Ember -> Prod

.env.example

@@ -2,16 +2,34 @@
 Nexus_Api_Key=API_KEY
 TBA_API_Key=TBA_API_KEY
 
+# Webhook Configuration
+# Token for verifying incoming webhooks from FRC Nexus
+# Get this from https://frc.nexus/api after registering your webhook endpoint
+NEXUS_WEBHOOK_TOKEN=your_nexus_webhook_token_here
+
 # Server Configuration
 PORT=3002
-NODE_ENV=development
 
 # Database Configuration
+# Why not URL? to be honest don't know.
 DB_HOST=localhost
 DB_PORT=3306
 DB_NAME=vorel
 DB_USER=vorel
 DB_PASSWORD=your_secure_password_here
 DB_ROOT_PASSWORD=your_root_password_here
 
+# Authentication Configuration
+# GitHub OAuth App credentials (create at https://github.com/settings/applications/new)
+GITHUB_CLIENT_ID=your_github_client_id_here
+GITHUB_CLIENT_SECRET=your_github_client_secret_here
+GITHUB_CALLBACK_URL=http://localhost:3002/auth/github/callback
+
+# Session secret for secure cookie signing
+SESSION_SECRET=your_very_secure_random_session_secret_here
+
+# Authorized GitHub users (comma-separated usernames)
+# Leave empty to allow any GitHub user in development
+AUTHORIZED_GITHUB_USERS=yourusername,anotheradmin
+
 # Note: In production, make sure to use strong passwords and consider using Docker secrets

.gitignore

@@ -1,3 +1,4 @@
 .env
 node_modules
-.cache
+.cache
+.encryption-key.json

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:23-alpine
+FROM node:current-alpine
 
 WORKDIR /app
 

GITHUB_OAUTH_SETUP.md

@@ -0,0 +1,115 @@
+# GitHub OAuth Setup Guide
+
+This guide will help you set up GitHub OAuth authentication for the Vorel admin panel.
+
+## 1. Create a GitHub OAuth App
+
+1. Go to [GitHub Developer Settings](https://github.com/settings/developers)
+2. Click "New OAuth App"
+3. Fill in the application details:
+   - **Application name**: `Vorel Admin` (or your preferred name)
+   - **Homepage URL**: `http://localhost:3002` (for development) or your production URL
+   - **Authorization callback URL**: `http://localhost:3002/auth/github/callback`
+4. Click "Register application"
+5. Copy the **Client ID** and **Client Secret**
+
+## 2. Configure Environment Variables
+
+Create a `.env` file in the root directory (copy from `.env.example`) and add:
+
+```bash
+# GitHub OAuth Configuration
+GITHUB_CLIENT_ID=your_client_id_here
+GITHUB_CLIENT_SECRET=your_client_secret_here
+GITHUB_CALLBACK_URL=http://localhost:3002/auth/github/callback
+
+# Session Secret (generate a secure random string)
+SESSION_SECRET=your_very_secure_random_session_secret_here
+
+# Authorized Users (comma-separated GitHub usernames)
+AUTHORIZED_GITHUB_USERS=yourusername,teammate1,teammate2
+```
+
+## 3. Generate a Secure Session Secret
+
+You can generate a secure session secret using Node.js:
+
+```bash
+node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"
+```
+
+## 4. Set Authorized Users
+
+Add the GitHub usernames of people who should have admin access to the `AUTHORIZED_GITHUB_USERS` environment variable. Separate multiple usernames with commas.
+
+**Important**: If this variable is empty or not set, anyone with a GitHub account can access the admin panel (useful for development, but not recommended for production).
+
+## 5. Production Setup
+
+For production:
+
+1. Update the OAuth app settings in GitHub to use your production domain
+2. Set `NODE_ENV=production` in your environment
+3. Use a secure session secret
+4. Consider using environment variable management tools or secrets management
+5. Ensure HTTPS is enabled (required for secure cookies)
+
+## 6. Testing
+
+1. Start your server: `npm start`
+2. Visit `http://localhost:3002/admin/notices`
+3. You should be redirected to the login page
+4. Click "Sign in with GitHub"
+5. Authorize the application
+6. You should be redirected back to the admin panel
+
+## 7. Admin Panel Features
+
+Once authenticated, you can:
+
+- View all active notices
+- Create new notices with different types (info, warning, success, danger)
+- Edit existing notices
+- Set notice priorities and expiration dates
+- Deactivate or delete notices
+- View your login status and logout
+
+## 8. API Endpoints
+
+The following admin API endpoints now require authentication:
+
+- `POST /api/notices` - Create notice
+- `PUT /api/notices/:id` - Update notice
+- `DELETE /api/notices/:id` - Delete notice
+- `POST /api/notices/:id/deactivate` - Deactivate notice
+
+Public endpoints (no auth required):
+
+- `GET /api/notices` - Get active notices (used by home page)
+
+## 9. Troubleshooting
+
+**"Missing required environment variables for GitHub OAuth"**
+- Make sure you've set `GITHUB_CLIENT_ID` and `GITHUB_CLIENT_SECRET` in your `.env` file
+
+**"User not authorized"**
+- Check that your GitHub username is in the `AUTHORIZED_GITHUB_USERS` list
+- Usernames are case-insensitive but must match exactly
+
+**"Authentication failed"**
+- Verify your OAuth app settings in GitHub
+- Check that the callback URL matches exactly
+- Ensure your client ID and secret are correct
+
+**Session issues**
+- Clear your browser cookies
+- Check that `SESSION_SECRET` is set
+- Restart the server after changing environment variables
+
+## 10. Security Notes
+
+- Never commit your `.env` file to version control
+- Use strong, unique session secrets
+- Regularly review and update authorized users
+- Consider implementing additional security measures for production (rate limiting, etc.)
+- Monitor authentication logs for suspicious activity

README.md

@@ -87,6 +87,33 @@ cp .env.example .env
    - Get a Nexus API key from [FIRST Nexus](https://frc.nexus)
    - Get a TBA API key from [The Blue Alliance](https://www.thebluealliance.com/account)
 
+### Real-time Updates Setup (Optional)
+
+Vorel supports real-time match updates via FRC Nexus webhooks for instant notifications instead of polling:
+
+1. **Configure the webhook token** in your `.env` file:
+   ```bash
+   NEXUS_WEBHOOK_TOKEN=your_webhook_token_here
+   ```
+
+2. **Register your webhook endpoint** at [frc.nexus/api](https://frc.nexus/api):
+   - **Webhook URL**: `https://your-domain.com/api/webhook/nexus`
+   - **Token**: Use the same token you set in `NEXUS_WEBHOOK_TOKEN`
+   - **Event Type**: Live event status (general) or Match status (team-specific)
+
+3. **Benefits of webhook setup**:
+   - Instant updates when match status changes (no 5-second polling delay)
+   - More efficient - only updates when there's actual data changes
+   - Lower server load and API usage
+   - Real-time notifications for teams using your instance
+
+4. **Monitoring**: 
+   - View webhook statistics in the admin dashboard at `/admin`
+   - Check endpoint `/api/webhook-stats` for webhook metrics
+   - Check endpoint `/api/sse-stats` for active connections
+
+Without webhook setup, the system will continue to work using 5-second polling, which is still very responsive.
+
 ## Usage
 
 ### Running locally

docker-compose-dockploy.yml

@@ -10,15 +10,20 @@ services:
       - PORT=${Port:-3002}
       - Nexus_Api_Key=${Nexus_Api_Key}
       - TBA_API_Key=${TBA_API_Key}
+      - NEXUS_WEBHOOK_TOKEN=${NEXUS_WEBHOOK_TOKEN}
       - DB_HOST=mariadb
       - DB_PORT=3306
       - DB_NAME=vorel
       - DB_USER=${DB_USER:-vorel}
       - DB_PASSWORD=${DB_PASSWORD}
+      - GITHUB_CALLBACK_URL=${GITHUB_CALLBACK_URL}
+      - GITHUB_CLIENT_ID=${GITHUB_CLIENT_ID}
+      - GITHUB_CLIENT_SECRET=${GITHUB_CLIENT_SECRET}
+      - AUTHORIZED_GITHUB_USERS=${AUTHORIZED_GITHUB_USERS}
     depends_on:
       - mariadb
     networks:
-      - app-network
+      - vorel-app-network
       - dokploy-network
     healthcheck:
       test: ["CMD", "wget", "-qO-", "http://localhost:${Port:-3002}/api/health"]
@@ -42,7 +47,7 @@ services:
     volumes:
       - mariadb_data:/var/lib/mysql
     networks:
-      - app-network
+      - vorel-app-network
     healthcheck:
       test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
       interval: 30s
@@ -63,7 +68,7 @@ volumes:
   mariadb_data:
 
 networks:
-  app-network:
+  vorel-app-network:
     driver: bridge
   dokploy-network:
     external: true

docker-compose.yml

@@ -12,15 +12,20 @@ services:
       - PORT=${Port:-3002}
       - Nexus_Api_Key=${Nexus_Api_Key}
       - TBA_API_Key=${TBA_API_Key}
+      - NEXUS_WEBHOOK_TOKEN=${NEXUS_WEBHOOK_TOKEN}
       - DB_HOST=mariadb
       - DB_PORT=3306
       - DB_NAME=vorel
       - DB_USER=${DB_USER:-vorel}
       - DB_PASSWORD=${DB_PASSWORD}
+      - GITHUB_CALLBACK_URL=${GITHUB_CALLBACK_URL}
+      - GITHUB_CLIENT_ID=${GITHUB_CLIENT_ID}
+      - GITHUB_CLIENT_SECRET=${GITHUB_CLIENT_SECRET}
+      - AUTHORIZED_GITHUB_USERS=${AUTHORIZED_GITHUB_USERS}
     depends_on:
       - mariadb
     networks:
-      - app-network
+      - vorel-app-network
     healthcheck:
       test: ["CMD", "wget", "-qO-", "http://localhost:${Port:-3002}/api/health"]
       interval: 30s
@@ -39,11 +44,11 @@ services:
       - MYSQL_ROOT_PASSWORD=${DB_ROOT_PASSWORD}
       - MYSQL_DATABASE=vorel
       - MYSQL_USER=${DB_USER:-vorel}
-      - MYSQL_PASSWORD=${DB_PASSWORD}    
+      - MYSQL_PASSWORD=${DB_PASSWORD}
     volumes:
       - mariadb_data:/var/lib/mysql
     networks:
-      - app-network
+      - vorel-app-network
     healthcheck:
       test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
       interval: 30s
@@ -64,5 +69,5 @@ volumes:
   mariadb_data:
 
 networks:
-  app-network:
+  vorel-app-network:
     driver: bridge