Never commit configuration
Keep database URLs, wallet keys, token peppers, delivery keys, invoices, preimages, macaroons, and capabilities outside Git and logs.
INSTALL / SELF-HOST
The public interface and demos work with payments disabled. Add PostgreSQL and an invoice-only Lightning wallet when you are ready to operate the full service.
LOCAL PREVIEW
Use the development server to inspect the storefront, documentation, stats surface, and local-only demos without wallet credentials.
git clone https://github.com/The402Machine/The402Machine.git cd The402Machine npm ci npm run dev
Open http://127.0.0.1:4020. With PAYMENT_PROVIDER=disabled, the checkout catalogue and purchase endpoints remain unavailable by design.
QUALITY GATE
The same gate runs in GitHub Actions. PostgreSQL integration tests use disposable containers and must never point at production data.
npm run test -- --maxWorkers=1 npm run lint npm run typecheck npm run build npm audit --omit=dev --audit-level=high docker compose --env-file .env.example config --quiet docker build . git diff --check
PRODUCTION
Production uses an untracked .env.production. PostgreSQL stays on an internal network. The payment adapter uses a dedicated invoice-only key, and the agent protocol key is separate from delivery encryption and capability hashing.
Keep database URLs, wallet keys, token peppers, delivery keys, invoices, preimages, macaroons, and capabilities outside Git and logs.
The Compose migration job applies ordered migrations and records them in schema_migrations.
The operator may use self-hosted LNbits and LND. Wallet or WebLN success is never accepted as settlement proof.
The worker and request paths remove or hide expired resources without extending public visibility.
docker compose --env-file .env.production config --quiet docker compose --env-file .env.production build docker compose --env-file .env.production up -d docker compose --env-file .env.production ps
FULL OPERATIONS GUIDE
The repository guide covers payment bridges, reverse proxies, product persistence, migrations, deployment, and verification without publishing private production topology.