update

README.md

@@ -10,24 +10,10 @@ license: agpl-3.0
 secrets:
   - name: HF_TOKEN
     description: HF token with WRITE access — enables DB+uploads backup persistence to a private HF Dataset.
-  - name: JWT_SECRET
-    description: (Optional) Random 48-byte string. Auto-generated on first boot and persisted to backup.
   - name: CLOUDFLARE_WORKERS_TOKEN
-    description: (Optional) Cloudflare API token (Workers Scripts → Edit) to auto-provision an outbound proxy.
-  - name: RESEND_API_KEY
-    description: (Optional) Resend key for sending email activation links. Without it, registration is auto-activated.
-  - name: STORAGE_PROVIDER
-    description: (Optional) "local" (default) or "cloudflare" to offload media to R2.
-  - name: CLOUDFLARE_ACCOUNT_ID
-    description: (Optional, if STORAGE_PROVIDER=cloudflare) R2 account ID.
-  - name: CLOUDFLARE_ACCESS_KEY
-    description: (Optional, if STORAGE_PROVIDER=cloudflare) R2 access key ID.
-  - name: CLOUDFLARE_SECRET_ACCESS_KEY
-    description: (Optional, if STORAGE_PROVIDER=cloudflare) R2 secret access key.
-  - name: CLOUDFLARE_BUCKETNAME
-    description: (Optional, if STORAGE_PROVIDER=cloudflare) R2 bucket name.
-  - name: CLOUDFLARE_BUCKET_URL
-    description: (Optional, if STORAGE_PROVIDER=cloudflare) R2 public bucket URL.
+    description: Cloudflare API token to auto-provision an outbound proxy.
+  - name: UPTIMEROBOT_API_KEY
+    description: UptimeRobot API key for automatic monitor setup.
 ---
 
 [![GitHub Stars](https://img.shields.io/github/stars/somratpro/huggingpost?style=flat-square)](https://github.com/somratpro/huggingpost)

start.sh

@@ -78,6 +78,12 @@ export NEXT_PUBLIC_UPLOAD_STATIC_DIRECTORY="${NEXT_PUBLIC_UPLOAD_STATIC_DIRECTOR
 export IS_GENERAL="${IS_GENERAL:-true}"
 export NX_ADD_PLUGINS="${NX_ADD_PLUGINS:-false}"
 export NODE_ENV="${NODE_ENV:-production}"
+# HF Space proxy rewrites Set-Cookie Domain to .hf.space which is a public
+# suffix — browsers reject such cookies. NOT_SECURED=true makes the backend
+# also send the JWT as an `auth` response header; the frontend JS reads it
+# and sets the cookie via document.cookie (no domain attr) so it lands on
+# the exact hostname and the browser accepts it.
+export NOT_SECURED="${NOT_SECURED:-true}"
 
 # Sync config
 export SYNC_INTERVAL="${SYNC_INTERVAL:-300}"