# .env.example - Copy to .env and modify for your domain # Domain Configuration NODE_ENV=production DOMAIN=yourdomain.com PORT=3000 HTTPS_PORT=3443 # Allowed Origins (comma-separated) ALLOWED_ORIGINS=https://yourdomain.com,https://www.yourdomain.com,https://app.yourdomain.com # SSL Certificate Paths (for HTTPS) SSL_CERT_PATH=./ssl/cert.pem SSL_KEY_PATH=./ssl/key.pem # Upload Configuration UPLOAD_DIR=./uploads MAX_FILE_SIZE=10485760 # Security Settings TRUST_PROXY=true SECURE_COOKIES=true # Database (if using) # DATABASE_URL=postgresql://user:password@localhost:5432/fileprocessor # Redis (for session storage) # REDIS_URL=redis://localhost:6379 #---------------------------------------------------------- # .env.development - Development environment NODE_ENV=development DOMAIN=localhost PORT=3000 HTTPS_PORT=3443 ALLOWED_ORIGINS=http://localhost:3000,https://localhost:3443,http://127.0.0.1:3000 SSL_CERT_PATH=./ssl/localhost-cert.pem SSL_KEY_PATH=./ssl/localhost-key.pem UPLOAD_DIR=./uploads MAX_FILE_SIZE=10485760 TRUST_PROXY=false SECURE_COOKIES=false #---------------------------------------------------------- # .env.production - Production environment NODE_ENV=production DOMAIN=yourdomain.com PORT=80 HTTPS_PORT=443 # Production domains ALLOWED_ORIGINS=https://yourdomain.com,https://www.yourdomain.com # Let's Encrypt SSL paths SSL_CERT_PATH=/etc/letsencrypt/live/yourdomain.com/fullchain.pem SSL_KEY_PATH=/etc/letsencrypt/live/yourdomain.com/privkey.pem UPLOAD_DIR=/var/uploads MAX_FILE_SIZE=52428800 TRUST_PROXY=true SECURE_COOKIES=true #---------------------------------------------------------- # Nginx Configuration Example # /etc/nginx/sites-available/fileprocessor server { listen 80; server_name yourdomain.com www.yourdomain.com; # Redirect HTTP to HTTPS return 301 https://$server_name$request_uri; } server { listen 443 ssl http2; server_name yourdomain.com www.yourdomain.com; # SSL Configuration ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers HIGH:!aNULL:!MD5; # Security Headers add_header X-Frame-Options "SAMEORIGIN" always; add_header X-XSS-Protection "1; mode=block" always; add_header X-Content-Type-Options "nosniff" always; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; # File Upload Size client_max_body_size 10M; # Proxy to Node.js app location / { proxy_pass http://localhost:3000; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection 'upgrade'; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_cache_bypass $http_upgrade; proxy_read_timeout 86400; } # Socket.IO WebSocket Support location /socket.io/ { proxy_pass http://localhost:3000; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } #---------------------------------------------------------- # Apache Configuration Example # /etc/apache2/sites-available/fileprocessor.conf ServerName yourdomain.com ServerAlias www.yourdomain.com # Redirect to HTTPS RewriteEngine On RewriteCond %{HTTPS} off RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L] ServerName yourdomain.com ServerAlias www.yourdomain.com # SSL Configuration SSLEngine on SSLCertificateFile /etc/letsencrypt/live/yourdomain.com/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/yourdomain.com/privkey.pem # Security Headers Header always set X-Frame-Options SAMEORIGIN Header always set X-Content-Type-Options nosniff Header always set X-XSS-Protection "1; mode=block" Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" # Proxy Configuration ProxyPreserveHost On ProxyPass / http://localhost:3000/ ProxyPassReverse / http://localhost:3000/ # WebSocket Support RewriteEngine On RewriteCond %{REQUEST_URI} ^/socket.io [NC] RewriteCond %{QUERY_STRING} transport=websocket [NC] RewriteRule ^(.*)$ ws://localhost:3000$1 [P,L] ProxyPass /socket.io/ http://localhost:3000/socket.io/ ProxyPassReverse /socket.io/ http://localhost:3000/socket.io/ #---------------------------------------------------------- # Docker Configuration # Dockerfile FROM node:18-alpine WORKDIR /app # Copy package files COPY package*.json ./ # Install dependencies RUN npm ci --only=production # Copy application files COPY . . # Create uploads directory RUN mkdir -p uploads # Expose ports EXPOSE 3000 3443 # Set environment ENV NODE_ENV=production # Start application CMD ["npm", "start"] #---------------------------------------------------------- # docker-compose.yml version: '3.8' services: fileprocessor: build: . ports: - "3000:3000" - "3443:3443" environment: - NODE_ENV=production - DOMAIN=yourdomain.com - TRUST_PROXY=true volumes: - ./uploads:/app/uploads - ./ssl:/app/ssl:ro restart: unless-stopped depends_on: - redis redis: image: redis:alpine restart: unless-stopped nginx: image: nginx:alpine ports: - "80:80" - "443:443" volumes: - ./nginx.conf:/etc/nginx/nginx.conf:ro - /etc/letsencrypt:/etc/letsencrypt:ro depends_on: - fileprocessor restart: unless-stopped #---------------------------------------------------------- # DNS Configuration Examples # A Record Examples: # yourdomain.com A YOUR_SERVER_IP # www.yourdomain.com A YOUR_SERVER_IP # api.yourdomain.com A YOUR_SERVER_IP # CNAME Examples: # app.yourdomain.com CNAME yourdomain.com # files.yourdomain.com CNAME yourdomain.com #---------------------------------------------------------- # SSL Certificate Generation Scripts # Let's Encrypt with Certbot #!/bin/bash # ssl-setup.sh # Install certbot sudo apt update sudo apt install certbot python3-certbot-nginx # Generate certificate sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com # Auto-renewal setup sudo crontab -e # Add this line: # 0 12 * * * /usr/bin/certbot renew --quiet #---------------------------------------------------------- # Self-signed SSL for Development #!/bin/bash # generate-dev-ssl.sh mkdir -p ssl # Generate private key openssl genrsa -out ssl/localhost-key.pem 2048 # Generate certificate openssl req -new -x509 -key ssl/localhost-key.pem -out ssl/localhost-cert.pem -days 365 \ -subj "/C=US/ST=State/L=City/O=Organization/OU=OrgUnit/CN=localhost" echo "Development SSL certificates generated in ./ssl/" #---------------------------------------------------------- # PM2 Configuration for Production # ecosystem.config.js module.exports = { apps: [{ name: 'fileprocessor', script: 'server.js', instances: 'max', exec_mode: 'cluster', env: { NODE_ENV: 'development', PORT: 3000 }, env_production: { NODE_ENV: 'production', PORT: 3000, DOMAIN: 'yourdomain.com' }, log_file: './logs/combined.log', out_file: './logs/out.log', error_file: './logs/error.log', log_date_format: 'YYYY-MM-DD HH:mm Z' }] }; # Start with PM2 # pm2 start ecosystem.config.js --env production # pm2 save # pm2 startup #---------------------------------------------------------- # Health Check Script #!/bin/bash # health-check.sh DOMAIN="yourdomain.com" PORT="443" echo "Checking $DOMAIN:$PORT..." # Check HTTP/HTTPS response HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://$DOMAIN/health) if [ $HTTP_STATUS -eq 200 ]; then echo "✅ Server is healthy (HTTP $HTTP_STATUS)" else echo "❌ Server error (HTTP $HTTP_STATUS)" exit 1 fi # Check Socket.IO connection if curl -s https://$DOMAIN/socket.io/ | grep -q "socket.io"; then echo "✅ Socket.IO is working" else echo "❌ Socket.IO not accessible" exit 1 fi echo "All checks passed!"