Deployment Guide

​

Pre-Deployment Checklist

• MongoDB database set up (local or MongoDB Atlas)
• Production environment variables configured
• Domain name configured (if applicable)
• SSL/TLS certificates ready
• Backend and frontend code tested locally
• All dependencies up to date and audited for security

​

Frontend Production Build

VITE_API_URL=https://api.yourdomain.com/api

cd frontend
npm run build

npm run preview

​

Frontend Deployment Examples

​

Vercel Deployment

# Install Vercel CLI
npm install -g vercel

# Navigate to frontend directory
cd frontend

# Deploy
vercel --prod

​

Netlify Deployment

# Install Netlify CLI
npm install -g netlify-cli

# Navigate to frontend directory
cd frontend

# Build and deploy
netlify deploy --prod --dir=dist

​

Nginx Configuration

server {
    listen 80;
    server_name yourdomain.com;
    
    root /var/www/smartshelf/frontend/dist;
    index index.html;
    
    location / {
        try_files $uri $uri/ /index.html;
    }
    
    # Enable gzip compression
    gzip on;
    gzip_vary on;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
}

​

Backend Production Setup

# Server Configuration
PORT=5000
NODE_ENV=production

# Database Configuration
MONGODB_URI=mongodb+srv://username:[email protected]/smartshelf

# JWT Configuration
JWT_SECRET=your_production_jwt_secret_key_at_least_32_characters_long
JWT_EXPIRE=24h

# CORS Configuration
ALLOWED_ORIGINS=https://yourdomain.com,https://www.yourdomain.com

cd backend
npm install --production

# Install PM2 globally
npm install -g pm2

# Start the application
pm2 start server.js --name smartshelf-backend

# Save PM2 configuration
pm2 save

# Set up PM2 to start on system boot
pm2 startup

[Unit]
Description=SmartShelf Backend
After=network.target

[Service]
Type=simple
User=www-data
WorkingDirectory=/path/to/backend
ExecStart=/usr/bin/node server.js
Restart=on-failure
Environment=NODE_ENV=production

[Install]
WantedBy=multi-user.target

sudo systemctl enable smartshelf
sudo systemctl start smartshelf

server {
    listen 80;
    server_name api.yourdomain.com;
    
    location / {
        proxy_pass http://localhost:5000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
    }
}

sudo ln -s /etc/nginx/sites-available/smartshelf-api /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

# Install Certbot
sudo apt-get install certbot python3-certbot-nginx

# Obtain and install certificate
sudo certbot --nginx -d api.yourdomain.com

# Test automatic renewal
sudo certbot renew --dry-run

​

Backend Deployment Platforms

​

Heroku

# Install Heroku CLI
npm install -g heroku

# Login to Heroku
heroku login

# Create app
cd backend
heroku create smartshelf-api

# Set environment variables
heroku config:set NODE_ENV=production
heroku config:set MONGODB_URI=your_mongodb_uri
heroku config:set JWT_SECRET=your_jwt_secret
heroku config:set JWT_EXPIRE=24h
heroku config:set ALLOWED_ORIGINS=https://yourdomain.com

# Deploy
git push heroku main

​

Railway

1. Sign up at Railway.app
2. Click “New Project” → “Deploy from GitHub repo”
3. Select your repository and backend directory
4. Add environment variables in the “Variables” tab
5. Railway automatically detects Node.js and deploys

​

DigitalOcean App Platform

1. Create account at DigitalOcean
2. Click “Create App” and connect your GitHub repository
3. Select the backend directory
4. Configure environment variables
5. Choose your plan and deploy

​

Environment Variable Management

​

Secure Storage Options

1. Platform-specific environment variables
   • Use your hosting platform’s environment variable management (Heroku Config Vars, Vercel Environment Variables, etc.)
2. Secret management services
   • AWS Secrets Manager - Managed secret storage for AWS deployments
   • HashiCorp Vault - Enterprise secret management
   • Azure Key Vault - Microsoft’s secret management solution
3. Environment files on server
   • Store .env file on server with restricted permissions:
   chmod 600 .env
   chown www-data:www-data .env
   

​

Environment Variable Validation

// backend/src/config/validateEnv.js
const requiredEnvVars = [
  'MONGODB_URI',
  'JWT_SECRET',
  'ALLOWED_ORIGINS'
];

requiredEnvVars.forEach((varName) => {
  if (!process.env[varName]) {
    throw new Error(`Missing required environment variable: ${varName}`);
  }
});

​

MongoDB Production Configuration

​

MongoDB Atlas Production Setup

​

Self-Hosted MongoDB Production

1. Enable authentication:
   // Create admin user
   use admin
   db.createUser({
     user: "admin",
     pwd: "securePassword",
     roles: [{ role: "userAdminAnyDatabase", db: "admin" }]
   })
   
2. Enable SSL/TLS:
   mongod --tlsMode requireTLS \
          --tlsCertificateKeyFile /path/to/cert.pem
   
3. Configure firewall:
   # Allow MongoDB port only from application servers
   sudo ufw allow from APP_SERVER_IP to any port 27017
   
4. Set up replication:
   • Use replica sets for high availability
   • Minimum 3-member replica set recommended

​

Security Best Practices

​

Application Security

1. Use HTTPS everywhere
   • Enable SSL/TLS for all connections
   • Redirect HTTP to HTTPS
   • Use HSTS headers
2. Implement rate limiting
   // backend/src/middlewares/rateLimiter.js
   const rateLimit = require('express-rate-limit');
   
   const limiter = rateLimit({
     windowMs: 15 * 60 * 1000, // 15 minutes
     max: 100, // Limit each IP to 100 requests per window
     message: 'Too many requests, please try again later.'
   });
   
   app.use('/api/', limiter);
   
3. Enable security headers
   const helmet = require('helmet');
   app.use(helmet());
   
4. Validate and sanitize input
   • Use validation libraries (express-validator, joi)
   • Sanitize user input to prevent injection attacks
   • Implement proper error handling
5. Keep dependencies updated
   # Check for vulnerabilities
   npm audit
   
   # Fix automatically if possible
   npm audit fix
   

​

Database Security

1. Use strong passwords
   • Minimum 16 characters
   • Mix of uppercase, lowercase, numbers, symbols
   • Use password generator
2. Principle of least privilege
   • Grant minimum necessary permissions
   • Use separate database users for different services
3. Enable encryption at rest
   • MongoDB Atlas encrypts data at rest by default
   • For self-hosted, enable encryption
4. Monitor database access
   • Enable audit logging
   • Review access logs regularly
   • Set up alerts for suspicious activity

​

API Security

1. Implement proper authentication
   • Use strong JWT secrets
   • Set reasonable token expiration times
   • Implement token refresh mechanism
2. Configure CORS properly
   // Only allow specific origins
   const corsOptions = {
     origin: process.env.ALLOWED_ORIGINS.split(','),
     credentials: true,
     optionsSuccessStatus: 200
   };
   app.use(cors(corsOptions));
   
3. Protect sensitive endpoints
   • Require authentication for all protected routes
   • Implement role-based access control
   • Log access to sensitive operations

​

Monitoring and Logging

​

Application Monitoring

1. PM2 Monitoring
   pm2 monit
   pm2 logs smartshelf-backend
   
2. Application Performance Monitoring (APM)
   • New Relic - Full-stack monitoring
   • Datadog - Infrastructure and APM
   • Sentry - Error tracking and monitoring

​

Logging Best Practices

// Use a logging library like winston
const winston = require('winston');

const logger = winston.createLogger({
  level: 'info',
  format: winston.format.json(),
  transports: [
    new winston.transports.File({ filename: 'error.log', level: 'error' }),
    new winston.transports.File({ filename: 'combined.log' })
  ]
});

if (process.env.NODE_ENV !== 'production') {
  logger.add(new winston.transports.Console({
    format: winston.format.simple()
  }));
}

​

Performance Optimization

1. Enable caching
   • Use Redis for session storage and caching
   • Implement API response caching
   • Enable browser caching for static assets
2. Database optimization
   • Create indexes for frequently queried fields
   • Use connection pooling
   • Implement query result caching
3. Frontend optimization
   • Enable gzip/brotli compression
   • Implement lazy loading for routes
   • Optimize images and assets
   • Use CDN for static assets
4. Load balancing
   • Use multiple backend instances
   • Implement load balancer (Nginx, HAProxy)
   • Scale horizontally as traffic grows

​

Backup and Disaster Recovery

1. Automated backups
   • Daily automated backups (MongoDB Atlas provides this)
   • Store backups in multiple locations
   • Test restore procedures regularly
2. Version control
   • Tag releases in Git
   • Maintain changelog
   • Keep deployment documentation updated
3. Rollback strategy
   • Keep previous versions available
   • Document rollback procedures
   • Test rollback in staging environment