whitlocktech/DebbieWindlerSeamstress
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Harden deployment security

Browse Source
This commit is contained in:
Codex
2026-07-21 12:28:06 -05:00
parent 5c2ac5f7e1
commit 63c3a1b0f8
15 changed files with 286 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
README.md
View File

@@ -46,8 +46,8 @@ If `pnpm` is not installed globally, `npm install` and `npm run dev` also work.
## First Owner Setup
1. Start the site.
2. Open `http://localhost:3000/admin`.
3. The app will redirect to `/admin/setup` until the first owner account is created.
2. Set a private `SETUP_TOKEN` in `.env`.
3. Open `http://localhost:3000/admin/setup?token=YOUR_SETUP_TOKEN`.
4. Enter owner name, email, and a password with at least 10 characters.
5. After setup, future visits to `/admin` use the owner login screen.
@@ -92,6 +92,8 @@ Important values:
- `PORT`: app port, default `3000`.
- `APP_BASE_URL`: final public URL, for example `https://debbiewindlerseamstress.com`.
- `SESSION_SECRET`: long random secret for sessions.
- `SETUP_TOKEN`: private one-time setup token required before the first owner account can be created.
- `TRUST_PROXY`: use `loopback` for a local reverse proxy; avoid broad proxy trust unless the proxy is configured to strip client-supplied forwarding headers.
- `DATABASE_PATH`: SQLite file path.
- `UPLOAD_DIR`: uploaded image folder.
- `BACKUP_DIR`: backup output folder.
@@ -123,7 +125,8 @@ Recommended production shape:
2. Put a reverse proxy such as Caddy, Nginx, or IIS ARR in front of it.
3. Configure TLS for `debbiewindlerseamstress.com`.
4. Later, redirect `debbiewindler.com` to `debbiewindlerseamstress.com`.
5. Set `NODE_ENV=production`, `APP_BASE_URL`, `SESSION_SECRET`, SMTP values, and owner email in `.env`.
5. Set `NODE_ENV=production`, `APP_BASE_URL`, `SESSION_SECRET`, `SETUP_TOKEN`, `TRUST_PROXY`, SMTP values, and owner email in `.env`.
6. Create the first owner account using `/admin/setup?token=YOUR_SETUP_TOKEN`.
This project does not make DNS, router, firewall, reverse proxy, or live production changes.
@@ -185,6 +188,7 @@ Manual checklist before going live:
## Security Checklist
- Set a long `SESSION_SECRET`.
- Set a private `SETUP_TOKEN` before first boot in production.
- Use HTTPS in production.
- Keep `.env` private.
- Use a strong owner password.