Can't deploy a v2 Medusa app on DigitalOcean

[vetaliieng]

Hey! When I try to deploy the server app on DigitalOcean, I receive such errors:

[2025-08-21 11:30:25] {"level":"warn","message":"Pg connection failed to connect to the database. Retrying...\n{\"code\":\"SELF_SIGNED_CERT_IN_CHAIN\"}","timestamp":"2025-08-21 11:30:25"}
<img width="614" height="754" alt="Untitled" src="https://github.com/user-attachments/assets/0c77be6b-1d30-4be6-b16a-0158fe5b33f2" />
[2025-08-21 11:30:26] {"level":"error","message":"self-signed certificate in certificate chain","stack":[{"columnNumber":34,"fileName":"node:_tls_wrap","functionName":"TLSSocket.onConnectSecure","lineNumber":1631,"methodName":"onConnectSecure","native":false,"typeName":"TLSSocket"},{"columnNumber":28,"fileName":"node:events","functionName":"TLSSocket.emit","lineNumber":507,"methodName":"emit","native":false,"typeName":"TLSSocket"},{"columnNumber":12,"fileName":"node:domain","functionName":"TLSSocket.emit","lineNumber":489,"methodName":"emit","native":false,"typeName":"TLSSocket"},{"columnNumber":8,"fileName":"node:_tls_wrap","functionName":"TLSSocket._finishInit","lineNumber":1077,"methodName":"_finishInit","native":false,"typeName":"TLSSocket"},{"columnNumber":12,"fileName":"node:_tls_wrap","functionName":"TLSWrap.ssl.onhandshakedone","lineNumber":863,"methodName":"onhandshakedone","native":false,"typeName":"TLSWrap.ssl"}],"timestamp":"2025-08-21 11:30:26"}

So to be precise, the error is "self-signed certificate in certificate". I tried to specify a custom CA certificate value in the medusa-config file, which DO provides. Tried both CA_CERT and DATABASE_CA_CERT variable names, but it didn't work.

My medusa-config file contents:

module.exports = defineConfig({
  projectConfig: {
    databaseUrl: process.env.DATABASE_URL,
    databaseDriverOptions: {
      connection: {
        ssl: {
          ca: process.env.DATABASE_CA_CERT,
        },
      },
    },
    redisUrl: process.env.REDIS_URL,
    workerMode: process.env.MEDUSA_WORKER_MODE as
      | 'shared'
      | 'worker'
      | 'server',
    http: {
      storeCors: process.env.STORE_CORS!,
      adminCors: process.env.ADMIN_CORS!,
      authCors: process.env.AUTH_CORS!,
      jwtSecret: process.env.JWT_SECRET || 'supersecret',
      cookieSecret: process.env.COOKIE_SECRET || 'supersecret',
    },
  },
  admin: {
    disable: process.env.DISABLE_MEDUSA_ADMIN === 'true',
  },
  modules: [
    {
      resolve: './src/modules/marketplace',
    },
    {
      resolve: '@medusajs/medusa/cache-redis',
      options: {
        redisUrl: process.env.REDIS_URL,
      },
    },
    {
      resolve: '@medusajs/medusa/event-bus-redis',
      options: {
        redisUrl: process.env.REDIS_URL,
      },
    },
    {
      resolve: '@medusajs/medusa/workflow-engine-redis',
      options: {
        redis: {
          url: process.env.REDIS_URL,
        },
      },
    },
  ],
})

For now, I'm using a command from the screenshot to run the app, but it stops installing packages at some point, and I receive a health check error:

[2025-08-22 06:49:09] npm warn deprecated @oclif/config@1.18.16: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
[2025-08-22 06:49:09] npm warn deprecated @oclif/config@1.18.2: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
[2025-08-22 06:49:59] ERROR failed health checks after 13 attempts with error Readiness probe failed: dial tcp 10.244.5.227:9000: connect: connection refused
[2025-08-22 06:49:59] ERROR failed health checks after 13 attempts with error Readiness probe failed: dial tcp 10.244.5.186:9000: connect: connection refused

My app has only 1GB of RAM on Digital Ocean, could this be a reason? What am I doing wrong? Seems like I follow every step of the general deployment instructions from the docs, but no result so far.

Env vars set up:

Start command:

[boshido]

Same here I've tested almost all possible choices for me still no work
even with NODE_TLS_REJECT_UNAUTHORIZED="0" still no work
here is spec.yml and medusa-config.ts that I have

spec.yml

region: sgp1

services:
  # 1. Medusa Backend - API Server Component
  - name: backend-server
    git:
      repo_clone_url: https://github.com/AAA/medusajs-poc
      branch: main
    source_dir: ./backend
    routes:
      - path: /api
    build_command: yarn install && yarn run build
    run_command: yarn run predeploy&& yarn start
    http_port: 3000
    health_check:
      http_path: /health
    envs:
      - key: MEDUSA_WORKER_MODE
        value: "server"
      - key: NODE_ENV
        value: "production"
      - key: JWT_SECRET
        type: SECRET
      - key: COOKIE_SECRET
        type: SECRET
      - key: NODE_TLS_REJECT_UNAUTHORIZED
        value: "0"
      # These values must match the new unique database names below
      - key: DATABASE_URL
        value: ${medusa-db.DATABASE_URL}
      - key: DATABASE_SSL_ENABLED
        value: "true"
      - key: REDIS_URL
        value: ${medusa-redis.REDIS_URL}


# Define the required databases
databases:
  # 4. PostgreSQL Database
  # This name is now unique and will be used for the dev database.
  - name: medusa-db
    engine: PG
    production: false
    version: "14"

  # 5. Redis Database
  # This name is now unique and will be used for the production cluster name.
  - name: medusa-redis
    cluster_name: medusajs-poc-redis-staging
    engine: REDIS
    production: true
    version: "8"

medusa-config.ts

import { defineConfig, loadEnv } from "@medusajs/framework/utils"

loadEnv(process.env.NODE_ENV || "development", process.cwd())

// Fixed SSL configuration using DigitalOcean's injected CA certificate
const databaseDriverOptions = process.env.DATABASE_SSL_ENABLED === 'true' ? {
  connection: {
    ssl: {
      rejectUnauthorized: true,
      ca: process.env.DATABASE_CA_CERT,
      checkServerIdentity: () => undefined, // Skip hostname verification
    }
  }
} : {}

const redisModules = [
   {
      resolve: "@medusajs/medusa/cache-redis",
      options: {
        redisUrl: process.env.REDIS_URL,
      },
    },
    {
      resolve: "@medusajs/medusa/event-bus-redis",
      options: {
        redisUrl: process.env.REDIS_URL,
      },
    },
    {
      resolve: "@medusajs/medusa/workflow-engine-redis",
      options: {
        redis: {
          url: process.env.REDIS_URL,
        },
      },
    },
    {
      resolve: "@medusajs/medusa/locking",
      options: {
        providers: [
          {
            resolve: "@medusajs/medusa/locking-redis",
            id: "locking-redis",
            is_default: true,
            options: {
              redisUrl: process.env.REDIS_URL,
            },
          },
        ],
      },
    },
]

export default defineConfig({
  projectConfig: {
    databaseUrl: process.env.DATABASE_URL,
    databaseDriverOptions: databaseDriverOptions,
    // --- CHANGE: Conditionally set the Redis URL ---
    redisUrl: process.env.NODE_ENV === "production" ? process.env.REDIS_URL : undefined,
    http: {
      storeCors: process.env.STORE_CORS || "http://localhost:8000",
      adminCors: process.env.ADMIN_CORS || "http://localhost:7001",
      authCors: process.env.AUTH_CORS || "http://localhost:7001",
      jwtSecret: process.env.JWT_SECRET || "supersecret",
      cookieSecret: process.env.COOKIE_SECRET || "supersecret",
    },
    workerMode: "server",
  },
  admin: {
    disable: true,
  },
  modules: [
    // --- CHANGE: Conditionally include Redis modules ---
    ...(process.env.NODE_ENV === "production" ? redisModules : []),
  ],
})