Add production deployment guide and restrict CORS to development.

Document clearnet, TLS, and Tor setup; enable Nest CORS only in development and skip CORS_ORIGINS validation in production.

backend/src/config/validate.spec.ts

@@ -35,4 +35,12 @@ describe('validate', () => {
         expect(() => validate(validConfig({ ALTCHA_ENABLED: 'yes' }))).toThrow();
         expect(() => validate(validConfig({ POSTGRES_MIGRATIONS_RUN: '1' }))).toThrow();
     });
+
+    it('does not require CORS_ORIGINS in production', () => {
+        const { CORS_ORIGINS: _removed, ...productionBase } = validConfig({
+            NODE_ENV: 'production'
+        });
+
+        expect(() => validate(productionBase)).not.toThrow();
+    });
 });

backend/src/config/validate.ts

@@ -1,5 +1,5 @@
 import { plainToClass } from 'class-transformer';
-import { IsEnum, IsIn, IsNotEmpty, IsNumber, IsString, Max, Min, validateSync } from 'class-validator';
+import { IsEnum, IsIn, IsNotEmpty, IsNumber, IsString, Max, Min, ValidateIf, validateSync } from 'class-validator';
 import { BOOLEAN_STRING_VALUES } from '../consts/booleanStringValues';
 import type { BooleanStringValue } from '../types/BooleanStringValue';
 import { NodeEnv } from '../types/NodeEnv';
@@ -41,6 +41,7 @@ class EnvironmentVariables {
     @IsIn(BOOLEAN_STRING_VALUES)
     POSTGRES_MIGRATIONS_RUN: BooleanStringValue;
 
+    @ValidateIf((config: EnvironmentVariables) => config.NODE_ENV === NodeEnv.Development)
     @IsNotEmpty()
     @IsString()
     CORS_ORIGINS: string;

backend/src/main.ts

@@ -8,6 +8,7 @@ import { altchaMiddleware } from './middlewares/altchaMiddleware';
 import { AltchaService } from './modules/altcha/services/AltchaService';
 import { Config } from './types/config/Config';
 import { HttpMethod } from './types/HttpMethod';
+import { NodeEnv } from './types/NodeEnv';
 
 async function bootstrap() {
     const app = await NestFactory.create<NestExpressApplication>(AppModule, { bodyParser: false });
@@ -21,6 +22,7 @@ async function bootstrap() {
 
     const {
         port,
+        nodeEnv,
         corsOrigins,
         validation: {
             upload: { maxRequestBodyBytes }
@@ -52,10 +54,12 @@ async function bootstrap() {
         })
     );
 
-    app.enableCors({
-        origin: corsOrigins,
-        credentials: true
-    });
+    if (nodeEnv === NodeEnv.Development) {
+        app.enableCors({
+            origin: corsOrigins,
+            credentials: true
+        });
+    }
 
     app.set('trust proxy', 1);