# Soft Touch — installable package

This is a complete, installable copy of the Soft Touch codebase: the main
gateway app (this folder) plus every sub-app under `apps/`. It does NOT
contain `node_modules` (reinstall those) or any of this server's live
secrets/data (API tokens, TOTP secrets, SMTP/DB passwords, saved SSH
connections, etc.) — every app ships a `.env.example` instead of a real
`.env`, and every app's `data/` folder starts empty and self-populates on
first run (that's how this box's own `lib/jsonStore.js`-backed files already
work — each one is created with sane defaults the first time it's read).

## 1. Prerequisites (Ubuntu 24.04 VPS, matches how this box is set up)

```bash
# Node.js 20+ (this box runs Node v22.23.1)
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
sudo apt install -y nodejs

# nginx (reverse proxy + TLS termination) and certbot (Let's Encrypt)
sudo apt install -y nginx
sudo apt install -y certbot python3-certbot-nginx

# ufw (firewall) and fail2ban (brute-force protection) — the Firewall Manager
# and its rule editor in this app expect these to already be installed
sudo apt install -y ufw fail2ban

# pm2, to keep every app running persistently and restart them on reboot
sudo npm install -g pm2
```

## 2. Unpack and install dependencies

```bash
tar -xzf <this-archive>.tar.gz
cd soft-touch-terminal
npm install --production
for d in apps/*/; do (cd "$d" && npm install --production); done
```

## 3. Configure secrets

For the main app AND every folder under `apps/`, copy `.env.example` to
`.env` and fill in real values:

```bash
cp .env.example .env
node generate-password-hash.js "your-chosen-password"   # -> AUTH_PASS_HASH
node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"  # -> SESSION_SECRET
```

Do the same per sub-app (`cd apps/<name> && cp .env.example .env`) — each
one's `.env.example` documents exactly what it needs and where to get it
(SMTP app password, Contabo API credentials for DNS Manager, a CERTBOT_EMAIL
for Domain Manager, etc). Leave the Database Manager and Object Storage
Manager credential fields blank — those get generated the first time you
bootstrap that engine from their own UI, not typed in by hand.

## 4. Start the main gateway with pm2

```bash
pm2 start server.js --name soft-touch-terminal
pm2 save
pm2 startup   # follow the printed instructions to enable on boot
```

The gateway listens on `PORT` from its `.env` (default 8022).

## 5. Put it behind a subdomain + HTTPS

```nginx
server {
    listen 443 ssl;
    server_name your.domain.here;

    ssl_certificate     /etc/letsencrypt/live/your.domain.here/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/your.domain.here/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:8022;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
    }
}
```

```bash
sudo certbot --nginx -d your.domain.here
```

## 6. Log in and install the bundled sub-apps

Log in at your new domain (the `AUTH_USER`/password from step 3), then use
the **App Installer** page to install each folder already sitting under
`apps/` (Dependency Manager, DNS Manager, Domain Manager, Database Manager,
Object Storage Manager, Claude's Room, ...). Installing an app there runs its
`npm install`, starts it under pm2, and wires it up behind
`/apps/<id>/...` automatically — you don't need to hand-write nginx config
or pm2 entries per sub-app, only for the main gateway in step 5. From then on,
use the Domain Manager app itself (not hand-edited nginx) for any further
subdomains, and the Firewall Manager (ufw) / SSH key pages for lockdown.

## 7. Restoring your own data (optional)

This package intentionally ships no data. If you're moving from another Soft
Touch box rather than starting fresh, copy that box's `data/` folders and
per-app `.env` files across yourself (outside of this package) instead of
recreating everything by hand.

---
Package built automatically every 24h. The 3 most recent daily builds are
kept in this folder; older ones are deleted automatically.