deploy

backend/src/index.js

@@ -20,8 +20,9 @@ const corsOrigin = process.env.CORS_ORIGIN ?? 'http://localhost:5173';
 
 if (!oidcIssuer) {
   console.error(
-    'Set OIDC_ISSUER or AUTHENTIK_URL + OIDC_APP_SLUG in backend/.env',
+    'Missing OIDC config: set AUTHENTIK_URL + OIDC_APP_SLUG (or OIDC_ISSUER) in environment.',
   );
+  console.error('  On server: cp deploy/.env.example deploy/.env && docker compose --env-file .env up -d --build');
   process.exit(1);
 }
 

deploy/README.md

@@ -82,6 +82,17 @@ sudo ufw allow 3001/tcp
 
 ## 5. Build and start the demo app
 
+`deploy/.env` is **not in git** — create it on the server first:
+
+```bash
+cp .env.example .env
+nano .env
+chmod +x up-app.sh diagnose.sh
+./up-app.sh
+```
+
+Or manually:
+
 ```bash
 docker compose --env-file .env up -d --build
 ```

deploy/diagnose.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+cd "$(dirname "$0")"
+
+echo "=== Files ==="
+ls -la .env 2>/dev/null || echo "MISSING deploy/.env — run: cp .env.example .env"
+ls -d ../backend ../frontend 2>/dev/null || echo "MISSING ../backend or ../frontend"
+
+echo ""
+echo "=== Containers ==="
+docker compose --env-file .env ps -a 2>/dev/null || docker compose ps -a
+
+echo ""
+echo "=== API logs (last 40 lines) ==="
+docker compose --env-file .env logs api --tail 40 2>/dev/null || true
+
+echo ""
+echo "=== Port 3001 ==="
+curl -fsS "http://127.0.0.1:${API_PORT:-3001}/health" 2>&1 || echo "curl failed (API not listening)"
+
+echo ""
+echo "=== Port 80 (web) ==="
+curl -fsS -o /dev/null -w "HTTP %{http_code}\n" "http://127.0.0.1/" 2>&1 || echo "web not responding"

deploy/docker-compose.yml

@@ -10,12 +10,8 @@ services:
     env_file:
       - .env
     environment:
-      PORT: 3001
-      CORS_ORIGIN: ${CORS_ORIGIN:-http://localhost}
-      AUTHENTIK_URL: ${AUTHENTIK_URL}
-      OIDC_APP_SLUG: ${OIDC_APP_SLUG:-oidc-demo}
-      OIDC_ISSUER: ${OIDC_ISSUER:-}
-      OIDC_AUDIENCE: ${OIDC_AUDIENCE}
+      PORT: "3001"
+      NODE_ENV: production
     ports:
       - "${API_PORT:-3001}:3001"
     healthcheck:

deploy/up-app.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd "$(dirname "$0")"
+
+if [[ ! -f ../backend/package.json ]]; then
+  echo "Error: run from repo root layout (deploy/ next to backend/ and frontend/)."
+  echo "  Expected: Authentik/backend  Authentik/frontend  Authentik/deploy"
+  exit 1
+fi
+
+if [[ ! -f .env ]]; then
+  echo "Missing deploy/.env — creating from .env.example"
+  cp .env.example .env
+  echo "Edit .env if needed, then run this script again."
+  exit 1
+fi
+
+if ! grep -q '^AUTHENTIK_URL=.' .env 2>/dev/null; then
+  echo "Error: AUTHENTIK_URL is empty in deploy/.env"
+  exit 1
+fi
+
+docker compose --env-file .env up -d --build "$@"
+
+echo ""
+echo "Status:"
+docker compose --env-file .env ps
+echo ""
+echo "API health:"
+sleep 3
+curl -fsS "http://127.0.0.1:${API_PORT:-3001}/health" && echo || {
+  echo "API not responding — check logs:"
+  echo "  docker compose --env-file .env logs api --tail 80"
+}