# Backend setup on cPanel (api.annhurst-ts.com)

## 1. Node.js app settings

In cPanel → **Setup Node.js App**:

| Setting | Value |
|---------|--------|
| Node.js version | 20.x |
| Application mode | Production |
| Application root | folder containing `server.js` and `package.json` |
| Application URL | `api.annhurst-ts.com` |
| Application startup file | `server.js` |

Click **Run NPM Install**, then **Restart**.

## 2. Environment variables (required)

Add these in the Node.js app **Environment Variables** section:

```
DATABASE_URL=postgresql://USER:PASSWORD@HOST:5432/DATABASE
DATABASE_SSL=false
JWT_SECRET=your-long-random-secret
CORS_ORIGIN=https://ats.annhurst-ts.com
API_PUBLIC_URL=https://api.annhurst-ts.com
```

Use your real PostgreSQL credentials from cPanel → PostgreSQL Databases.

If the host only accepts SSL, set `DATABASE_SSL=true`.

## 3. Required folders on the server

After deploy, these must exist next to `server.js`:

- `lib/` (helper modules — **required**)
- `routes/` (API routes)
- `middleware/`
- `utils/`
- `public/uploads/`
- `node_modules/` (from NPM Install)

## 4. Grant database permissions (important)

If API routes return **500** and logs show `permission denied for table settings`,
the PostgreSQL user in `DATABASE_URL` does not have access to the imported tables.

1. Open `postgres-import/59-grants.sql`
2. Replace `YOUR_DB_USER` with your PostgreSQL username (from `DATABASE_URL`)
3. Paste and run it in the PostgreSQL SQL tab

Or in cPanel → **PostgreSQL Databases**, make sure your app user is added to the
database with **ALL PRIVILEGES**.

## 5. Verify the API is running

Open in a browser:

- `https://api.annhurst-ts.com/health` → `{"status":"ok","service":"annhurst-api"}`
- `https://api.annhurst-ts.com/health/db` → should show `"database":"connected"`
- `https://api.annhurst-ts.com/api/settings` → should return settings JSON (not 500)

If you see **503 Service Unavailable**, open **Setup Node.js App → Open log** and look for errors like:

- `Cannot find module '../../lib/compat'` → upload/redeploy the `lib/` folder
- `DATABASE_URL` / connection refused → fix database env vars
- `permission denied for table` → run `59-grants.sql` (see section 4)
- `EADDRINUSE` → restart the Node app from cPanel

## 5. CORS note

The browser CORS errors on the frontend usually mean the API is **down** (503), not a separate CORS misconfiguration. Fix the Node app first; CORS headers are sent automatically when the API responds.