[Vercel Deployment]

backend/app/security/turnstile.py

@@ -17,7 +17,7 @@ async def verify_turnstile_token(token: str, ip_address: str = None) -> bool:
 
     verify_url = "https://challenges.cloudflare.com/turnstile/v0/siteverify"
     payload = {
-        "secret": settings.TURNSTILE_SECRET_KEY or "1x0000000000000000000000000000000AA",
+        "secret": settings.TURNSTILE_SECRET_KEY,
         "response": token
     }
 

backend/main.py

@@ -2,6 +2,8 @@ from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.staticfiles import StaticFiles
 from contextlib import asynccontextmanager
+import os
+from uvicorn.middleware.proxy_headers import ProxyHeadersMiddleware
 from slowapi import _rate_limit_exceeded_handler
 from slowapi.errors import RateLimitExceeded
 from app.api.user_routes import router as user_router
@@ -23,16 +25,32 @@ async def lifespan(app: FastAPI):
     pass
     yield
 
+is_production = os.environ.get("ENVIRONMENT", "development") == "production"
+
 app = FastAPI(
     title="Spotix",
-    lifespan=lifespan
+    lifespan=lifespan,
+    docs_url=None if is_production else "/docs",
+    redoc_url=None if is_production else "/redoc",
+    openapi_url=None if is_production else "/openapi.json"
+)
+
+app.add_middleware(ProxyHeadersMiddleware, trusted_hosts=["*"])
+
+app.add_middleware(
+    SessionMiddleware, 
+    secret_key=os.environ.get("SESSION_SECRET_KEY", "neural-vault-oauth-session-secret-9912"),
+    https_only=is_production
 )
 
-app.add_middleware(SessionMiddleware, secret_key="neural-vault-oauth-session-secret-9912")
+frontend_url = os.environ.get("FRONTEND_URL", "http://localhost:3000")
+origins = [frontend_url]
+if frontend_url != "http://localhost:3000":
+    origins.append("http://localhost:3000")
 
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["http://localhost:3000"],
+    allow_origins=origins,
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],

frontend/app/login/page.tsx

@@ -74,14 +74,15 @@ export default function LoginPage() {
         }
 
         try {
+            const baseUrl = process.env.NEXT_PUBLIC_BACKEND_URL || "http://localhost:8000";
             if (mode === 'login') {
-                const res = await axios.post("http://localhost:8000/auth/login", { identifier, password }, {
+                const res = await axios.post(`${baseUrl}/auth/login`, { identifier, password }, {
                     headers: { "cf-turnstile-response": turnstileToken }
                 });
                 localStorage.setItem("access_token", res.data.access_token);
                 window.location.href = "/dashboard";
             } else {
-                const res = await axios.post("http://localhost:8000/users/register", { email, username, password }, {
+                const res = await axios.post(`${baseUrl}/users/register`, { email, username, password }, {
                     headers: { "cf-turnstile-response": turnstileToken }
                 });
                 setSuccessMessage(res.data.message || "Account created! Check your email to verify.");
@@ -206,7 +207,7 @@ export default function LoginPage() {
                         
                         <div className="flex justify-center mt-4">
                             <Turnstile 
-                                siteKey={process.env.NEXT_PUBLIC_TURNSTILE_SITE_KEY || '1x00000000000000000000AA'} 
+                                siteKey={process.env.NEXT_PUBLIC_TURNSTILE_SITE_KEY!} 
                                 onSuccess={(token) => setTurnstileToken(token)}
                                 onError={() => setError("Turnstile security check failed.")}
                                 onExpire={() => setTurnstileToken("")}
@@ -244,7 +245,7 @@ export default function LoginPage() {
                     </div>
 
                     <a 
-                        href="http://localhost:8000/auth/google/login"
+                        href={`${process.env.NEXT_PUBLIC_BACKEND_URL || 'http://localhost:8000'}/auth/google/login`}
                         className="w-full mt-8 py-4 rounded-xl flex items-center justify-center gap-3 bg-theme-text/5 hover:bg-[var(--theme-text)]/10 border border-theme-border transition group cursor-pointer"
                     >
                         <svg className="w-5 h-5" viewBox="0 0 24 24">

frontend/components/upload/UploadZone.tsx

@@ -53,7 +53,8 @@ export default function UploadZone({ autoAnalyze = false }: { autoAnalyze?: bool
             };
             if (token) headers["Authorization"] = `Bearer ${token}`;
 
-            const uploadRes = await axios.post("http://localhost:8000/files/upload", formData, {
+            const baseUrl = process.env.NEXT_PUBLIC_BACKEND_URL || "http://localhost:8000";
+            const uploadRes = await axios.post(`${baseUrl}/files/upload`, formData, {
                 withCredentials: true,
                 headers
             });
@@ -66,7 +67,8 @@ export default function UploadZone({ autoAnalyze = false }: { autoAnalyze?: bool
             const pollInterval = setInterval(async () => {
                 if (!polling) return;
                 try {
-                    const statusRes = await axios.get(`http://localhost:8000/files/${fileId}`, {
+                    const baseUrl = process.env.NEXT_PUBLIC_BACKEND_URL || "http://localhost:8000";
+                    const statusRes = await axios.get(`${baseUrl}/files/${fileId}`, {
                         withCredentials: true,
                         headers
                     });

frontend/lib/api.ts

@@ -9,7 +9,7 @@ const getToken = () => {
 };
 
 export const api = axios.create({
-    baseURL: 'http://localhost:8000',
+    baseURL: process.env.NEXT_PUBLIC_BACKEND_URL || 'http://localhost:8000',
     withCredentials: true
 });
 

render.yaml

@@ -0,0 +1,64 @@
+services:
+  - type: web
+    name: spotix-api
+    env: python
+    buildCommand: "cd backend && pip install -r requirements.txt"
+    startCommand: "cd backend && uvicorn main:app --host 0.0.0.0 --port $PORT --forwarded-allow-ips='*' --proxy-headers"
+    envVars:
+      - key: DATABASE_URL
+        sync: false
+      - key: REDIS_URL
+        sync: false
+      - key: JWT_SECRET
+        generateValue: true
+      - key: TURNSTILE_SECRET_KEY
+        sync: false
+      - key: ENVIRONMENT
+        value: production
+      - key: FRONTEND_URL
+        sync: false
+      - key: R2_ENDPOINT_URL
+        sync: false
+      - key: R2_ACCESS_KEY_ID
+        sync: false
+      - key: R2_SECRET_ACCESS_KEY
+        sync: false
+      - key: R2_BUCKET_NAME
+        sync: false
+
+  - type: worker
+    name: spotix-celery
+    env: python
+    buildCommand: "cd backend && pip install -r requirements.txt"
+    startCommand: "cd backend && celery -A app.worker.celery_app worker --loglevel=info -P solo"
+    envVars:
+      - key: DATABASE_URL
+        fromService:
+          type: web
+          name: spotix-api
+          envVarKey: DATABASE_URL
+      - key: REDIS_URL
+        fromService:
+          type: web
+          name: spotix-api
+          envVarKey: REDIS_URL
+      - key: R2_ENDPOINT_URL
+        fromService:
+          type: web
+          name: spotix-api
+          envVarKey: R2_ENDPOINT_URL
+      - key: R2_ACCESS_KEY_ID
+        fromService:
+          type: web
+          name: spotix-api
+          envVarKey: R2_ACCESS_KEY_ID
+      - key: R2_SECRET_ACCESS_KEY
+        fromService:
+          type: web
+          name: spotix-api
+          envVarKey: R2_SECRET_ACCESS_KEY
+      - key: R2_BUCKET_NAME
+        fromService:
+          type: web
+          name: spotix-api
+          envVarKey: R2_BUCKET_NAME