Prod: public origin gupi.glitch.university, internal services over HTTP

CORS_ORIGIN defaults to https://gupi.${DOMAIN} (the TLS frontend served by the
proxy); the app still reaches Postgres/MinIO by their docker hostnames over
plain HTTP on the shared network. Clarify the split in .env.prod.example and
fix the deploy success URL.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.prod.example

@@ -1,9 +1,13 @@
-# GUPI production environment. Copy to /opt/gupi/.env.prod on the server and fill in.
-# GUPI runs ONLY its own app container; Postgres + MinIO come from the shared gu_common
-# stack (which must already be up). These values point the app at those services.
+# GUPI production environment TEMPLATE. Copy to /opt/gupi/.env.prod on the server and
+# fill in real values there (never commit real secrets). GUPI runs ONLY its own app
+# container; Postgres + MinIO come from the shared gu_common stack (must already be up).
 #
-# Deploy with:  ./deploy.sh
-# (which runs, on the server, from /opt/gupi:)
+# Endpoints:
+#   - Public (frontend, TLS via the proxy):  https://gupi.glitch.university
+#   - Internal (app -> services, plain HTTP): docker hostnames gnommo-db / gnommo-minio
+#     (those hostnames live in docker-compose.prod.yml; here you only set credentials).
+#
+# Deploy with:  ./deploy.sh   (server-side it runs, from /opt/gupi:)
 #   docker compose -f /opt/gupi/docker-compose.prod.yml --env-file /opt/gupi/.env.prod up -d
 
 # --- Shared PostgreSQL (gu_common; reachable as gnommo-db on the shared network) ---
@@ -18,7 +22,10 @@ S3_REGION=us-east-1
 OSINT_S3_BUCKET=gupi-osint
 
 # --- App ---
+# DOMAIN drives the default public origin (https://gupi.${DOMAIN}); override CORS_ORIGIN
+# directly if the frontend is served somewhere else.
 DOMAIN=glitch.university
+# CORS_ORIGIN=https://gupi.glitch.university
 JWT_SECRET=CHANGE_ME_LONG_RANDOM_SECRET
 LEVEL_EDITING_ENABLED=false
 MAX_DOCUMENT_BYTES=26214400

.gitignore

@@ -1,6 +1,9 @@
 node_modules/
 dist/
 .env
+.env.prod
+.env.local
+.env.*.local
 .DS_Store
 *.tsbuildinfo
 playwright-report/

deploy.sh

@@ -98,4 +98,4 @@ for i in $(seq 1 24); do
   fi
 done
 
-echo "==> Done! https://osint.glitch.university"
+echo "==> Done! https://gupi.glitch.university"

docker-compose.prod.yml

@@ -8,8 +8,10 @@ services:
     environment:
       NODE_ENV: production
       PORT: 8787
+      # Internal: reach gu_common services by their docker hostnames over plain HTTP.
       DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@gnommo-db:5432/${POSTGRES_DB}
-      CORS_ORIGIN: https://osint.${DOMAIN}
+      # Public: the frontend is served over TLS at gupi.glitch.university by the proxy.
+      CORS_ORIGIN: ${CORS_ORIGIN:-https://gupi.${DOMAIN}}
       JWT_SECRET: ${JWT_SECRET}
       LEVEL_EDITING_ENABLED: ${LEVEL_EDITING_ENABLED:-false}
       MAX_DOCUMENT_BYTES: ${MAX_DOCUMENT_BYTES:-26214400}