nmemmert
5140958305
Projects were previously global to anyone who could reach the server. Adds email/password accounts with httpOnly cookie sessions, scopes every project (both SQLite and localStorage) to the signed-in user, and auto-claims pre-existing unowned projects for whoever registers first. Also adds optional TOTP two-factor auth with backup codes, managed from a new Account Settings page, since there's no password-reset flow to fall back on otherwise. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
28 lines
665 B
Desktop File
28 lines
665 B
Desktop File
[Unit]
|
|
Description=Bible Study App
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
# Edit these to match your deployment
|
|
User=study-app
|
|
Group=study-app
|
|
WorkingDirectory=/opt/study-app
|
|
Environment=NODE_ENV=production
|
|
Environment=PORT=3001
|
|
# Replaced with a generated value by install.sh — keep this secret and stable
|
|
# across deploys, or every existing login session gets invalidated.
|
|
Environment=SESSION_SECRET=__SESSION_SECRET__
|
|
ExecStart=/usr/bin/node server/index.js
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
|
|
# Hardening (relax if it causes issues)
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
ProtectSystem=full
|
|
ReadWritePaths=/opt/study-app
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|