Deploy without losing the inbox

Choose hosting that matches this app.

The source kit needs one long-running Node process and a persistent disk. It cannot keep its JSON storage unchanged on an ephemeral serverless function or multiple independent instances. A transactional database is the right next step when the application needs those deployment models.

For a restricted pilot, select a Node host that documents persistent volumes. Keep data outside the public folder. Configure the environment through the host’s secret settings and keep only the environment example in source control.

HOST=0.0.0.0
PORT=3000
APP_ORIGIN=https://your-real-domain.example
DATA_FILE=/your-persistent-mount/enquiries.json

These are placeholders. Set the host’s start command to npm run start:host; it reads the hosting environment directly without requiring a local .env file. Use the host’s port and actual persistent mount. APP_ORIGIN must be the HTTPS origin people use, without a trailing slash. The reverse proxy must preserve that external Host header. The app rejects a different host or browser origin.

Verify the public deployment.

Submit fictional data through the deployed form and note the receipt. Check that anonymous inbox access returns 401. Sign in, retrieve the record, restart the service, and retrieve the same ID again. A deployment that loses it has failed the storage requirement, even if the page looks fine.

Stop writes while making a file backup, restore a copy in a separate test environment, and verify that it opens. Know who checks failures, rotates credentials, manages recurring charges, and responds to an enquiry. Operator sessions and process-local rate limits reset on restart in this teaching version.

Agree what a real launch includes.

Before collecting actual customer details, review privacy and retention, durable authentication and abuse controls, backup recovery, and operational support for the intended use. This course is a working foundation, not a complete production security assessment.

Use the full app launch checklist to record the remaining responsibilities. You can extend this app, replace its storage layer, or bring a specific blocker to Zach.