e2b10387c2
Implemented comprehensive beta testing system with tier badges and
reorganized environment configuration for better maintainability.
Beta Testing Features:
- Beta banner component with dismissible state (localStorage)
- Auto-assign SUPPORTER tier to new registrations (env controlled)
- TierBadge component with SUPPORTER/COMFORT tier display
- Badge shown in Navbar, ProfilePage, and PublicProfilePage
- Environment variables: VITE_BETA_MODE, BETA_AUTO_SUPPORTER
Environment Configuration Reorganization:
- Moved .env files from root to frontend/ and backend/ directories
- Created .env.{development,production}{,.example} structure
- Updated docker-compose.yml to use env_file for frontend
- All env vars properly namespaced and documented
Privacy Policy Implementation:
- New /privacy route with dedicated PrivacyPage component
- Comprehensive GDPR/RODO compliant privacy policy (privacy.html)
- Updated CookieConsent banner to link to /privacy
- Added Privacy Policy links to all footers (HomePage, PublicFooter)
- Removed privacy section from About Us page
HTML Content System:
- Replaced react-markdown dependency with simple HTML loader
- New HtmlContentPage component for rendering .html files
- Converted about-us.md and how-it-works.md to .html format
- Inline CSS support for full styling control
- Easier content editing without React knowledge
Backend Changes:
- Registration auto-assigns SUPPORTER tier when BETA_AUTO_SUPPORTER=true
- Added accountTier to auth middleware and user routes
- Updated public profile endpoint to include accountTier
Files:
- Added: frontend/.env.{development,production}{,.example}
- Added: backend/.env variables for BETA_AUTO_SUPPORTER
- Added: components/BetaBanner.jsx, TierBadge.jsx, HtmlContentPage.jsx
- Added: pages/PrivacyPage.jsx
- Added: public/content/{about-us,how-it-works,privacy}.html
- Modified: docker-compose.yml (env_file configuration)
- Modified: App.jsx (privacy route, beta banner)
- Modified: auth.js (auto SUPPORTER tier logic)
74 lines
1.9 KiB
Plaintext
74 lines
1.9 KiB
Plaintext
# Server
|
|
NODE_ENV=production
|
|
PORT=3000
|
|
|
|
# CORS
|
|
CORS_ORIGIN=http://localhost
|
|
|
|
# Database (production)
|
|
DATABASE_URL=postgresql://spotlightcam:spotlightcam123@db-prod:5432/spotlightcam?schema=public
|
|
|
|
# JWT (CHANGE THESE IN PRODUCTION!)
|
|
JWT_SECRET=production-secret-key-CHANGE-THIS-IN-REAL-PRODUCTION
|
|
JWT_EXPIRES_IN=24h
|
|
|
|
# AWS SES (REPLACE WITH YOUR CREDENTIALS)
|
|
AWS_REGION=eu-central-1
|
|
AWS_ACCESS_KEY_ID=your-aws-access-key-id
|
|
AWS_SECRET_ACCESS_KEY=your-aws-secret-access-key
|
|
SES_FROM_EMAIL=noreply@spotlight.cam
|
|
SES_FROM_NAME=spotlight.cam
|
|
|
|
# Email Settings
|
|
FRONTEND_URL=http://localhost
|
|
VERIFICATION_TOKEN_EXPIRY=24h
|
|
|
|
# Security - Rate Limiting
|
|
RATE_LIMIT_ENABLED=true
|
|
RATE_LIMIT_WINDOW_MS=900000
|
|
RATE_LIMIT_MAX=100
|
|
RATE_LIMIT_AUTH_MAX=5
|
|
RATE_LIMIT_EMAIL_MAX=3
|
|
|
|
# Security - CSRF Protection
|
|
ENABLE_CSRF=true
|
|
|
|
# Security - Body Size Limits
|
|
BODY_SIZE_LIMIT=10kb
|
|
|
|
# Security - Password Policy
|
|
PASSWORD_MIN_LENGTH=8
|
|
PASSWORD_REQUIRE_UPPERCASE=true
|
|
PASSWORD_REQUIRE_LOWERCASE=true
|
|
PASSWORD_REQUIRE_NUMBER=true
|
|
PASSWORD_REQUIRE_SPECIAL=false
|
|
|
|
# Security - Account Lockout
|
|
ENABLE_ACCOUNT_LOCKOUT=true
|
|
MAX_LOGIN_ATTEMPTS=5
|
|
LOCKOUT_DURATION_MINUTES=15
|
|
|
|
# Logging
|
|
LOG_LEVEL=warn
|
|
|
|
# Scheduler
|
|
# Enable simple in-process scheduler for auto-matching (enable on exactly one replica)
|
|
ENABLE_SCHEDULER=false
|
|
# Global tick interval in seconds (e.g., 300 = 5min)
|
|
SCHEDULER_INTERVAL_SEC=300
|
|
# Per-event minimum time between runs in seconds to avoid thrashing
|
|
MATCHING_MIN_INTERVAL_SEC=120
|
|
|
|
# Cloudflare Turnstile (CAPTCHA)
|
|
# Get your secret key from: https://dash.cloudflare.com/
|
|
TURNSTILE_SECRET_KEY=your-production-secret-key-here
|
|
|
|
# Cloudflare TURN/STUN
|
|
# Get your credentials from: https://dash.cloudflare.com/ -> Calls -> TURN
|
|
CLOUDFLARE_TURN_TOKEN_ID=your-production-turn-token-id-here
|
|
CLOUDFLARE_TURN_API_TOKEN=your-production-turn-api-token-here
|
|
|
|
# Beta Testing
|
|
# Auto-assign SUPPORTER tier to new registrations during beta
|
|
BETA_AUTO_SUPPORTER=false
|