PTS/Church-Music
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Initial commit - Church Music Database

Browse Source
This commit is contained in:
Kristen Hercules
2026-01-27 18:04:50 -06:00
commit d367261867
336 changed files with 103545 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

59
legacy-site/documentation/configs/church-music-backend.service Normal file
View File

@@ -0,0 +1,59 @@
[Unit]
Description=Church Music Database Backend API (Flask/Gunicorn)
Documentation=https://github.com/church-hop/music-database
After=network.target postgresql.service
Wants=postgresql.service
[Service]
Type=simple
User=pts
Group=pts
WorkingDirectory=/media/pts/Website/Church_HOP_MusicData/backend
Environment="PATH=/media/pts/Website/Church_HOP_MusicData/backend/venv/bin:/usr/local/bin:/usr/bin:/bin"
EnvironmentFile=/media/pts/Website/Church_HOP_MusicData/backend/.env.systemd
# Security: Run with minimal privileges
NoNewPrivileges=true
PrivateTmp=true
ReadWritePaths=/media/pts/Website/Church_HOP_MusicData/backend/logs
# Pre-start check: Kill any rogue processes on port 8080
ExecStartPre=/media/pts/Website/Church_HOP_MusicData/backend/pre-start-check.sh
# Start command using gunicorn with inline configuration
ExecStart=/media/pts/Website/Church_HOP_MusicData/backend/venv/bin/gunicorn \
--bind 127.0.0.1:8080 \
--workers 2 \
--worker-class sync \
--timeout 60 \
--keep-alive 5 \
--access-logfile /media/pts/Website/Church_HOP_MusicData/backend/logs/access.log \
--error-logfile /media/pts/Website/Church_HOP_MusicData/backend/logs/error.log \
--log-level info \
--name church_music_backend \
app:app
# Reload gracefully
ExecReload=/bin/kill -s HUP $MAINPID
# Restart policy
Restart=always
RestartSec=10
StartLimitInterval=300
StartLimitBurst=5
# Resource limits (adjust based on your server capacity)
MemoryMax=512M
CPUQuota=50%
# Logging
StandardOutput=append:/media/pts/Website/Church_HOP_MusicData/backend/logs/service.log
StandardError=append:/media/pts/Website/Church_HOP_MusicData/backend/logs/service-error.log
SyslogIdentifier=church-music-backend
# Timeout settings
TimeoutStartSec=60
TimeoutStopSec=30
[Install]
WantedBy=multi-user.target

46
legacy-site/documentation/configs/church-music-frontend.service Normal file
View File

@@ -0,0 +1,46 @@
[Unit]
Description=Church Music Database Frontend (React Static Files)
Documentation=https://github.com/church-hop/music-database
After=network.target church-music-backend.service
Wants=church-music-backend.service
[Service]
Type=simple
User=pts
Group=pts
WorkingDirectory=/media/pts/Website/Church_HOP_MusicData/frontend/build
Environment="PATH=/usr/bin:/bin"
Environment="NODE_ENV=production"
# Security: Run with minimal privileges
NoNewPrivileges=true
PrivateTmp=true
# Start command using serve to host static files on port 5100
ExecStart=/usr/bin/serve \
-s \
-p 5100 \
--no-clipboard \
/media/pts/Website/Church_HOP_MusicData/frontend/build
# Restart policy
Restart=always
RestartSec=10
StartLimitInterval=300
StartLimitBurst=5
# Resource limits
MemoryMax=256M
CPUQuota=25%
# Logging
StandardOutput=journal
StandardError=journal
SyslogIdentifier=church-music-frontend
# Timeout settings
TimeoutStartSec=30
TimeoutStopSec=15
[Install]
WantedBy=multi-user.target

64
legacy-site/documentation/configs/nginx-http.conf Normal file
View File

@@ -0,0 +1,64 @@
# Nginx configuration for Church Music Database (HTTP)
# Location: /etc/nginx/sites-available/church-music
server {
listen 80;
listen [::]:80;
server_name houseofprayer.ddns.net;
# Increase body size for file uploads
client_max_body_size 16M;
# Logging
access_log /var/log/nginx/church-music-access.log;
error_log /var/log/nginx/church-music-error.log;
# Security Headers
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
# Backend API (proxy to port 8080)
location /api/ {
proxy_pass http://127.0.0.1:8080/api/;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
# Timeouts
proxy_connect_timeout 60s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;
# Disable buffering for real-time responses
proxy_buffering off;
}
# Frontend (React App - proxy to port 5100)
location / {
proxy_pass http://127.0.0.1:5100;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_cache_bypass $http_upgrade;
# WebSocket support (if needed)
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
# Health check endpoint
location /health {
access_log off;
return 200 "healthy\n";
add_header Content-Type text/plain;
}
}

69
legacy-site/documentation/configs/nginx-ssl.conf Normal file
View File

@@ -0,0 +1,69 @@
# Nginx configuration for Church Music Database with HTTPS/TLS
# HTTP -> HTTPS redirect
server {
listen 80;
listen [::]:80;
server_name houseofprayer.ddns.net;
# Redirect all HTTP to HTTPS
return 301 https://$server_name$request_uri;
}
# HTTPS Configuration
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name houseofprayer.ddns.net;
# SSL Certificate Configuration (Let's Encrypt)
ssl_certificate /etc/letsencrypt/live/houseofprayer.ddns.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/houseofprayer.ddns.net/privkey.pem;
# SSL Security Settings
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
ssl_prefer_server_ciphers off;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
# HSTS (uncomment after testing)
# add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
# Security Headers
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
# Frontend (React App) - Serve static build files
root /media/pts/Website/Church_HOP_MusicData/frontend/build;
index index.html;
location / {
try_files $uri $uri/ /index.html;
}
# Backend API
location /api/ {
proxy_pass http://localhost:8080/api/;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
# CORS Headers (handled by Flask but can add here as backup)
add_header 'Access-Control-Allow-Origin' '*' always;
add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
add_header 'Access-Control-Allow-Headers' 'Content-Type, Authorization' always;
# Request size limits
client_max_body_size 16M;
}
# Static files with caching
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
expires 1y;
add_header Cache-Control "public, immutable";
}
}