Devs to release

.env.example

@@ -0,0 +1,19 @@
+# ==========================================
+# payNEXT Environment Variables Template
+# ==========================================
+# COPY THIS FILE AND RENAME IT TO .env
+# Command: cp .env.example .env
+
+# Remote Shared Database
+DATABASE_URL=postgresql://USER:PASSWORD@HOST:5432/paynext_db?sslmode=require
+
+# Optional split variables if your backend uses them
+DB_HOST=your-db-host.supabase.com
+DB_PORT=5432
+DB_USER=postgres
+DB_PASSWORD=change_me
+DB_NAME=postgres
+DB_SSL=true
+
+# API Secrets
+JWT_SECRET=choose_your_own_local_jwt_secret

.github/workflows/deploy.yml

@@ -2,14 +2,9 @@ name: payNEXT CI/CD
 
 on:
   push:
-    branches:
-      - devs
-      - release
-      - main
+    branches: [devs, release, main]
   pull_request:
-    branches:
-      - release
-      - main
+    branches: [release, main]
   workflow_dispatch:
 
 concurrency:
@@ -20,43 +15,38 @@ jobs:
   validate:
     name: Validate Project
     runs-on: ubuntu-latest
-
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
 
       - name: Check required files
         run: |
-          echo "Checking required payNEXT files..."
           test -f docker-compose.yml
           test -f web/Dockerfile
           test -f web/nginx.conf
           test -f web/public/index.html
-          echo "All required files exist."
+          test -f db/init.sql
 
       - name: Validate Docker Compose file
-        run: |
-          docker compose -f docker-compose.yml config > /dev/null
-          echo "Docker Compose file is valid."
+        run: docker compose -f docker-compose.yml config > /dev/null
+
   deploy-production:
     name: Deploy to Production
     runs-on: ubuntu-latest
-
     needs: validate
-
     if: github.ref == 'refs/heads/main'
-
     environment:
       name: production
-
-    env:
+      env:
       SERVER_IP: ${{ secrets.SERVER_IP }}
       SSH_USER: ${{ secrets.SSH_USER }}
       SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
-
+      DB_HOST: ${{ secrets.DB_HOST }}
+      DB_USER: ${{ secrets.DB_USER }}
+      DB_NAME: ${{ secrets.DB_NAME }}
+      DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
+      JWT_SECRET: ${{ secrets.JWT_SECRET }}
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
 
       - name: Setup SSH
         run: |
@@ -67,33 +57,36 @@ jobs:
           ssh-keyscan -H "$SERVER_IP" >> ~/.ssh/known_hosts
 
       - name: Create deployment folder on server
-        run: |
-          ssh "$SSH_USER@$SERVER_IP" "mkdir -p /opt/paynext"
+        run: ssh "$SSH_USER@$SERVER_IP" "mkdir -p /opt/paynext"
 
-      - name: Package application files
+      - name: Build server .env on the runner
         run: |
-          tar --exclude='./.git' --exclude='./.github' -czf paynext.tgz docker-compose.yml web
-
-      - name: Copy package to server
+          {
+            echo "DB_HOST=$DB_HOST"
+            echo "DB_PORT=5432"
+            echo "DB_USER=$DB_USER"
+            echo "DB_PASSWORD=$DB_PASSWORD"
+            echo "DB_NAME=$DB_NAME"
+            echo "DB_SSL=true"
+            echo "JWT_SECRET=$JWT_SECRET"
+          } > server.env
+
+      - name: Copy app and .env to server
         run: |
+          tar --exclude='./.git' --exclude='./.github' -czf paynext.tgz docker-compose.yml web db
           scp paynext.tgz "$SSH_USER@$SERVER_IP":/tmp/paynext.tgz
+          scp server.env "$SSH_USER@$SERVER_IP":/opt/paynext/.env
+          rm -f server.env paynext.tgz
 
       - name: Deploy using Docker
         run: |
           ssh "$SSH_USER@$SERVER_IP" << 'EOF'
           set -e
-
           cd /opt/paynext
-
           docker compose down --remove-orphans || true
-
-          rm -rf web docker-compose.yml
-
+          rm -rf web db docker-compose.yml
           tar -xzf /tmp/paynext.tgz
-
-          rm /tmp/paynext.tgz
-
+          rm -f /tmp/paynext.tgz
           docker compose up -d --build
-
           docker image prune -f
           EOF

.gitignore

@@ -5,4 +5,10 @@ node_modules/
 *.log
 .DS_Store
 dist/
-build/
+build/get-docker.sh
+
+# Block all .env files everywhere
+**/.env
+.env
+.agents
+skills-lock.json

Caddyfile

@@ -0,0 +1,13 @@
+paynextt.me, www.paynextt.me {
+
+    encode zstd gzip
+
+    handle /api/* {
+    	reverse_proxy api:3000
+    }
+
+    handle {
+    	reverse_proxy web:80
+    }
+
+}

README.md

@@ -1,23 +1,114 @@
+<div align="center">
+
+<img src="assets/payNEXT_logo.png" alt="Project Logo" width="180"/>
+
 # payNEXT
 
-payNEXT is a digital wallet platform.
+**payNEXT is a next-generation digital wallet platform.**
+
+</div>
+
+## 📖 About The Project
+
+payNEXT is a digital wallet platform developed for Web Programming Lab II.
+
+The project uses an MVC-based backend and provides API-driven features for common wallet operations, including:
+
+- Wallet balance management
+- Transaction history
+- Peer-to-peer money requests
+- Merchant payments
+- User authentication
 
-## Local Development
+The application runs as a Docker-based multi-container system.
 
-The frontend is served using Docker and Nginx.
+## ✨ Features
 
-## Deploy
+- 💳 **Digital Wallet**: Manage wallet balances and transactions.
+- 🔒 **Automatic HTTPS**: Caddy manages HTTPS and Let's Encrypt certificates.
+- 🐳 **Docker Support**: Run the application and its services with Docker Compose.
 
-This project uses GitHub Actions to deploy to the server.
+## 🛠️ Tech Stack
 
-When changes are pushed to the `main` branch, GitHub Actions will:
+- **Frontend**: HTML, CSS, JavaScript
+- **Web Server**: Nginx
+- **Backend**: Node.js, Express.js
+- **Architecture**: MVC
+- **Database**: PostgreSQL 16
+- **Reverse Proxy**: Caddy v2
+- **SSL/TLS**: Let's Encrypt
+- **Containerization**: Docker, Docker Compose
+- **CI/CD**: GitHub Actions
 
-1. Copy files to the server
-2. Build the Docker image
-3. Restart the payNEXT web container
+## 🏗️ Architecture
 
-## Server
+payNEXT uses four main services:
+
+1. **Caddy**
+   - Receives incoming web traffic.
+   - Redirects HTTP traffic to HTTPS.
+   - Manages Let's Encrypt certificates.
+   - Routes `/api/*` requests to the backend.
+   - Routes frontend requests to Nginx.
+
+2. **Web**
+   - Runs Nginx.
+   - Serves the frontend files.
+   - Handles client-side routing.
+
+3. **API**
+   - Runs the Node.js and Express.js backend.
+   - Handles authentication and wallet operations.
+   - Processes transactions and money requests.
+   - Communicates with PostgreSQL.
+
+4. **Database**
+   - Runs PostgreSQL 16.
+   - Stores users, wallets, transactions, money requests, and other application data.
+
+The request flow looks like this:
 
 ```text
-http://104.214.170.158
+User
+  │
+  ▼
+Caddy
+  │
+  ├── / ──────────► Nginx
+  │                   │
+  │                   ▼
+  │                Frontend
+  │
+  └── /api/* ─────► Node.js
+                       │
+                       ▼
+                   PostgreSQL
 ```
+
+## 🚀 Getting Started
+
+### Prerequisites
+
+Install these tools before running the project:
+
+- [Docker](https://www.docker.com/get-started)
+- [Docker Compose](https://docs.docker.com/compose/)
+- [Git](https://git-scm.com/)
+
+### Stopping the Application
+
+Stop the containers with:
+
+```bash
+docker compose down
+```
+
+To also remove Docker volumes:
+
+```bash
+docker compose down -v
+```
+
+Use the `-v` option only when you want to remove the stored local database data.
+
+payNEXT - Powering Your Next Move. Next Generation Digital Wallet.

SECURITY.md

@@ -0,0 +1,27 @@
+# 🔐 Security Measures in payNEXT
+
+This document outlines the security implementations in the payNEXT architecture.
+
+## 1. Transport Layer Security
+
+- **HTTPS Enforcement:** Caddy automatically provisions Let's Encrypt SSL certificates and redirects all HTTP traffic to HTTPS.
+- **Security Headers:** `helmet.js` is configured globally to set secure HTTP headers (HSTS, X-Frame-Options, etc.).
+
+## 2. Access Control & Rate Limiting
+
+- **Rate Limiting:** Authentication endpoints (`/api/v1/auth/login`, `/register`) are restricted to 5 requests per 15 minutes per IP to prevent brute-force attacks.
+- **CORS:** Strict origin whitelisting is enforced. Only `https://paynextt.me` and `http://localhost:8080` are permitted.
+
+## 3. Input Validation & Injection Prevention
+
+- **SQL Injection:** All PostgreSQL queries use parameterized inputs via the `pg` library.
+- **XSS & Data Sanitization:** `express-validator` is used to trim, escape, and validate all incoming user inputs before processing.
+
+## 4. Infrastructure & Load Balancing
+
+- **Reverse Proxy:** Caddy acts as the single entry point, routing `/api/*` to the backend and `/` to the Nginx frontend.
+- **Load Balancing:** The API service can be scaled horizontally (`docker-compose up --scale api=2`). Caddy distributes traffic across instances using a `round_robin` policy.
+
+## 5. How to Test
+
+See the repository wiki or run the provided `curl` commands in `TESTING.md` to verify rate limiting, CORS, and header configurations.