Refacto

A complete from-scratch re-write of Postfacto, with a focus on simplified code, development, and deployment.

Running locally

Requires Node.js 18 or above.

npm start

The site will be available at http://localhost:5000/, using a mock Google authentication server and an in-memory database.

See CONTRIBUTING.md for full guidance on local development.

Building for deployment

You can find pre-built releases at Refacto/releases, or you can build your own:

npm run build

The output is placed in build.

Deploying

You will need to have NodeJS 18 or newer installed in the deployment environment.

cd build
npm install --omit=dev
./index.js

By default:

• no authentication providers are available (you will need to add at least one to use the service);
• an in-memory database is used (all data will be lost when the process ends);
• blank secrets are used for encryption and password hashing (you can use ./scripts/random-secrets.mjs to generate a set of secure random secrets for a deployment);
• Giphy integration is not enabled;
• haveibeenpwned integration is enabled;
• the server listens on port 5000.

See SERVICES.md and SECURITY.md for details.

The full list of recognised configuration options (and their default values) can be found in config/default.json (nested properties are joined and written in UPPER_SNAKE_CASE).

Typical values to configure are:

PORT=5000 \
SSO_GOOGLE_CLIENT_ID="<your-google-client-id>" \
SSO_GITHUB_CLIENT_ID="<your-github-client-id>" \
SSO_GITHUB_CLIENT_SECRET="<your-github-client-secret>" \
SSO_GITLAB_CLIENT_ID="<your-gitlab-client-id>" \
DB_URL="mongodb://localhost:27017/refacto" \
GIPHY_API_KEY="<your-giphy-api-key>" \
TRUST_PROXY="false" \
PASSWORD_WORK_FACTOR=10 \
PASSWORD_SECRET_PEPPER="<value-from-random-secrets.mjs>" \
ENCRYPTION_SECRET_KEY="<value-from-random-secrets.mjs>" \
TOKEN_SECRET_PASSPHRASE="<value-from-random-secrets.mjs>" \
./index.js

Services

See the services documentation for details on setting up a database and integrating with authentication providers.

Extra security

See the security documentation for details on configuring additional security for deployments.