# Go-live guide — jerseyfanshop.com

The store is production-ready code. The only things left need *your* accounts
(hosting + domain DNS), which can't be done from a dev machine. Pick one path:

## Option A — Render (easiest, ~10 minutes)

1. Push this folder to a GitHub repo (make sure `.env` is NOT committed —
   `.gitignore` already excludes it).
2. Go to https://render.com → **New → Blueprint**, point it at the repo.
   It reads `render.yaml` automatically.
3. When prompted, fill in the environment variables:
   - `STRIPE_SECRET_KEY` / `STRIPE_PUBLISHABLE_KEY` — from your `.env`
   - `ADMIN_KEY` — from your `.env` (used to unlock `/admin.html`)
   - `BASE_URL` = `https://jerseyfanshop.com`
   - `STRIPE_WEBHOOK_SECRET` — created in step 5
4. Render gives you a `*.onrender.com` URL — the site is live immediately.
5. In Stripe Dashboard → Developers → Webhooks → **Add endpoint**:
   - URL: `https://jerseyfanshop.com/api/webhook`
   - Event: `checkout.session.completed`
   - Copy the `whsec_...` into the `STRIPE_WEBHOOK_SECRET` env var.
6. At your domain registrar (wherever jerseyfanshop.com DNS lives), add a
   CNAME record: `www` → your onrender URL, and/or an A/ALIAS record on the
   root per Render's **Custom Domains** instructions. Wait for DNS (minutes
   to a few hours).

## Option B — Any VPS (DigitalOcean, Hetzner, EC2…)

```bash
# on the server, with Node 18+ and Docker installed:
docker build -t jerseyfanshop .
docker run -d --restart unless-stopped -p 80:3000 \
  -e STRIPE_SECRET_KEY=sk_live_... \
  -e STRIPE_PUBLISHABLE_KEY=pk_live_... \
  -e ADMIN_KEY=change-me \
  -e BASE_URL=https://jerseyfanshop.com \
  -e STRIPE_WEBHOOK_SECRET=whsec_... \
  --name jerseyfanshop jerseyfanshop
```

Put a reverse proxy with TLS in front (Caddy is two lines):

```
jerseyfanshop.com {
  reverse_proxy localhost:3000
}
```

Point the domain's A record at the server IP.

## Option C — Railway / Fly.io

Both detect the Node app automatically (`npm ci` + `npm start`); set the same
environment variables as above.

## After launch checklist

- [ ] Place one real (or test-mode) order end-to-end.
- [ ] Confirm the order appears in `/admin.html` (unlock with `ADMIN_KEY`).
- [ ] Confirm the Stripe webhook shows deliveries in the dashboard.
- [ ] Add your business name/address to the footer if your jurisdiction
      requires it for e-commerce (many do).
- [ ] Rotate the Stripe secret key if it was ever exposed in chat/commits
      (dashboard.stripe.com/apikeys), then update the env var.

## Test before going live (recommended)

Swap in a **test** key pair from https://dashboard.stripe.com/test/apikeys,
buy a jersey with card `4242 4242 4242 4242` (any future expiry, any CVC),
and confirm the flow — then swap the live keys back in.