# Upload and launch checklist

## Files to upload

Upload the complete project folder, including hidden files. Do not upload a real `.env` from your computer. The server must contain:

- `server.js`
- `package.json`
- `ecosystem.config.cjs`
- `.htaccess`
- `public/`
- `deploy/`

The application creates `data/workspace.json` automatically. Keep the `data` directory persistent and include it in backups.

## Create the private server configuration

On the server, copy `.env.example` to `.env`. Replace every example value:

```env
PORT=3000
HOST=127.0.0.1
APP_ORIGIN=https://bouncingroom.counding.com
FIREBASE_WEB_API_KEY=YOUR_FIREBASE_WEB_API_KEY
SESSION_SECRET=YOUR_RANDOM_SECRET_WITH_AT_LEAST_32_CHARACTERS
TRUST_PROXY=true
```

Never place `.env` inside `public/` and never share it through the website.

Do not put a user's Firebase email or password in `.env`. Each user enters their own credentials on the sign-in page. The server sends them directly to Firebase Authentication for validation and does not store them.

## Launch Node continuously

If the hosting panel has a **Node.js Application** section, use:

- Application root: the folder containing `server.js`
- Startup file: `server.js`
- Node version: 20 or newer
- Application URL: `bouncingroom.counding.com`
- Mode: Production

Add the environment values through the panel, then press **Start** or **Restart**.

For a VPS using PM2:

```sh
npm install -g pm2
pm2 start ecosystem.config.cjs
pm2 save
pm2 startup
```

Run the final command printed by `pm2 startup` so the application returns after a server restart.

## Connect the domain

For Nginx, install `deploy/bouncingroom.nginx.conf`, enable it, obtain an SSL certificate, test the configuration, and reload Nginx. The configuration forwards public HTTPS requests to the private Node address `127.0.0.1:3000`.

For cPanel/Plesk managed Node hosting, the panel normally creates this forwarding automatically when the application URL is assigned. Do not set the domain's document root to the raw project folder.

## Confirm before launch

1. Opening `https://bouncingroom.counding.com` shows the sign-in page, not a folder listing.
2. `https://bouncingroom.counding.com/server.js` is forbidden or not found.
3. Login, note creation, refresh, and sign-out work.
4. Restart the Node process and confirm saved notes remain.
5. Confirm the browser shows a valid HTTPS lock.