chore: bump backend version to 1.0.101

- The events table doesn't have an updated_at column
- Fixes PostgreSQL error 42703 when resetting passwords
- Password hash update now works correctly

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

.env.example

@@ -10,10 +10,13 @@ JWT_SECRET=your_very_long_random_jwt_secret_here
 # Database Configuration (PostgreSQL)
 DATABASE_CLIENT=pg
 DB_USER=picpeak
+# IMPORTANT: Avoid $ character in passwords - Docker Compose interprets it as variable substitution
+# If you must use $, escape it as $$ (e.g., Pass$$word instead of Pass$word)
 DB_PASSWORD=your_secure_postgres_password_here
 DB_NAME=picpeak_prod
 
 # Redis Configuration
+# IMPORTANT: Same warning applies - avoid $ or escape as $$
 REDIS_PASSWORD=your_secure_redis_password_here
 
 # Admin Account (initial setup)

DEPLOYMENT_GUIDE.md

@@ -23,8 +23,8 @@ This guide covers deploying PicPeak using Docker Compose with direct port exposu
 
 1. **Clone the repository**
    ```bash
-   git clone https://github.com/yourusername/wedding-photo-sharing.git
-   cd wedding-photo-sharing
+   git clone https://github.com/the-luap/picpeak.git
+   cd picpeak
    ```
 
 2. **Set up environment**
@@ -58,21 +58,29 @@ Generate secure values:
 # JWT Secret
 openssl rand -base64 64
 
-# Database Password
-openssl rand -base64 32
+# Database Password (avoid $ character - see warning below)
+openssl rand -base64 32 | tr -d '$'
 
-# Redis Password
-openssl rand -base64 32
+# Redis Password (avoid $ character - see warning below)
+openssl rand -base64 32 | tr -d '$'
 ```
 
+⚠️ **PASSWORD WARNING**: Docker Compose interprets `$` as variable substitution. Either:
+- Avoid `$` in passwords (recommended - use the commands above)
+- Escape `$` as `$$` (e.g., `Pass$$word` instead of `Pass$word`)
+- Quote the entire value: `DB_PASSWORD='Pass$word'` (less reliable)
+
 Update `.env` with:
-- `JWT_SECRET` - Authentication secret
+- `JWT_SECRET` - Authentication secret (REQUIRED - generate a secure random value)
 - `DB_PASSWORD` - PostgreSQL password
 - `REDIS_PASSWORD` - Redis password
 - `SMTP_*` - Email configuration
-- `FRONTEND_URL` - Your domain URL
-- `ADMIN_URL` - Backend admin URL
-- `VITE_API_URL` - API URL for frontend
+- **CRITICAL URL Configuration** (must match your deployment):
+  - `FRONTEND_URL` - Frontend URL with port (e.g., `http://yourdomain.com:3000`)
+  - `ADMIN_URL` - Backend URL with port (e.g., `http://yourdomain.com:3001`)
+  - `VITE_API_URL` - Backend API URL (e.g., `http://yourdomain.com:3001/api`)
+
+⚠️ **IMPORTANT**: These URLs MUST include the correct ports and match exactly how users will access your site. Mismatched URLs will cause CORS errors and login failures!
 
 ### Email Configuration Examples
 
@@ -119,20 +127,66 @@ By default, services are exposed on:
 
 ### Initial Admin Setup
 
-The admin credentials are generated during first startup. Check the logs:
+When deploying for the first time, an admin account is automatically created with a secure random password. You need to retrieve this password to access the admin panel.
 
+#### Finding the Admin Password
+
+**Option 1: Check the backend logs** (recommended)
 ```bash
-docker compose logs backend | grep -A 5 "Admin user created"
+# View the initial setup logs
+docker compose logs backend | grep -A 10 "Admin user created"
 ```
 
-Or use the helper script:
+You should see output like:
+```
+========================================
+✅ Admin user created successfully!
+========================================
+Email: admin@example.com
+Password: BraveTiger6231!
+
+⚠️  IMPORTANT:
+1. Save these credentials securely
+2. Please change the password after first login
+========================================
+```
+
+**Note**: You login with the **email address**, not a username!
+
+**Option 2: Check the saved credentials file**
 ```bash
+# The password is saved in the backend container
+docker exec picpeak-backend cat data/ADMIN_CREDENTIALS.txt
+```
+
+**Option 3: Use the helper script**
+```bash
+# Show current admin username and email (password is hidden)
 docker exec picpeak-backend node scripts/show-admin-credentials.js
 
-# To reset password
+# Reset the admin password to a new random password
 docker exec picpeak-backend node scripts/show-admin-credentials.js --reset
 ```
 
+#### Important Notes
+
+- **Login requires the email address**, not username
+- The admin password is only shown once during initial setup
+- If you lose the password, use the `--reset` option to generate a new one
+- You must change the password on first login (enforced by the system)
+- Password requirements: minimum 12 characters, mixed case, numbers, and special characters
+
+#### Configuring Admin Email
+
+By default, the admin email is `admin@example.com`. To use a different email address, set it in your `.env` file before first deployment:
+
+```env
+# .env
+ADMIN_EMAIL=your-email@yourdomain.com
+```
+
+**Note**: This only works on first deployment. To change the admin email after deployment, you'll need to update it in the database or create a new admin user through the admin panel.
+
 ## 🔒 Reverse Proxy Setup
 
 For production deployments, you should use a reverse proxy for SSL/HTTPS. The application exposes ports directly, allowing you to use any reverse proxy solution.
@@ -325,6 +379,53 @@ docker exec picpeak-backend npm run migrate
 
 ### Common Issues
 
+#### 502 Bad Gateway / Login Failures
+**This is the most common deployment issue!** Usually caused by misconfigured URLs or network problems:
+
+1. **CORS Configuration Errors**:
+   ```bash
+   # WRONG - Missing port will cause CORS errors
+   FRONTEND_URL=http://10.0.252.12
+   
+   # CORRECT - Include the port you're accessing from
+   FRONTEND_URL=http://10.0.252.12:3000
+   ```
+   
+   The backend validates Origin headers against `FRONTEND_URL` for CORS. If they don't match exactly, you'll get 500 errors on login.
+
+2. **After Container Restarts**:
+   - Nginx may have cached old container IPs
+   - Solution: `docker restart picpeak-frontend`
+   - Always wait 30-60 seconds for health checks
+
+3. **Backend Not Starting After Migrations**:
+   - The logs may only show migrations completed
+   - Check if server is actually running: `docker exec picpeak-backend ps aux | grep node`
+   - Should see `node server.js` process
+
+4. **Login After Fresh Install**:
+   - Check migration logs for generated credentials
+   - Username: `admin` or the email shown in logs
+   - Password: Shown during first migration (e.g., `SharpPhoenix9920$`)
+
+5. **Complete Fix Sequence**:
+   ```bash
+   # 1. Fix your .env file URLs
+   # 2. Full restart
+   docker-compose down
+   docker-compose up -d
+   
+   # 3. Wait for healthy status
+   sleep 60
+   docker ps  # All should show (healthy)
+   
+   # 4. Test backend directly
+   curl http://localhost:3001/health
+   
+   # 5. Test through frontend
+   curl http://localhost:3000/api/public/settings
+   ```
+
 #### Port Already in Use
 ```bash
 # Check what's using the port
@@ -336,6 +437,17 @@ FRONTEND_PORT=3002
 BACKEND_PORT=3003
 ```
 
+#### Docker Compose Variable Substitution Errors
+If you see warnings like:
+```
+WARN[0000] The "fgbf" variable is not set. Defaulting to a blank string.
+```
+
+This means your password contains `$` which Docker Compose interprets as a variable. Solutions:
+1. **Best**: Generate passwords without `$`: `openssl rand -base64 32 | tr -d '$'`
+2. **Alternative**: Escape `$` as `$$` in your .env file
+3. **Example**: `DB_PASSWORD=Pass@#$$fgbf` instead of `DB_PASSWORD=Pass@#$fgbf`
+
 #### Permission Errors
 ```bash
 # Fix ownership

README.md

@@ -71,7 +71,7 @@ docker-compose up -d
 
 ## 📖 Documentation
 
-- 📘 [**Deployment Guide**](DEPLOYMENT.md) - Detailed installation instructions
+- 📘 [**Deployment Guide**](DEPLOYMENT_GUIDE.md) - Detailed installation instructions
 - 🤝 [**Contributing**](CONTRIBUTING.md) - How to contribute
 - 📜 [**License**](LICENSE) - MIT License
 - 🔒 [**Security**](SECURITY.md) - Security policies
@@ -209,7 +209,7 @@ PicPeak is released under the [MIT License](LICENSE). Use it freely for personal
 ## 🚀 Ready to Get Started?
 
 1. ⭐ **Star this repository** to show your support
-2. 📖 Read the [Deployment Guide](DEPLOYMENT.md)
+2. 📖 Read the [Deployment Guide](DEPLOYMENT_GUIDE.md)
 3. 🐛 Report issues or request features
 4. 🤝 Join our community and contribute!
 
@@ -219,6 +219,6 @@ PicPeak is released under the [MIT License](LICENSE). Use it freely for personal
   Made with ❤️ by photographers, for photographers
   <br>
   <a href="https://github.com/the-luap/picpeak">GitHub</a> •
-  <a href="DEPLOYMENT.md">Documentation</a> •
+  <a href="DEPLOYMENT_GUIDE.md">Documentation</a> •
   <a href="https://github.com/the-luap/picpeak/issues">Support</a>
 </p>

backend/migrations/core/001_init.js

@@ -18,9 +18,13 @@ exports.up = async function(knex) {
       const generatedPassword = generateReadablePassword();
       const passwordHash = await bcrypt.hash(generatedPassword, 12); // Increased rounds for better security
       
+      // Get admin credentials from environment or use defaults
+      const adminUsername = process.env.ADMIN_USERNAME || 'admin';
+      const adminEmail = process.env.ADMIN_EMAIL || 'admin@example.com';
+      
       await knex('admin_users').insert({
-        username: 'admin',
-        email: 'admin@example.com',
+        username: adminUsername,
+        email: adminEmail,
         password_hash: passwordHash,
         created_at: new Date()
       });
@@ -36,7 +40,7 @@ PicPeak Admin Credentials
 
 Your admin account has been created with these credentials:
 
-Username: admin
+Email: ${adminEmail}
 Password: ${generatedPassword}
 
 IMPORTANT SECURITY NOTES:
@@ -47,6 +51,8 @@ IMPORTANT SECURITY NOTES:
 
 Login URL: ${process.env.ADMIN_URL || 'http://localhost:3001'}/admin
 
+Login with the email address shown above
+
 Generated on: ${new Date().toISOString()}
 ========================================
 `;
@@ -65,7 +71,7 @@ Generated on: ${new Date().toISOString()}
       console.log('\n========================================');
       console.log('✅ Admin user created successfully!');
       console.log('========================================');
-      console.log('Username: admin');
+      console.log(`Email: ${adminEmail}`);
       console.log(`Password: ${generatedPassword}`);
       console.log('\n⚠️  IMPORTANT:');
       console.log('1. Save these credentials securely');

backend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "picpeak-backend",
-  "version": "1.0.98",
+  "version": "1.0.101",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "picpeak-backend",
-      "version": "1.0.98",
+      "version": "1.0.101",
       "dependencies": {
         "@aws-sdk/client-s3": "^3.850.0",
         "@aws-sdk/lib-storage": "^3.850.0",

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "picpeak-backend",
-  "version": "1.0.98",
+  "version": "1.0.101",
   "description": "Backend for PicPeak event photo sharing platform",
   "main": "server.js",
   "scripts": {

backend/src/routes/adminEvents.js

@@ -526,16 +526,15 @@ router.post('/:id/reset-password', adminAuth, async (req, res) => {
     }
 
     // Generate new password
-    const { generatePassword } = require('../utils/passwordGenerator');
-    const newPassword = generatePassword();
+    const { generateReadablePassword } = require('../utils/passwordGenerator');
+    const newPassword = generateReadablePassword();
     const passwordHash = await bcrypt.hash(newPassword, 10);
 
     // Update event with new password
     await db('events')
       .where('id', id)
       .update({
-        password_hash: passwordHash,
-        updated_at: new Date()
+        password_hash: passwordHash
       });
 
     // Log activity

docker-compose.yml

@@ -1,5 +1,3 @@
-version: '3.8'
-
 services:
   backend:
     build:

frontend/nginx.conf

@@ -39,7 +39,7 @@ server {
 
     # API proxy
     location /api {
-        proxy_pass http://backend:3000;
+        proxy_pass http://backend:3001;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection 'upgrade';
@@ -53,7 +53,7 @@ server {
 
     # Photo serving proxy
     location /photos {
-        proxy_pass http://backend:3000;
+        proxy_pass http://backend:3001;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
@@ -67,7 +67,7 @@ server {
 
     # Thumbnail serving proxy
     location /thumbnails {
-        proxy_pass http://backend:3000;
+        proxy_pass http://backend:3001;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
@@ -81,7 +81,7 @@ server {
 
     # Uploads serving proxy (logos, favicons, watermarks)
     location /uploads {
-        proxy_pass http://backend:3000;
+        proxy_pass http://backend:3001;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;

frontend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "picpeak-frontend",
-  "version": "1.0.98",
+  "version": "1.0.100",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "picpeak-frontend",
-      "version": "1.0.98",
+      "version": "1.0.100",
       "dependencies": {
         "@tanstack/react-query": "^5.0.0",
         "@tiptap/extension-character-count": "^2.26.1",

frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "picpeak-frontend",
   "private": true,
-  "version": "1.0.98",
+  "version": "1.0.100",
   "type": "module",
   "scripts": {
     "dev": "vite",