testing 127.0.0.1 issue

Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>

.env-development

@@ -0,0 +1,98 @@
+# ═══════════════════════════════════════════════════════════════════════════════
+#  $APP_NAME — Environment Variables Template (LOCAL DEVELOPMENT)
+#  Copy to .env and fill in the CHANGE_ME values before running `npm run dev`.
+#
+#  Local development setup:
+#    1. cp .env-development .env
+#    2. Fill in every CHANGE_ME value below
+#    3. npm install
+#    4. npm run dev        (nodemon, auto-restarts on file change)
+#
+#  For a production / self-hosted deployment (Docker Compose, Redis, TLS),
+#  use .env-production instead — see docker-compose.yml.
+#
+#  Generate random secrets with:
+#    node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+# ═══════════════════════════════════════════════════════════════════════════════
+
+# ── App ───────────────────────────────────────────────────────────────────────
+APP_NAME=starr
+NODE_ENV=development
+ORIGIN_GUARD_DISABLED=true   # allows Postman/curl in dev; hard-locked false when NODE_ENV=production
+PORT=3024
+APP_URL=http://localhost:3024
+APP_LOGO_URL=https://your-cdn.com/logo.png
+FRONTEND_URL=http://localhost:5173
+
+# ── Database (PostgreSQL) ─────────────────────────────────────────────────────
+#  Local Postgres install — no SSL needed.
+DB_HOST=127.0.0.1
+DB_PORT=5432
+DB_NAME=CHANGE_ME
+DB_USER=CHANGE_ME
+DB_PASSWORD=CHANGE_ME
+DB_SSL=false
+DB_FORCE_SYNC=false   # never drop tables — even in dev, unless you mean it
+
+# ── Cache driver ──────────────────────────────────────────────────────────────
+#  memory → no Redis/Valkey needed. Safe default for a single local process.
+#  Rate limit counters and CSRF sessions reset on restart — fine for dev.
+CACHE_DRIVER=memory
+
+# ── JWT ───────────────────────────────────────────────────────────────────────
+#  Generate each secret independently — never reuse across fields.
+JWT_SECRET=CHANGE_ME_32_BYTE_HEX
+MEDIA_JWT_SECRET=CHANGE_ME_32_BYTE_HEX
+JWT_EXPIRES_IN=15m
+JWT_REFRESH_SECRET=CHANGE_ME_32_BYTE_HEX
+JWT_REFRESH_EXPIRES_IN=7d
+
+# ── CSRF & Cookies ────────────────────────────────────────────────────────────
+SESSION_SECRET=CHANGE_ME_32_BYTE_HEX
+
+# ── Google OAuth ──────────────────────────────────────────────────────────────
+#  console.cloud.google.com → Credentials → OAuth 2.0 Client ID
+#  Add http://localhost:3024/api/auth/google/callback to Authorized redirect URIs
+GOOGLE_CLIENT_ID=CHANGE_ME
+GOOGLE_CLIENT_SECRET=CHANGE_ME
+GOOGLE_CALLBACK_URL=http://localhost:3024/api/auth/google/callback
+
+# ── PayPal ────────────────────────────────────────────────────────────────────
+#  Use Sandbox credentials for local testing: developer.paypal.com → Sandbox tab.
+PAYPAL_CLIENT_ID=CHANGE_ME
+PAYPAL_CLIENT_SECRET=CHANGE_ME
+PAYPAL_ENV=sandbox
+
+# ── Email (SMTP) ──────────────────────────────────────────────────────────────
+#  Gmail: enable 2FA → generate an App Password at myaccount.google.com/apppasswords
+SMTP_HOST=smtp.gmail.com
+SMTP_PORT=587
+SMTP_USER=CHANGE_ME@gmail.com
+SMTP_PASS=CHANGE_ME_APP_PASSWORD
+EMAIL_FROM=CHANGE_ME@gmail.com
+
+OTP_EXPIRY_MINUTES=10
+
+# ── S3-compatible Storage (Garage, run locally — bare-metal) ─────────────────
+#  Run Garage directly on your machine (the docker-compose.yml Garage service
+#  is set up for the production stack). See:
+#  https://garagehq.deuxfleurs.fr/documentation/quick-start/
+S3_ENDPOINT=http://127.0.0.1:3900
+S3_REGION=garage
+S3_ACCESS_KEY=CHANGE_ME
+S3_SECRET_KEY=CHANGE_ME
+S3_BUCKET=CHANGE_ME
+S3_PUBLIC_URL=http://127.0.0.1:3900
+
+# ── Chibisafe (optional — used alongside S3 for some asset types) ────────────
+CHIBISAFE_BASE_URL=CHANGE_ME
+CHIBISAFE_API_KEY=CHANGE_ME
+CHIBISAFE_ALBUM_AVATARS=CHANGE_ME_UUID
+CHIBISAFE_ALBUM_IMAGES=CHANGE_ME_UUID
+CHIBISAFE_ALBUM_VIDEOS=CHANGE_ME_UUID
+CHIBISAFE_ALBUM_THUMBNAILS=CHANGE_ME_UUID
+CHIBISAFE_ALBUM_DOCUMENTS=CHANGE_ME_UUID
+CHIBISAFE_ALBUM_ARCHIVED=CHANGE_ME_UUID
+
+# ── CORS ──────────────────────────────────────────────────────────────────────
+ALLOWED_ORIGINS=http://localhost:5173,http://localhost:3024

.env-production

@@ -1,13 +1,16 @@
 # ═══════════════════════════════════════════════════════════════════════════════
-#  $APP_NAME — Environment Variables Template
+#  $APP_NAME — Environment Variables Template (PRODUCTION / SELF-HOSTED)
 #  Copy to .env and fill in all CHANGE_ME values before deploying.
 #
 #  Self-hosted setup (recommended):
-#    1. cp .env.example .env
+#    1. cp .env-production .env
 #    2. Fill in every CHANGE_ME value below
-#    3. npm install
-#    4. npm start          (or: pm2 start server.js --name $APP_NAME)
-#    5. Point Nginx to PORT (see nginx.conf.example)
+#    3. docker compose up -d      (see docker-compose.yml)
+#       — or, without Docker: npm install && npm start
+#          (or: pm2 start server.js --name $APP_NAME, with Nginx in front)
+#
+#  For local development, use .env-development instead (memory cache, no
+#  Docker/Redis/TLS required).
 #
 #  Generate random secrets with:
 #    node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"

.gitignore

@@ -5,7 +5,8 @@ node_modules/
 .env
 .env.local
 .env.*.local
-# Keep .env.example — it is safe and documents required variables
+# Keep .env-development and .env-production — they are safe templates
+# that document required variables (no real secrets, only CHANGE_ME placeholders)
 
 # ── SSL / TLS / Keys ──────────────────────────────────────────────────────────
 *.pem

README.md

@@ -81,7 +81,8 @@
 new_starr/
 ├── server.js                        ← App entry point
 ├── package.json
-├── .env.example                     ← Copy to .env and fill values
+├── .env-development                 ← Local dev template — copy to .env
+├── .env-production                  ← Self-hosted/Docker template — copy to .env
 │
 ├── config/
 │   ├── db.config.js                 ← Sequelize PostgreSQL instance
@@ -142,8 +143,9 @@ cd star-auth-system
 npm install
 
 # 3. Configure environment
-cp .env.example .env
+cp .env-development .env
 # Edit .env with your DB, SMTP, Google OAuth, and JWT credentials
+# (For a production/self-hosted deploy, use .env-production instead — see docker-compose.yml)
 
 # 4. Ensure PostgreSQL is running and the DB exists
 createdb star_db

docker-compose.yml

@@ -2,7 +2,7 @@
 #  $APP_NAME — Docker Compose (self-hosted)
 #
 #  Prerequisites:
-#    1. Backend  → cp .env.example .env  and fill in all CHANGE_ME values
+#    1. Backend  → cp .env-production .env  and fill in all CHANGE_ME values
 #    2. Frontend → cd ../new_starr_app && cp .env.example .env → fill in values
 #                  → npm run build   (must run BEFORE building the Docker image)
 #    3. Run: docker compose up -d

server.js

@@ -12,7 +12,7 @@
  * Date Modified: Jun. 17, 2026
  ***********************************************************************************************************************************************************************
  * HOW TO RUN:
- *   1. cp .env.example .env   (fill in your values)
+ *   1. cp .env-development .env   (or .env-production for self-hosted/Docker — fill in your values)
  *   2. npm install
  *   3. npm run dev            (development)
  *      npm start              (production)