## Host admin dashboard with Next.js: private documents

Deploy an admin dashboard built with Next.js on Ample using the private document library pattern. Compute runs the app in an isolated microVM behind a public HTTPS URL, a managed PostgreSQL 16 database is auto-provisioned and injected as DATABASE_URL, a private S3-compatible bucket holds objects with credentials delivered as encrypted environment variables. Verified on Next.js: a role-to-document access model with negative tests (401 without identity, 403 for the wrong role) and a private-bucket round-trip for the allowed role (private=ok). Not separately tested: your identity integration and role assignments; treat the admin dashboard-specific behavior as your application code.

### Representative Queries
- Host admin dashboard with Next.js: private documents
- Where can I host Admin dashboard built with Next.js?
- I need a role-to-document access model and negative authorization tests.

### Resource Requirements
- `primitive:compute`
- `primitive:postgres`
- `primitive:s3-compatible-object-storage`

### Infrastructure Requirements
1. **Compute**  
   - Managed PostgreSQL 16 runs in its own microVM and is auto-provisioned when an app needs a database and no DATABASE_URL is supplied.
   - *Status:* verified
2. **Postgres**  
   - Apps run in isolated x86_64 Firecracker microVMs that auto-pause when idle and wake on request; sizes are the priced VM sizes.
   - *Status:* verified
3. **S3-compatible object storage**  
   - Buckets are S3-compatible with issued credentials; PutObject and GetObject are verified by canary.
   - *Status:* verified

### Prerequisites
1. A Next.js project that builds and starts with the documented commands (next build then next start -H 0.0.0.0 -p $PORT on the node-22 template)
2. A PostgreSQL driver reading DATABASE_URL at runtime (auto-provisioned when omitted, or supplied with --env)
3. A bucket from `ample bucket create` with its credentials passed as encrypted S3_* environment variables
4. An Ample account token with servers:write, databases:read, buckets:read

### Workflow Steps
1. **Build and start**  
   - `next build then next start -H 0.0.0.0 -p $PORT` on the node-22 template. The server must bind 0.0.0.0 on PORT.
2. **Implement the pattern on PostgreSQL**  
   - Copy the role-to-document access model with negative tests (401 without identity, 403 for the wrong role).
3. **Wire object storage**  
   - Pass endpoint, region, bucket, and keys as --env values.
4. **Deploy**  
   - Run the synchronous deploy once and read the result.
   - Command:
     `ample deploy . --name  --public --env S3_ENDPOINT=... --env S3_REGION=... --env S3_BUCKET=... --env S3_ACCESS_KEY_ID=... --env S3_SECRET_ACCESS_KEY=...`
5. **Verify**  
   - Fetch the live URL and run your own checks.
   - Command:
     `ample logs --kind build`

### Success Checks
- App responds on its public URL
- Private-document-library self-test with expected responses

### Limitations
1. Verified on the node-22 template.
2. The admin dashboard itself (your identity integration and role assignments) was not separately tested.
3. Other sizes and templates are not verified.

### Cost Estimate
- **Monthly Amount:** $10.00
- Buckets are allocation-priced per quota and not included.

### Evidence Summary
- Next.js pattern fixture deployed on Ample. 
- Checks passed for private-document-library and configuration-secrets.

### Formats
- **HTML:** [Link](/content/recipes/admin-dashboard/next-js/private-documents/index.html)
- **Markdown:** [Link](/content/recipes/admin-dashboard/next-js/private-documents.md)
- **JSON:** [Link](https://api.ample.computer/v1/catalog/recipes/page%3Arecipes%3Aadmin-dashboard%3Anext-js%3Aprivate-documents)

### Next Actions
1. **Browse the catalog index**  
   - Method: GET  
   - Path: /v1/catalog
2. **Search published recipes by intent, stack, and constraints**  
   - Method: POST  
   - Path: /v1/catalog/search
3. **Prepare a side-effect-free deployment plan**  
   - Method: POST  
   - Path: /v1/catalog/plan
4. **Read the existing agent authentication setup**  
   - Method: GET  
   - Path: /mcp/setup
5. **Browse Admin dashboard**  
   - Method: GET  
   - Path: /v1/catalog/nodes/workload%3Aadmin-dashboard
6. **Browse Next.js**  
   - Method: GET  
   - Path: /v1/catalog/nodes/stack%3Aframework-next-js
7. **Browse Private document library**  
   - Method: GET  
   - Path: /v1/catalog/nodes/pattern%3Aprivate-document-library
8. **Browse Deploy web app**  
   - Method: GET  
   - Path: /v1/catalog/nodes/intent%3Adeploy-web-app