BarberSaaS
Multi-tenant barber appointment platform: Next.js 16 (App Router), React 19, MongoDB Atlas (Mongoose), Upstash Redis, Pusher, Cloudflare R2, web-push. Deployed on Vercel. Product and architecture notes: PROJECT.md. Admin operations: ADMIN_GUIDE.md. Going live: LAUNCH_CHECKLIST.md.
Run locally
npm install
cp .env.example .env.local # or create it by hand; see the table below
npm run dev # http://localhost:3000
Checks before every release: npx tsc --noEmit, npm run lint, npm run build.
Environment variables
Set in .env.local locally and in Vercel -> Project -> Settings -> Environment Variables (Production). The server checks them at start (src/lib/envCheck.ts, run from src/instrumentation.ts): a missing Required one stops a production start with a clear message (names only, never values); Recommended and Optional ones are logged. /api/health never exposes any of them.
| Variable | Level | What it does / if missing |
|---|
MONGODB_URI | Required | MongoDB Atlas connection string. |
AUTH_SECRET | Required | Signs login cookies. 32+ random characters (openssl rand -base64 48). Changing it logs everyone out. Also salts visitor-IP hashes. |
CRON_SECRET | Recommended (needed for launch) | Vercel sends it as Authorization: Bearer ... to /api/cron/daily. Without it the daily job returns 401 and slots stop extending. |
NEXT_PUBLIC_APP_URL | Recommended | Public site URL (https://yourdomain.com, no trailing slash). Used for sitemap, robots and social-preview absolute URLs. Falls back to Vercel's production domain, then localhost. |
UPSTASH_REDIS_REST_URL, UPSTASH_REDIS_REST_TOKEN | Recommended | Shared rate limiting and cache. Also accepted: UPSTASH_REDIS_REST_REDIS_URL/TOKEN, KV_REST_API_URL/TOKEN. Without it limits fall back to per-instance memory. |
PUSHER_APP_ID, PUSHER_KEY, PUSHER_SECRET, NEXT_PUBLIC_PUSHER_KEY, NEXT_PUBLIC_PUSHER_CLUSTER | Optional | Live refresh of the dashboard. All five or none. Cluster for India: ap2. |
NEXT_PUBLIC_VAPID_PUBLIC_KEY, VAPID_PRIVATE_KEY | Optional | Phone notifications. Generate once: npx web-push generate-vapid-keys. |
VAPID_SUBJECT | Optional | mailto:[email protected], sent with notifications. |
R2_ENDPOINT, R2_BUCKET, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY, R2_PUBLIC_BASE_URL | Optional | Cloudflare R2 for pictures/videos. All five or none. The public URL's host is added to the CSP and image config automatically. |
CRON_BATCH, CRON_CONCURRENCY, CRON_TIME_BUDGET_MS, SLOT_WINDOW_DAYS | Tuning | Defaults 50 / 10 / 45000 / 30. |
PUSHER_HOST, PUSHER_PORT, PUSHER_TLS, PUSH_ALLOW_ANY_HOST | Tests only | Never set in production (the app refuses to start with PUSH_ALLOW_ANY_HOST=1). |
First admin account: ADMIN_CODE=<code> ADMIN_PASSWORD='<long private password>' npx tsx scripts/create-admin.ts (the script prints which database it will change). Change that password in the admin Settings afterwards.
Scripts in scripts/ load .env.local. If that points at your real database, override MONGODB_URI on the command line before running anything destructive.
Health and monitoring
GET /api/health returns 200 {"ok":true,"db":"up"} when MongoDB answers a ping within 4 s, otherwise 503. Point an uptime monitor (UptimeRobot, BetterStack) at it. See LAUNCH_CHECKLIST.md for backups and rollback.
