# KoolTap Production Deployment

## Option A: Docker (recommended)

The production setup uses PostgreSQL and configurable secrets.

### 1. Set environment variables

Create `.env` in the project root:

```env
# Database
DB_PASSWORD=<generate-a-strong-password>

# JWT secret — generate with: openssl rand -hex 64
JWT_SECRET=<64-char-hex-string>

# URLs — set your actual domain/port
DASHBOARD_URL=https://dashboard.yourdomain.com
API_URL=https://api.yourdomain.com
DASHBOARD_PORT=3000
API_PORT=3001
```

### 2. Build and start

```bash
docker compose -f docker-compose.prod.yml up --build -d
```

### 3. Create the venue and admin (first time only)

Migrations run automatically when the API container starts.

```bash
docker compose -f docker-compose.prod.yml exec api node prisma/setup.js "My Venue" admin@myvenue.com '<strong password>'
```

`setup.js` does nothing when a venue already exists. `--force` wipes ALL data and starts over.

### 4. Set up a reverse proxy (nginx/Caddy)

Example Caddyfile:
```
dashboard.yourdomain.com {
    reverse_proxy dashboard:3000
}

api.yourdomain.com {
    reverse_proxy api:3001
}
```

---

## Option B: Manual (Node.js + PostgreSQL)

### 1. Install PostgreSQL

Create database and user:
```sql
CREATE DATABASE kooltap;
CREATE USER kooltap WITH PASSWORD 'your-password';
GRANT ALL PRIVILEGES ON DATABASE kooltap TO kooltap;
```

### 2. Configure environment

```env
DATABASE_URL="postgresql://kooltap:your-password@localhost:5432/kooltap"
JWT_SECRET="<random-64-char-string>"
PORT=3001
CORS_ORIGIN="https://dashboard.yourdomain.com"
```

### 3. Build and run

```bash
cd apps/api
pnpm install
npx prisma generate
npx prisma migrate deploy
pnpm build
node dist/main
```

---

## Security Checklist

- [ ] JWT secrets are 64+ random hex characters
- [ ] DB_PASSWORD is strong and unique
- [ ] HTTPS is terminated at reverse proxy
- [ ] CORS_ORIGIN is set to the exact dashboard URL (no wildcard)
- [ ] API is not exposed directly to the internet (reverse proxy only)
- [ ] Rate limiting is configured
- [ ] Audit logs are monitored