Skip to content
LionPOS

Architecture (monorepo)

Backend process

Section titled “Backend process”
  • Entry: apps/backend/src/main.ts — creates NestExpressApplication, applies applyGlobalHttpConfig, mounts static SPAs when build artifacts exist.
  • CORS: CORS_ORIGIN — comma-separated origins; default http://localhost:5173.
  • Port: PORT (default 3000).

For Throttler, ValidationPipe, Swagger exclusions, and module imports, see Backend architecture (NestJS). For controller namespaces, see Backend modules.

HTTP hardening

Section titled “HTTP hardening”
  • Helmet is applied in bootstrap-http.ts (CSP relaxed for Swagger UI).
  • ValidationPipe: whitelist, forbid non-whitelisted properties, transform enabled.

Static SPAs

Section titled “Static SPAs”
  • Built admin and vendor apps can be served from apps/backend/static/ — see mountStaticSpasIfPresent in bootstrap-static-spas.ts.
  • Admin assets: prefix /admin.
  • Vendor is the default app at /; paths reserved for API and Swagger are not handed to the vendor SPA (/api, /admin, Swagger UI + JSON under SWAGGER_PATH, … — see isReservedNonVendorPath).

Container image (production-shaped)

Section titled “Container image (production-shaped)”
  • Root Dockerfile: multi-stage build runs npm run build:deploy (admin → vendor → backend), copies apps/backend/dist and apps/backend/static into the runtime image, exposes PORT (default 3000), and uses a health check against GET /api/v1/health.
  • Vite is built with VITE_API_URL= (empty) so browser calls use a same-origin relative base (/api/v1/…) when the UI and API share one host.

CI

Section titled “CI”
  • .github/workflows/docker-build.yml — builds the image on push/PR to main/master (docker/build-push-action, no push; tag indochina-pos:ci). Use it to verify the Dockerfile after dependency or build changes.

Deploy without Docker

Section titled “Deploy without Docker”
  • deploy/deploy-to-vps.sh — optional rsync + SSH flow for a VPS (PM2 or systemd). Configure deploy/.env.deploy from deploy/env.deploy.example. Targets: admin, vendor, backend, or all.

Organization-specific notes

Section titled “Organization-specific notes”

Document separately for each environment: TLS termination, CDN or reverse proxy rules, and where static/admin and static/vendor are produced in your pipeline if not using the repo Dockerfile.