ccb4bdaabf
HIGH PRIORITY: Fixes production 404 error on research inquiry form Research Inquiry API: - Add POST /api/research-inquiry endpoint for form submissions - Add admin endpoints for inquiry management (list, get, assign, respond, delete) - Create ResearchInquiry model with MongoDB integration - Add to moderation queue for human review (strategic quadrant) - Include rate limiting (5 req/min) and CSRF protection - Tested locally: endpoint responding, data saving to DB Umami Analytics (Privacy-First): - Add Docker Compose config for Umami + PostgreSQL - Create nginx reverse proxy config with SSL support - Implement privacy-first tracking script (DNT, opt-out, no cookies) - Integrate tracking across 26 public HTML pages - Exclude admin pages from tracking (privacy boundary) - Add comprehensive deployment guide (UMAMI_SETUP_GUIDE.md) - Environment variables added to .env.example Files Created (9): - src/models/ResearchInquiry.model.js - src/controllers/research.controller.js - src/routes/research.routes.js - public/js/components/umami-tracker.js - deployment-quickstart/nginx-analytics.conf - deployment-quickstart/UMAMI_SETUP_GUIDE.md - scripts/add-umami-tracking.sh - scripts/add-tracking-python.py - SESSION_SUMMARY_ANALYTICS_RESEARCH_INQUIRY.md Files Modified (29): - src/routes/index.js (research routes) - deployment-quickstart/docker-compose.yml (umami services) - deployment-quickstart/.env.example (umami config) - 26 public HTML pages (tracking script) Values Alignment: ✅ Privacy-First Design (cookie-free, DNT honored, opt-out available) ✅ Human Agency (research inquiries require human review) ✅ Data Sovereignty (self-hosted analytics, no third-party sharing) ✅ GDPR Compliance (no personal data in analytics) ✅ Transparency (open-source tools, documented setup) Testing Status: ✅ Research inquiry: Locally tested, data verified in MongoDB ⏳ Umami analytics: Pending production deployment Next Steps: 1. Deploy to production (./scripts/deploy.sh) 2. Test research form on live site 3. Deploy Umami following UMAMI_SETUP_GUIDE.md 4. Update umami-tracker.js with website ID after setup 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
122 lines
5 KiB
Text
122 lines
5 KiB
Text
# Tractatus Framework - Environment Configuration Template
|
|
# Copy this file to .env and fill in your actual values
|
|
|
|
#=============================================================================
|
|
# REQUIRED: Database Configuration
|
|
#=============================================================================
|
|
MONGODB_USERNAME=tractatus
|
|
MONGODB_PASSWORD=YOUR_SECURE_PASSWORD_HERE # CHANGE THIS!
|
|
MONGODB_DATABASE=tractatus_prod
|
|
MONGODB_PORT=27017
|
|
MONGODB_URI=mongodb://tractatus:YOUR_SECURE_PASSWORD_HERE@mongodb:27017/tractatus_prod?authSource=admin
|
|
|
|
#=============================================================================
|
|
# REQUIRED: Application Configuration
|
|
#=============================================================================
|
|
NODE_ENV=production
|
|
APP_PORT=9000
|
|
BASE_URL=https://your-domain.com # Your production URL
|
|
|
|
# JWT Secret (generate with: openssl rand -base64 32)
|
|
JWT_SECRET=YOUR_JWT_SECRET_HERE # CHANGE THIS!
|
|
|
|
# Session Secret (generate with: openssl rand -base64 32)
|
|
SESSION_SECRET=YOUR_SESSION_SECRET_HERE # CHANGE THIS!
|
|
|
|
#=============================================================================
|
|
# REQUIRED: Admin Account
|
|
#=============================================================================
|
|
ADMIN_EMAIL=admin@your-domain.com
|
|
ADMIN_PASSWORD=YOUR_ADMIN_PASSWORD_HERE # CHANGE THIS!
|
|
|
|
#=============================================================================
|
|
# REQUIRED: Anthropic API (for AI-assisted features)
|
|
#=============================================================================
|
|
ANTHROPIC_API_KEY=sk-ant-your-api-key-here # Get from console.anthropic.com
|
|
|
|
#=============================================================================
|
|
# Governance Services (5 Core Components)
|
|
#=============================================================================
|
|
BOUNDARY_ENFORCER_ENABLED=true
|
|
CONTEXT_PRESSURE_ENABLED=true
|
|
CROSS_REF_VALIDATOR_ENABLED=true
|
|
PERSISTENCE_CLASSIFIER_ENABLED=true
|
|
METACOGNITIVE_VERIFIER_ENABLED=true
|
|
|
|
#=============================================================================
|
|
# Rate Limiting & Performance
|
|
#=============================================================================
|
|
RATE_LIMIT_WINDOW_MS=900000 # 15 minutes
|
|
RATE_LIMIT_MAX_REQUESTS=100 # Max requests per window
|
|
MAX_FILE_SIZE=10485760 # 10MB max upload size
|
|
|
|
#=============================================================================
|
|
# Feature Flags
|
|
#=============================================================================
|
|
BLOG_ENABLED=true
|
|
KOHA_ENABLED=true # Donation system
|
|
DEMOS_ENABLED=true # Interactive demos
|
|
ANALYTICS_ENABLED=false # Privacy-preserving analytics
|
|
|
|
#=============================================================================
|
|
# Optional: Email Configuration (for notifications)
|
|
#=============================================================================
|
|
# SMTP_HOST=smtp.example.com
|
|
# SMTP_PORT=587
|
|
# SMTP_USER=noreply@your-domain.com
|
|
# SMTP_PASSWORD=your-email-password
|
|
# SMTP_FROM_NAME=Tractatus Framework
|
|
# SMTP_FROM_EMAIL=noreply@your-domain.com
|
|
|
|
#=============================================================================
|
|
# Optional: Stripe (for Koha donations)
|
|
#=============================================================================
|
|
# STRIPE_SECRET_KEY=sk_live_your-stripe-key
|
|
# STRIPE_PUBLIC_KEY=pk_live_your-stripe-key
|
|
# STRIPE_WEBHOOK_SECRET=whsec_your-webhook-secret
|
|
|
|
#=============================================================================
|
|
# Optional: Umami Analytics (Privacy-Preserving, GDPR-Compliant)
|
|
#=============================================================================
|
|
# Umami provides cookie-free, privacy-first web analytics
|
|
# Default login after first setup: admin / umami (change immediately!)
|
|
|
|
# Generate APP_SECRET with: openssl rand -base64 32
|
|
UMAMI_APP_SECRET=YOUR_UMAMI_SECRET_HERE # CHANGE THIS!
|
|
|
|
# Database credentials for Umami PostgreSQL
|
|
UMAMI_DB_NAME=umami
|
|
UMAMI_DB_USER=umami
|
|
UMAMI_DB_PASSWORD=YOUR_UMAMI_DB_PASSWORD_HERE # CHANGE THIS!
|
|
|
|
# Port for Umami dashboard (internal, proxy via nginx)
|
|
UMAMI_PORT=3000
|
|
|
|
# Custom tracker script name (optional, for additional privacy)
|
|
# Default: 'umami' - Access at /script.js
|
|
# Custom: 'analytics' - Access at /analytics.js
|
|
UMAMI_TRACKER_SCRIPT=umami
|
|
|
|
# Disable Umami's own telemetry (privacy-first)
|
|
UMAMI_DISABLE_TELEMETRY=1
|
|
|
|
#=============================================================================
|
|
# Security Headers
|
|
#=============================================================================
|
|
HELMET_ENABLED=true
|
|
CSP_ENABLED=true
|
|
CORS_ORIGIN=https://your-domain.com # Comma-separated for multiple origins
|
|
|
|
#=============================================================================
|
|
# Logging
|
|
#=============================================================================
|
|
LOG_LEVEL=info # debug, info, warn, error
|
|
LOG_TO_FILE=true
|
|
LOG_TO_CONSOLE=true
|
|
|
|
#=============================================================================
|
|
# Development/Testing (disable in production)
|
|
#=============================================================================
|
|
# DEBUG=false
|
|
# VERBOSE_LOGGING=false
|
|
# ENABLE_DEBUGGING_ENDPOINTS=false
|