ahmadteeb/zauxoflix-backend repository overview

services:
  db:
    container_name: postgres
    image: postgres:17-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: zauxoflix
      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:-zauxoflix}"
      POSTGRES_DB: zauxoflix
    # Deliberately NOT published to the host: the database holds IPTV
    # credentials and password hashes, and only the backend needs to reach it
    # over the compose network. Use `docker compose exec db psql` for admin.
    volumes:
      - db_data:/var/lib/postgresql/data
    networks:
      net:
        ipv4_address: 172.30.0.3
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U zauxoflix -d zauxoflix"]
      interval: 5s
      timeout: 5s
      retries: 10

  backend:
    image: ahmadteeb/zauxoflix-backend:latest
    container_name: zauxoflix
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    environment:
      # Inside the compose network the database host is `db`, not localhost.
      DATABASE_URL: "postgresql://zauxoflix:${POSTGRES_PASSWORD:-zauxoflix}@db:5432/zauxoflix?schema=public"
      ADMIN_EMAIL: "${ADMIN_EMAIL:[email protected]}"
      # No default: the seed refuses to create an admin with a known password.
      ADMIN_PASSWORD: "${ADMIN_PASSWORD:?set ADMIN_PASSWORD in the environment}"
      JWT_SECRET: "${JWT_SECRET:?set JWT_SECRET in the environment}"
      ACCESS_TOKEN_TTL_SECONDS: "${ACCESS_TOKEN_TTL_SECONDS:-900}"
      REFRESH_TOKEN_TTL_DAYS: "${REFRESH_TOKEN_TTL_DAYS:-90}"
      LICENSE_PUBLIC_KEY: "${LICENSE_PUBLIC_KEY:?set LICENSE_PUBLIC_KEY in the environment}"
      # Fingerprint the host, not the container, so the license binds to the box.
      MACHINE_ID_PATH: "/etc/host-machine-id"
      # Uploaded app binaries served by the public landing page live on a volume.
      RELEASES_DIR: "/data/releases"
      NODE_ENV: production
    volumes:
      - ${MACHINE_ID_PATH}:/etc/host-machine-id:ro
      - releases_data:/data/releases
    networks:
      net:
        ipv4_address: 172.30.0.2

volumes:
  # Back up with: docker compose exec db pg_dump -U zauxoflix zauxoflix > backup.sql
  db_data:
    name: zauxoflix-db-data
  # Uploaded app builds. Survives container rebuilds; back up by copying it out.
  releases_data:
    name: zauxoflix-releases-data

networks:
  net:
    name: zauxoflix-network
    driver: bridge
    ipam:
      config:
        - subnet: 172.30.0.0/29
          gateway: 172.30.0.1

# Copy to .env for local/host development.
# Docker Compose overrides DATABASE_URL to use host `db` (see docker-compose.yml).
# Under compose the database is NOT published to the host; POSTGRES_PASSWORD is
# required and must be strong: `openssl rand -base64 24`.
POSTGRES_PASSWORD="change-me"
DATABASE_URL="postgresql://zauxoflix:${POSTGRES_PASSWORD}@localhost:5432/zauxoflix?schema=public"

# Seed admin (created by `npm run db:seed`). ADMIN_PASSWORD has no default —
# the seed refuses to run without one. Pick something strong.
ADMIN_EMAIL="[email protected]"
ADMIN_PASSWORD=""

# Auth. Generate a strong secret for production: `openssl rand -base64 48`.
JWT_SECRET="change-me"

# Encrypts stored IPTV source passwords. Independent of JWT_SECRET so token
# signing can be rotated safely. Generate: openssl rand -base64 32
# When unset, the key is derived from JWT_SECRET (legacy behaviour) and
# rotating JWT_SECRET makes every stored IPTV password undecryptable.
SOURCE_ENCRYPTION_KEY=""

ACCESS_TOKEN_TTL_SECONDS="900"
REFRESH_TOKEN_TTL_DAYS="90"

# License gate (node-locked activation).
# Public key generated by vendor (base64 SPKI DER).
LICENSE_PUBLIC_KEY=""
# Path to the host machine-id used as the fingerprint source.
MACHINE_ID_PATH="/etc/machine-id"

# SMTP (optional). When SMTP_HOST is unset, self-service "forgot password"
# email is disabled and users must get reset codes from the admin. It also
# gates the license-expiry notifications below.
SMTP_HOST=""
SMTP_PORT="587"
# "true" for implicit TLS (port 465 implies it automatically).
SMTP_SECURE="false"
SMTP_USER=""
SMTP_PASS=""
SMTP_FROM="Zauxoflix <[email protected]>"

# Days before expiry to start emailing admins a renewal warning (requires SMTP).
LICENSE_EXPIRY_WARN_DAYS="14"

docker compose up -d

sudo apt update
sudo apt install -y nginx certbot python3-certbot-nginx

server {
    listen 80;
    listen [::]:80;
    server_name zauxoflix.yourdomain.com;

    # Must match MAX_RELEASE_BYTES in the backend (2 GiB) for app-binary uploads.
    client_max_body_size 2g;

    location / {
        proxy_pass http://172.30.0.2:3000;
        proxy_http_version 1.1;

        proxy_set_header Host $host;
        # X-Real-IP is assigned (not appended) so clients cannot spoof it.
        # The backend rate-limiter keys on this header.
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Required for Server-Sent Events (live sync / watch progress).
        proxy_set_header Connection "";
        proxy_buffering off;
        proxy_cache off;
        proxy_request_buffering off;
        proxy_read_timeout 1d;
        proxy_send_timeout 1d;
        chunked_transfer_encoding on;
        add_header X-Accel-Buffering no;
    }
}

sudo ln -s /etc/nginx/sites-available/zauxoflix /etc/nginx/sites-enabled/zauxoflix
sudo nginx -t                    # must print "syntax is ok"
sudo systemctl reload nginx

sudo certbot --nginx -d zauxoflix.yourdomain.com

curl -sI https://zauxoflix.yourdomain.com/api/healthz
# Expected: HTTP/2 200