feat: enhance production readiness and security features

- Updated .gitignore to include additional environment files and logs
- Expanded README with production deployment instructions and required environment variables
- Integrated security middleware (Helmet, rate limiting, compression) in app.js
- Added production-specific validations for environment variables in config.js
- Improved Dockerfile for better security and performance
- Created a CI/CD pipeline in GitHub Actions for automated testing and security audits
- Added a production readiness verification script to ensure deployment requirements are met
- Updated package.json scripts for clearer development and production commands

Author: soumya813

.dockerignore

@@ -0,0 +1,12 @@
+node_modules
+npm-debug.log
+.env
+.env.*
+.git
+.gitignore
+README.md
+Dockerfile
+.dockerignore
+coverage
+.nyc_output
+logs/*.log

.github/workflows/nodejs.yml

@@ -0,0 +1,36 @@
+name: CI/CD Pipeline
+
+on:
+  push:
+    branches: [ main, develop ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    
+    strategy:
+      matrix:
+        node-version: [18.x, 20.x]
+    
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v3
+    
+    - name: Use Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@v3
+      with:
+        node-version: ${{ matrix.node-version }}
+        cache: 'npm'
+    
+    - name: Install dependencies
+      run: npm ci
+    
+    - name: Run tests
+      run: npm test
+      env:
+        NODE_ENV: test
+    
+    - name: Run security audit
+      run: npm audit --audit-level moderate

.gitignore

@@ -1,2 +1,45 @@
+# Environment variables
 .env
-/node_modules
+.env.local
+.env.production
+.env.test
+
+# Dependencies
+/node_modules
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# Logs
+logs/
+*.log
+
+# Runtime data
+pids
+*.pid
+*.seed
+*.pid.lock
+
+# Coverage directory used by tools like istanbul
+coverage/
+.nyc_output
+
+# IDE/Editor files
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# OS generated files
+.DS_Store
+.DS_Store?
+._*
+.Spotlight-V100
+.Trashes
+ehthumbs.db
+Thumbs.db
+
+# Build outputs
+dist/
+build/

Dockerfile

@@ -0,0 +1,34 @@
+# Use official Node.js runtime as base image
+FROM node:18-alpine
+
+# Set working directory
+WORKDIR /app
+
+# Copy package files
+COPY package*.json ./
+
+# Install dependencies
+RUN npm ci --only=production && npm cache clean --force
+
+# Create non-root user
+RUN addgroup -g 1001 -S nodejs && \
+    adduser -S appuser -u 1001
+
+# Copy application code
+COPY . .
+
+# Create logs directory with proper permissions
+RUN mkdir -p logs && chown -R appuser:nodejs logs
+
+# Switch to non-root user
+USER appuser
+
+# Expose port
+EXPOSE 5000
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+  CMD node -e "require('http').get('http://localhost:5000/health', (res) => { process.exit(res.statusCode === 200 ? 0 : 1) })"
+
+# Start application
+CMD ["node", "app.js"]

Procfile

@@ -0,0 +1 @@
+web: node app.js

README.md

@@ -132,6 +132,90 @@ The app will run at [http://localhost:5000](http://localhost:5000)
 
 ---
 
+## 🚀 Production Deployment
+
+### Required Environment Variables
+
+Set these environment variables in your hosting provider:
+
+```env
+# Database (Required)
+MONGODB_URI=mongodb+srv://username:password@cluster.mongodb.net/notes-app
+
+# Google OAuth (Required)
+GOOGLE_CLIENT_ID=your_google_client_id
+GOOGLE_CLIENT_SECRET=your_google_client_secret
+GOOGLE_CALLBACK_URL=https://yourdomain.com/google/callback
+
+# Security (Required for production)
+SESSION_SECRET=your_super_secret_random_string_here
+NODE_ENV=production
+PORT=5000
+
+# Optional Features
+HUGGING_FACE_API=your_hugging_face_token
+REDIS_URL=redis://localhost:6379
+DOMAIN=yourdomain.com
+
+# Email (Optional)
+SMTP_HOST=smtp.gmail.com
+SMTP_PORT=587
+SMTP_USER=your_email@gmail.com
+SMTP_PASS=your_app_password
+SMTP_FROM=noreply@yourdomain.com
+```
+
+### Deploy to Heroku
+
+1. Install Heroku CLI
+2. Login and create app:
+```bash
+heroku login
+heroku create your-notes-app
+```
+
+3. Set environment variables:
+```bash
+heroku config:set NODE_ENV=production
+heroku config:set MONGODB_URI=your_mongodb_uri
+heroku config:set SESSION_SECRET=your_secret
+# ... add all other required vars
+```
+
+4. Deploy:
+```bash
+git add .
+git commit -m "Deploy to production"
+git push heroku main
+```
+
+### Deploy with Docker
+
+1. Build image:
+```bash
+docker build -t notes-app .
+```
+
+2. Run container:
+```bash
+docker run -d \
+  -p 5000:5000 \
+  -e NODE_ENV=production \
+  -e MONGODB_URI=your_mongodb_uri \
+  -e SESSION_SECRET=your_secret \
+  --name notes-app \
+  notes-app
+```
+
+### Deploy to Render/Railway
+
+1. Connect your GitHub repository
+2. Set environment variables in the dashboard
+3. Use build command: `npm install`
+4. Use start command: `npm start`
+
+---
+
 ## 🔄 Real-time Collaboration
 
 This app includes collaborative editing powered by Socket.IO:

app.js

@@ -4,6 +4,9 @@ const express = require('express');
 const http = require('http');
 const expressLayouts =  require('express-ejs-layouts');
 const methodOverride = require('method-override');
+const helmet = require('helmet');
+const rateLimit = require('express-rate-limit');
+const compression = require('compression');
 const { connectDB } = require('./server/config/db');
 const { getConfig } = require('./server/config/config');
 const session = require('express-session');
@@ -18,6 +21,9 @@ if (config.NODE_ENV === 'production') {
   app.set('trust proxy', 1);
 }
 
+// Compression middleware
+app.use(compression());
+
 // Winston logger setup
 const winston = require('winston');
 const morgan = require('morgan');
@@ -88,22 +94,66 @@ app.use(methodOverride("_method"));
 // Connect to database
 connectDB();
 
-// Static files
-app.use(express.static('public'));
-
-// Templating engine
-app.use(expressLayouts);
-app.set('layout', './layouts/main');
-app.set('view engine', 'ejs');
+// Security middleware - Helmet with EJS-friendly CSP
+app.use(helmet({
+  contentSecurityPolicy: {
+    directives: {
+      defaultSrc: ["'self'"],
+      // Allow Google Fonts stylesheet
+      styleSrc: [
+        "'self'",
+        "'unsafe-inline'",
+        "https://cdn.jsdelivr.net",
+        "https://cdnjs.cloudflare.com",
+        "https://fonts.googleapis.com"
+      ],
+      scriptSrc: [
+        "'self'",
+        "'unsafe-inline'",
+        "https://cdn.jsdelivr.net",
+        "https://cdnjs.cloudflare.com",
+        "https://cdn.socket.io"
+      ],
+      imgSrc: ["'self'", "data:", "https:"],
+      // Allow Google Fonts font files
+      fontSrc: [
+        "'self'",
+        "data:",
+        "https://cdn.jsdelivr.net",
+        "https://cdnjs.cloudflare.com",
+        "https://fonts.gstatic.com"
+      ],
+      connectSrc: ["'self'", "ws:", "wss:"]
+    }
+  }
+}));
+
+// Rate limiting
+const limiter = rateLimit({
+  windowMs: config.SECURITY.rateLimitWindow, // from config
+  max: config.SECURITY.rateLimitRequests,
+  message: 'Too many requests from this IP, please try again later.',
+  standardHeaders: true,
+  legacyHeaders: false,
+});
+app.use(limiter);
 
-// Security middleware
+// Additional security headers (keeping existing ones for compatibility)
 app.use((req, res, next) => {
   res.setHeader('X-Content-Type-Options', 'nosniff');
   res.setHeader('X-Frame-Options', 'DENY');
   res.setHeader('X-XSS-Protection', '1; mode=block');
   next();
 });
 
+// Static files
+app.use(express.static('public'));
+
+// Templating engine
+app.use(expressLayouts);
+app.set('layout', './layouts/main');
+app.set('view engine', 'ejs');
+
 // API versioning
 app.use('/api/v1/notes', require('./server/routes/api/v1/notes'));