97 lines
2.0 KiB
Markdown
97 lines
2.0 KiB
Markdown
# KoolTap Production Deployment
|
|
|
|
## Option A: Docker (recommended)
|
|
|
|
The production setup uses PostgreSQL and configurable secrets.
|
|
|
|
### 1. Set environment variables
|
|
|
|
Create `.env` in the project root:
|
|
|
|
```env
|
|
# Database
|
|
DB_PASSWORD=<generate-a-strong-password>
|
|
|
|
# JWT secret — generate with: openssl rand -hex 64
|
|
JWT_SECRET=<64-char-hex-string>
|
|
|
|
# URLs — set your actual domain/port
|
|
DASHBOARD_URL=https://dashboard.yourdomain.com
|
|
API_URL=https://api.yourdomain.com
|
|
DASHBOARD_PORT=3000
|
|
API_PORT=3001
|
|
```
|
|
|
|
### 2. Build and start
|
|
|
|
```bash
|
|
docker compose -f docker-compose.prod.yml up --build -d
|
|
```
|
|
|
|
### 3. Create the venue and admin (first time only)
|
|
|
|
Migrations run automatically when the API container starts.
|
|
|
|
```bash
|
|
docker compose -f docker-compose.prod.yml exec api node prisma/setup.js "My Venue" admin@myvenue.com '<strong password>'
|
|
```
|
|
|
|
`setup.js` does nothing when a venue already exists. `--force` wipes ALL data and starts over.
|
|
|
|
### 4. Set up a reverse proxy (nginx/Caddy)
|
|
|
|
Example Caddyfile:
|
|
```
|
|
dashboard.yourdomain.com {
|
|
reverse_proxy dashboard:3000
|
|
}
|
|
|
|
api.yourdomain.com {
|
|
reverse_proxy api:3001
|
|
}
|
|
```
|
|
|
|
---
|
|
|
|
## Option B: Manual (Node.js + PostgreSQL)
|
|
|
|
### 1. Install PostgreSQL
|
|
|
|
Create database and user:
|
|
```sql
|
|
CREATE DATABASE kooltap;
|
|
CREATE USER kooltap WITH PASSWORD 'your-password';
|
|
GRANT ALL PRIVILEGES ON DATABASE kooltap TO kooltap;
|
|
```
|
|
|
|
### 2. Configure environment
|
|
|
|
```env
|
|
DATABASE_URL="postgresql://kooltap:your-password@localhost:5432/kooltap"
|
|
JWT_SECRET="<random-64-char-string>"
|
|
PORT=3001
|
|
CORS_ORIGIN="https://dashboard.yourdomain.com"
|
|
```
|
|
|
|
### 3. Build and run
|
|
|
|
```bash
|
|
cd apps/api
|
|
pnpm install
|
|
npx prisma generate
|
|
npx prisma migrate deploy
|
|
pnpm build
|
|
node dist/main
|
|
```
|
|
|
|
---
|
|
|
|
## Security Checklist
|
|
|
|
- [ ] JWT secrets are 64+ random hex characters
|
|
- [ ] DB_PASSWORD is strong and unique
|
|
- [ ] HTTPS is terminated at reverse proxy
|
|
- [ ] CORS_ORIGIN is set to the exact dashboard URL (no wildcard)
|
|
- [ ] API is not exposed directly to the internet (reverse proxy only)
|
|
- [ ] Rate limiting is configured
|
|
- [ ] Audit logs are monitored |