yuriy.pandClaude Opus 5
b673367c6f
Fixes that block or weaken a real deployment. Nothing here changes the rendered pages. Bind the lead API to loopback. Each server called app.listen() without a host, so it bound 0.0.0.0. Combined with a blanket `trust proxy: true` — which makes Express take the leftmost X-Forwarded-For entry as req.ip — the in-memory lead rate limiter was spoofable by anyone who could reach the port directly. HOST now defaults to 127.0.0.1 and trust is narrowed to 'loopback', so a request arriving from anywhere but the local proxy has its forged header ignored. Give each landing its own port. All four .env files claimed PORT=3000, and fitnes/.env.example collided with medcenter/.env.example, so three of the four could never have started on one host. Now 3000/3001/3002/3003 consistently across the code defaults, the env templates and the vite dev proxies, so all four also run side by side locally. Template the JSON-LD url. canonical and og:url already resolved from %VITE_SITE_URL%, but the JSON-LD block hardcoded an exodevices.ru sub-path that would not follow the environment. All four now read from the same variable. Declare the Node version. Nothing stated it, yet transitive deps impose a >=22.12 floor (@rolldown/binding, yargs, concurrently). Added engines and .nvmrc so a too-old runtime fails clearly. Typechecked and production-built on all four; verified the socket binds 127.0.0.1 only, health reports amo:true, the site still boots with the CRM unconfigured, and the limiter returns 429 with Retry-After on the ninth request. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
37 lines
1.7 KiB
Bash
37 lines
1.7 KiB
Bash
# ---------------------------------------------------------------------------
|
|
# Public (baked into the client bundle at build time — never put secrets here)
|
|
# ---------------------------------------------------------------------------
|
|
VITE_SITE_URL=https://exodevices.ru/medical-centers/no-physiotherapy
|
|
|
|
# Sub-path the site is served from, if any. Leave as "/" when it sits at the
|
|
# domain root; set to "/medical-centers/no-physiotherapy/" when it is mounted
|
|
# under that path.
|
|
VITE_BASE_PATH=/
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Server
|
|
# ---------------------------------------------------------------------------
|
|
# One port per landing so all four can run side by side:
|
|
# fitnes 3000, hotel 3001, medcenter 3002, medcenterpersonal 3003.
|
|
PORT=3003
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# amoCRM — server-side only, never exposed to the browser
|
|
# ---------------------------------------------------------------------------
|
|
# Your account subdomain: for https://exotherapy.amocrm.ru put "exotherapy"
|
|
AMO_SUBDOMAIN=
|
|
|
|
# Long-lived access token.
|
|
# amoCRM → Настройки → Интеграции → Создать интеграцию → Внешняя интеграция →
|
|
# open it → tab "Ключи и скопы" → «Генерировать токен» (долгосрочный, ~1 год).
|
|
AMO_LONG_LIVED_TOKEN=
|
|
|
|
# Pipeline (воронка) the leads land in. The lead is placed in its first stage.
|
|
AMO_PIPELINE_ID=10980758
|
|
|
|
# Optional: numeric id of the amoCRM user leads are assigned to.
|
|
AMO_RESPONSIBLE_USER_ID=
|
|
|
|
# Optional: comma-separated tags added to every lead.
|
|
AMO_LEAD_TAGS=medcenter-no-physio-landing
|