbo prune @nexst/api --docker
+
+# ---------------------------------------------------
+# Stage 2: Deps
+# ---------------------------------------------------
+FROM dhi.io/bun:${BUN_VERSION}-alpine-dev AS deps
+WORKDIR /app
+COPY --from=pruner /app/out/json/ .
+RUN --mount=type=cache,id=bun-install,sharing=locked,target=/root/.bun/install/cache \
+    bun install --frozen-lockfile --production --omit=peer
+
+# ---------------------------------------------------
+# Stage 3: Prisma
+# ---------------------------------------------------
+FROM dhi.io/bun:${BUN_VERSION}-alpine-dev AS prisma
+WORKDIR /app/apps/api
+RUN --mount=type=bind,from=pruner,source=/app/out/json/bun.lock,target=/tmp/bun.lock \
+    --mount=type=cache,id=bun-install,sharing=locked,target=/root/.bun/install/cache \
+    bun add --omit=peer $(bun -p 'require("/tmp/bun.lock").packages.prisma[0]') && \
+    find node_modules -path '*@prisma/engines/schema-engine-*' -type f | grep -q .
+COPY --from=pruner /app/out/full/apps/api/prisma ./prisma
+COPY --from=pruner /app/out/full/apps/api/prisma.config.ts ./
+
+# ---------------------------------------------------
+# Stage 4: Builder
+# ---------------------------------------------------
+FROM prisma AS builder
+RUN --mount=type=bind,from=pruner,source=/app/out/json/bun.lock,target=/tmp/bun.lock \
+    --mount=type=cache,id=bun-install,sharing=locked,target=/root/.bun/install/cache \
+    bun add --omit=peer $(bun -p 'require("/tmp/bun.lock").packages["@prisma/client"][0]') && \
+    bunx --bun prisma generate
+
+# ---------------------------------------------------
+# Stage 5: Migrator
+# ---------------------------------------------------
+FROM prisma AS migrator
+ENV NODE_ENV=production
+USER nonroot
+CMD ["bunx", "--bun", "prisma", "migrate", "deploy"]
+
+# ---------------------------------------------------
+# Stage 6: Runtime
+# ---------------------------------------------------
+FROM dhi.io/bun:${BUN_VERSION}-alpine AS runtime
+WORKDIR /app
+ENV NODE_ENV=production \
+    PRISMA_AUTO_MIGRATE=false
+
+COPY --from=deps --chown=nonroot:nonroot /app/node_modules ./node_modules
+COPY --from=deps --chown=nonroot:nonroot /app/apps/api/node_modules ./apps/api/node_modules
+# @if worker
+COPY --from=pruner --chown=nonroot:nonroot /app/out/full/packages/queues ./packages/queues
+# @endif
+COPY --from=pruner --chown=nonroot:nonroot /app/out/full/apps/api ./apps/api
+COPY --from=builder --chown=nonroot:nonroot /app/apps/api/src/generated ./apps/api/src/generated
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=15s --retries=3 \
+  CMD ["bun", "-e", "require('http').get('http://localhost:3001/health', (res) => { process.exit(res.statusCode === 200 ? 0 : 1) }).on('error', () => process.exit(1))"]
+
+EXPOSE 3001
+STOPSIGNAL SIGTERM
+WORKDIR /app/apps/api
+CMD ["bun", "src/main.ts"]

package/template/apps/api/_gitignore

@@ -0,0 +1,8 @@
+# tests
+report.html
+
+# prisma
+src/generated
+
+# sealed secrets
+kustomize/sealedsecrets.pem

package/template/apps/api/knip.config.ts

@@ -0,0 +1,22 @@
+import { createKnipConfig } from "@nexst/lint/knip";
+import type { KnipConfig } from "knip";
+
+const config: KnipConfig = createKnipConfig({
+  entry: [
+    "prisma/schema.prisma",
+    "src/main.ts",
+    "scripts/auth.cli.ts", // @if auth
+    // Template building blocks, kept until the first feature uses them.
+    "src/auth/decorator/roles.decorator.ts", // @if auth
+    "src/errors/app-parse-uuid.pipe.ts",
+    "src/utils/pagination.input.ts",
+  ],
+  ignoreBinaries: [
+    "better-auth", // @if auth
+  ],
+  ignoreDependencies: ["@prisma/client-runtime-utils", "@types/js-yaml"],
+  project: ["prisma/**/*.prisma"],
+  vitest: { config: ["vitest.config.ts", "vitest.config.e2e.ts"] },
+});
+
+export default config;

package/template/apps/api/kustomize/base/application.properties

@@ -0,0 +1,16 @@
+NODE_ENV=production
+LOG_LEVEL=info
+PRISMA_AUTO_MIGRATE=false
+# @if auth
+BETTER_AUTH_URL=https://api.example.com
+COOKIE_DOMAIN=.example.com
+# GOOGLE_CLIENT_ID=<id>.apps.googleusercontent.com
+# @endif
+# @if worker
+REDIS_HOST=redis-master
+REDIS_PORT=6379
+# @endif
+# @if r2
+R2_BUCKET=nexst
+R2_ENDPOINT=https://<account-id>.r2.cloudflarestorage.com
+# @endif

package/template/apps/api/kustomize/base/deployment.yaml

@@ -0,0 +1,94 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nexst-api
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nexst-api
+  template:
+    metadata:
+      labels:
+        app: nexst-api
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        fsGroup: 10001
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: ghcr-puller
+      initContainers:
+        - name: db-migrate
+          image: nexst-api-migrate
+          imagePullPolicy: IfNotPresent
+          envFrom:
+            - configMapRef:
+                name: nexst-api-config
+            - secretRef:
+                name: nexst-api-secret
+          resources:
+            requests:
+              memory: 128Mi
+              cpu: 50m
+            limits:
+              memory: 256Mi
+              cpu: 200m
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: false
+            readOnlyRootFilesystem: false
+            capabilities:
+              drop: [ALL]
+            seccompProfile:
+              type: RuntimeDefault
+      containers:
+        - name: nexst-api
+          image: nexst-api
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 3001
+              protocol: TCP
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 10001
+            runAsGroup: 10001
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: [ALL]
+            seccompProfile:
+              type: RuntimeDefault
+          envFrom:
+            - configMapRef:
+                name: nexst-api-config
+            - secretRef:
+                name: nexst-api-secret
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+          resources:
+            requests:
+              memory: 256Mi
+              cpu: 100m
+            limits:
+              memory: 512Mi
+              cpu: 500m
+          livenessProbe:
+            httpGet:
+              path: /health/live
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 5
+      volumes:
+        - name: tmp
+          emptyDir: {}

package/template/apps/api/kustomize/base/kustomization.yaml

@@ -0,0 +1,17 @@
+labels:
+  - pairs:
+      app.kubernetes.io/name: nexst-api
+      app.kubernetes.io/part-of: nexst
+      app.kubernetes.io/managed-by: kustomize
+      app.kubernetes.io/created-by: your-org
+      app.kubernetes.io/component: api
+    includeSelectors: true
+
+resources:
+  - deployment.yaml
+  - service.yaml
+
+configMapGenerator:
+  - name: nexst-api-config
+    envs:
+      - application.properties

package/template/apps/api/kustomize/base/service.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nexst-api
+spec:
+  ports:
+    - name: http
+      port: 80
+      targetPort: 3001
+      protocol: TCP

package/template/apps/api/kustomize/overlays/prod/kustomization.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../base
+  # Generate with scripts/seal-secret.sh, then uncomment.
+  # - sealedsecret.yaml
+
+namespace: nexst
+
+images:
+  - name: nexst-api
+    newName: ghcr.io/your-org/nexst-api
+    newTag: latest
+  - name: nexst-api-migrate
+    newName: ghcr.io/your-org/nexst-api-migrate
+    newTag: latest

package/template/apps/api/kustomize/overlays/staging/application.properties

@@ -0,0 +1 @@
+# Staging overrides for base/application.properties.

package/template/apps/api/kustomize/overlays/staging/kustomization.yaml

@@ -0,0 +1,21 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../base
+
+namespace: nexst-staging
+
+images:
+  - name: nexst-api
+    newName: ghcr.io/your-org/nexst-api
+    newTag: test
+  - name: nexst-api-migrate
+    newName: ghcr.io/your-org/nexst-api-migrate
+    newTag: test
+
+configMapGenerator:
+  - name: nexst-api-config
+    behavior: merge
+    envs:
+      - application.properties