Fixes in deployment and passwords

README.md

@@ -184,6 +184,44 @@ cp .env.example .env
 docker compose up --build
 ```
 
+### Production Environment Variables (IMPORTANT)
+
+The root `.env` file is the **source of truth** for all Docker Compose services. The `docker-compose.yml` uses `${VAR:?...}` syntax which reads from this file. **Do not use placeholder values in production** — the backend validates them on startup and will crash.
+
+Required variables to set with real secrets:
+
+```env
+# PostgreSQL password (used by postgres, backend, n8n, exporters)
+PG_PASSWORD=<strong-random-hex>
+
+# Backend session secret (required, non-placeholder)
+SESSION_SECRET=<strong-random-hex>
+
+# Backend CORS origin (must be your real domain, not localhost)
+CORS_ORIGIN=https://farmacias.hacecalor.net
+
+# N8N admin password
+N8N_PASSWORD=<strong-random-string>
+
+# Parapharmacy API keys (required for product ingestion)
+INGEST_API_KEY=<strong-random-hex>
+ADMIN_API_KEY=<strong-random-hex>
+```
+
+Generate secrets with:
+```bash
+node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+```
+
+**After changing `PG_PASSWORD`**, you must reset the PostgreSQL volume:
+```bash
+docker compose down
+docker volume rm farmafinder_postgres_data
+docker compose up -d
+```
+
+Then re-seed data (see "First Run" below).
+
 ### Services
 
 | Service | URL | Description |
@@ -201,10 +239,27 @@ docker compose up --build
 docker compose exec backend node create-admin.js
 # Default: admin / admin123
 
-# Seed sample pharmacies
+# Seed sample pharmacies (SQLite — for local dev)
 docker compose exec backend node seed.js
+
+# Seed parapharmacy products (requires INGEST_API_KEY)
+# The n8n-init container handles this automatically on first run.
+# To re-seed manually after a PostgreSQL reset:
+docker compose exec parapharmacy-api node -e "
+const http = require('http');
+const fs = require('fs');
+const seed = JSON.parse(fs.readFileSync('/home/node/seed.json','utf8'));
+const body = JSON.stringify(seed);
+const req = http.request('http://localhost:3002/api/products/bulk', {
+  method: 'POST',
+  headers: { 'Content-Type': 'application/json', 'x-service-key': process.env.INGEST_API_KEY, 'Content-Length': Buffer.byteLength(body) }
+}, res => { let d=''; res.on('data',c=>d+=c); res.on('end',()=>console.log(d)); });
+req.write(body); req.end();
+"
 ```
 
+After a PostgreSQL volume reset, the n8n-init container will re-import workflows automatically. The backend re-creates its PG tables on startup (`initDatabase()` in `server.js`).
+
 ### N8N Setup
 
 N8N auto-creates an admin account on first start:
@@ -225,6 +280,16 @@ docker compose down
 docker compose down -v
 ```
 
+### Reset PostgreSQL Only (keep other data)
+
+```bash
+docker compose down
+docker volume rm farmafinder_postgres_data
+docker compose up -d
+# n8n-init re-imports workflows; backend re-creates tables on startup
+# Re-seed parapharmacy products (see First Run above)
+```
+
 ## Manual Setup
 
 ### 1. Install Redis
@@ -325,13 +390,27 @@ See [Parapharmacy Documentation](docs/parapharmacy.md) for details.
 
 ## Database Schema
 
-### SQLite Tables
+In production (Docker), the backend uses **PostgreSQL**. In local dev without PG, it falls back to **SQLite**.
 
-**pharmacies**: `id`, `name`, `address`, `phone`, `latitude`, `longitude`
+### PostgreSQL Tables (Production)
+
+**pharmacies**: `id`, `name`, `address`, `phone`, `latitude`, `longitude`, `opening_hours`
 
 **pharmacy_medicines**: `id`, `pharmacy_id`, `medicine_nregistro`, `medicine_name`, `price`, `stock`
 
-**users**: `id`, `username`, `password_hash`, `created_at`
+**users**: `id`, `username`, `password_hash`, `is_admin`, `address`, `latitude`, `longitude`, `created_at`
+
+**user_alerts**: `id`, `user_id`, `type`, `medicine_nregistro`, `title`, `detail`, `schedule`, `created_at`, `updated_at`
+
+**push_subscriptions**: `id`, `user_id`, `medicine_nregistro`, `medicine_name`, `endpoint`, `p256dh`, `auth`, `created_at`
+
+**push_subscriptions_pharmacy**: `id`, `user_id`, `medicine_nregistro`, `medicine_name`, `pharmacy_id`, `endpoint`, `p256dh`, `auth`, `created_at`
+
+**expo_push_tokens**: `id`, `user_id`, `expo_token`, `created_at`
+
+### SQLite Tables (Local Dev Fallback)
+
+Same schema as above minus foreign key constraints and PostgreSQL-specific types.
 
 ### Redis Cache