# Production Notes

## Build

Frontend:

```sh
cd cshare-app
npm ci
npm run check
```

`npm run build` also creates `.gz` and `.br` siblings for compressible files in `dist/`.

Backend:

```sh
cd backend
npm ci
npm run check
NODE_ENV=production npm start
```

## Required Environment

Set these before starting the backend in production:

```sh
NODE_ENV=production
PORT=4001
FRONTEND_URL=https://cshare.app
PUBLIC_APP_URL=https://cshare.app
JWT_ACCESS_SECRET=<64+ random chars>
JWT_REFRESH_SECRET=<64+ random chars>
ADMIN_API_KEY=<64+ random chars>
PREVIEW_MAX_FILE_SIZE_BYTES=25000000
DATA_DIR=/var/lib/cshare
```

Set `VITE_API_BASE_URL` for the frontend only when the API is not served from the same origin. If omitted in production, the frontend calls `window.location.origin`, which works with an Nginx reverse proxy that forwards `/api` to the backend.

## Runtime

- Serve `cshare-app/dist/` with Nginx or another static host.
- Cache hashed files under `/assets/` aggressively.
- Serve precompressed `.br` first and `.gz` second when the client supports them.
- Do not cache `/index.html`; it must be revalidated so deploys pick up new asset hashes.
- Proxy `/api`, `/health`, and file download routes to the backend.
- Keep `backend/data/` outside the repo and backed up if using the local disk adapter.
- Protect every `/api/admin/*` request with `x-admin-key: $ADMIN_API_KEY`.
- Small safe file previews are served from `/api/v1/links/:linkId/preview`; files over `PREVIEW_MAX_FILE_SIZE_BYTES` remain download-only.
- The admin API is disabled unless `ADMIN_API_KEY` is set.

Example Nginx compression settings:

```nginx
brotli on;
brotli_static on;
gzip on;
gzip_static on;
gzip_types text/css application/javascript application/json image/svg+xml;
```

`brotli_static` requires an Nginx build with the Brotli module. If that module is unavailable, keep `gzip_static on` and serve the generated `.gz` files.

The current backend is production-shaped but still uses local JSON and disk storage. For durable production use, replace it with the PostgreSQL, Redis, and R2 adapters described in `CONTINUE.md`.