# .env.production
# Servidor
PORT=3001
HOST=0.0.0.0
NODE_ENV=production
JWT_SECRET=tu-clave-secreta-muy-larga-y-aleatoria-minimo-32-chars

# Evolution API
EVOLUTION_API_URL=https://api.evolution.com
EVOLUTION_API_KEY=sk_live_xxxxxxxxxx
EVOLUTION_INSTANCE_NAME=produccion
EVOLUTION_WEBHOOK_SECRET=webhook-secret-seguro

# Base de datos
DATABASE_URL=postgresql://user:password@db.host.com:5432/camarauth

# Seguridad
CORS_ORIGINS=https://miapp.com,https://www.miapp.com
RATE_LIMIT_ENABLED=true
RATE_LIMIT_MAX_REQUESTS=100

# Monitoreo
SENTRY_DSN=https://xxx@yyy.ingest.sentry.io/zzz
LOG_LEVEL=info

# Dockerfile
FROM node:20-alpine

WORKDIR /app

COPY package*.json ./
RUN npm ci --only=production

COPY . .
RUN npm run build

EXPOSE 3001

USER node

CMD ["node", "dist/index.js"]

# docker-compose.yml
version: '3.8'

services:
  app:
    build: .
    ports:
      - "3001:3001"
    environment:
      - NODE_ENV=production
      - DATABASE_URL=postgresql://postgres:postgres@db:5432/camarauth
      - JWT_SECRET=${JWT_SECRET}
    depends_on:
      - db
    restart: unless-stopped

  db:
    image: postgres:15-alpine
    volumes:
      - postgres_data:/var/lib/postgresql/data
    environment:
      - POSTGRES_USER=postgres
      - POSTGRES_PASSWORD=postgres
      - POSTGRES_DB=camarauth
    restart: unless-stopped

volumes:
  postgres_data:

# Instalar Certbot
sudo apt-get install certbot python3-certbot-nginx

# Obtener certificado
sudo certbot --nginx -d api.tudominio.com

# Auto-renovación
sudo certbot renew --dry-run

// Usar HTTPS en producción
import https from 'https';
import fs from 'fs';

if (process.env.NODE_ENV === 'production') {
  const options = {
    key: fs.readFileSync('/etc/letsencrypt/live/api.tudominio.com/privkey.pem'),
    cert: fs.readFileSync('/etc/letsencrypt/live/api.tudominio.com/fullchain.pem')
  };
  
  https.createServer(options, app).listen(443);
}

-- Crear usuario y base de datos
CREATE USER camarauth WITH PASSWORD 'password-seguro';
CREATE DATABASE camarauth OWNER camarauth;

-- Configurar conexiones
ALTER SYSTEM SET max_connections = '200';
ALTER SYSTEM SET shared_buffers = '256MB';

# Usando tu herramienta favorita
npx prisma migrate deploy
# o
npx typeorm migration:run

// Endpoint de health check (ya incluido)
app.get('/health', async (req, res) => {
  const checks = {
    database: await checkDatabase(),
    evolution: await checkEvolutionAPI(),
    timestamp: new Date().toISOString()
  };
  
  const isHealthy = Object.values(checks).every(c => c.status === 'ok');
  
  res.status(isHealthy ? 200 : 503).json(checks);
});

// Logger estructurado en producción
import { createProductionLogger } from 'camarauth-sdk/backend';

const logger = createProductionLogger();

// Uso
logger.info('PIN registrado', {
  pinId: pin.id,
  userId: user.id,
  timestamp: new Date().toISOString()
});

import * as Sentry from '@sentry/node';

Sentry.init({
  dsn: process.env.SENTRY_DSN,
  environment: process.env.NODE_ENV,
  tracesSampleRate: 0.1
});

// Capturar errores
app.use(Sentry.Handlers.errorHandler());

// Configuración con Redis
import Redis from 'ioredis';
import { createAdapter } from '@socket.io/redis-adapter';

const pubClient = new Redis(process.env.REDIS_URL);
const subClient = pubClient.duplicate();

io.adapter(createAdapter(pubClient, subClient));

# UFW (Ubuntu)
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

import helmet from 'helmet';

app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      connectSrc: ["'self'", "wss:", "https:"]
    }
  },
  hsts: {
    maxAge: 31536000,
    includeSubDomains: true,
    preload: true
  }
}));