From 072e82f2534dee2e452101b60a47700bc9c8e195 Mon Sep 17 00:00:00 2001
From: jenstandstad <jens.tandstad@gmail.com>
Date: Sat, 22 Aug 2026 23:06:02 +0200
Subject: [PATCH] Prod: public origin gupi.glitch.university, internal services
 over HTTP

CORS_ORIGIN defaults to https://gupi.${DOMAIN} (the TLS frontend served by the
proxy); the app still reaches Postgres/MinIO by their docker hostnames over
plain HTTP on the shared network. Clarify the split in .env.prod.example and
fix the deploy success URL.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .env.prod.example       | 17 ++++++++++++-----
 .gitignore              |  3 +++
 deploy.sh               |  2 +-
 docker-compose.prod.yml |  4 +++-
 4 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/.env.prod.example b/.env.prod.example
index 540ec58..e96355d 100644
--- a/.env.prod.example
+++ b/.env.prod.example
@@ -1,9 +1,13 @@
-# GUPI production environment. Copy to /opt/gupi/.env.prod on the server and fill in.
-# GUPI runs ONLY its own app container; Postgres + MinIO come from the shared gu_common
-# stack (which must already be up). These values point the app at those services.
+# GUPI production environment TEMPLATE. Copy to /opt/gupi/.env.prod on the server and
+# fill in real values there (never commit real secrets). GUPI runs ONLY its own app
+# container; Postgres + MinIO come from the shared gu_common stack (must already be up).
 #
-# Deploy with:  ./deploy.sh
-# (which runs, on the server, from /opt/gupi:)
+# Endpoints:
+#   - Public (frontend, TLS via the proxy):  https://gupi.glitch.university
+#   - Internal (app -> services, plain HTTP): docker hostnames gnommo-db / gnommo-minio
+#     (those hostnames live in docker-compose.prod.yml; here you only set credentials).
+#
+# Deploy with:  ./deploy.sh   (server-side it runs, from /opt/gupi:)
 #   docker compose -f /opt/gupi/docker-compose.prod.yml --env-file /opt/gupi/.env.prod up -d
 
 # --- Shared PostgreSQL (gu_common; reachable as gnommo-db on the shared network) ---
@@ -18,7 +22,10 @@ S3_REGION=us-east-1
 OSINT_S3_BUCKET=gupi-osint
 
 # --- App ---
+# DOMAIN drives the default public origin (https://gupi.${DOMAIN}); override CORS_ORIGIN
+# directly if the frontend is served somewhere else.
 DOMAIN=glitch.university
+# CORS_ORIGIN=https://gupi.glitch.university
 JWT_SECRET=CHANGE_ME_LONG_RANDOM_SECRET
 LEVEL_EDITING_ENABLED=false
 MAX_DOCUMENT_BYTES=26214400
diff --git a/.gitignore b/.gitignore
index 65ce6f5..41533af 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,9 @@
 node_modules/
 dist/
 .env
+.env.prod
+.env.local
+.env.*.local
 .DS_Store
 *.tsbuildinfo
 playwright-report/
diff --git a/deploy.sh b/deploy.sh
index 861f464..0f6bc65 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -98,4 +98,4 @@ for i in $(seq 1 24); do
   fi
 done
 
-echo "==> Done! https://osint.glitch.university"
+echo "==> Done! https://gupi.glitch.university"
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 9a00b92..be1aae4 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -8,8 +8,10 @@ services:
     environment:
       NODE_ENV: production
       PORT: 8787
+      # Internal: reach gu_common services by their docker hostnames over plain HTTP.
       DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@gnommo-db:5432/${POSTGRES_DB}
-      CORS_ORIGIN: https://osint.${DOMAIN}
+      # Public: the frontend is served over TLS at gupi.glitch.university by the proxy.
+      CORS_ORIGIN: ${CORS_ORIGIN:-https://gupi.${DOMAIN}}
       JWT_SECRET: ${JWT_SECRET}
       LEVEL_EDITING_ENABLED: ${LEVEL_EDITING_ENABLED:-false}
       MAX_DOCUMENT_BYTES: ${MAX_DOCUMENT_BYTES:-26214400}