Add admin VPS console (/sshv), admin-mode UX, tips persistence, HTTPS health & deployment updates

.env.example

@@ -5,6 +5,12 @@ DEVICE=vps
 ADMIN_IDS=YOUR_TELEGRAM_USER_ID
 # Bot token from @BotFather — BOT_TOKEN is the canonical name
 BOT_TOKEN=
+# WebApp init-data HMAC key used to verify Telegram WebApp payload signatures.
+# Use a secret 32-byte value (hex or base64), for example:
+#   openssl rand -hex 32
+#   openssl rand -base64 32
+# Keep this value private and never commit real secrets to git.
+WEBAPP_HMAC_KEY=
 # Legacy alias — only needed if you used TELEGRAM_BOT_TOKEN before; BOT_TOKEN takes priority
 TELEGRAM_BOT_TOKEN=
 DISCORD_CODE_GENERATION_IMAGE_URL=https://raw.githubusercontent.com/gamblecodezcom/Runewager/main/images/discord_code_generation.png

.gitignore

@@ -22,3 +22,12 @@ build/
 # System files
 .DS_Store
 Thumbs.db
+.last_rollback
+data/admin-events.log
+data/*.json
+data/backups/*
+users.json
+giveaways.json
+promo.json
+env.json
+analytics*.json

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Runewager
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -17,12 +17,9 @@ npm install
 npm start
 ```
 
-## Docker
+## Deployment
 
-```bash
-docker build -t runewager-bot .
-docker run -d --env-file .env --name runewager runewager-bot
-```
+Systemd is the only supported production deployment path (`prod-run.sh` + `runewager.service`).
 
 ## Environment Variables
 
@@ -60,7 +57,7 @@ See `.env.example` for all variables. Required: `BOT_TOKEN`, `ADMIN_IDS`.
 
 ## Health Check
 
-The bot runs an HTTP server on `PORT` (default: 3000).
+The bot runs a local health server on `PORT` (default: 3000), with HTTPS when TLS cert/key are configured and HTTP fallback if not.
 - `GET /health` returns runtime health metadata (uptime, node version, users, pending bonus count, last persist timestamp).
 - `GET /metrics` returns Prometheus-style counters/gauges for core bonus and user metrics.
 

SECURITY.md

@@ -0,0 +1,21 @@
+# Security Policy
+
+## Supported Versions
+
+We provide security updates for the latest `main` branch and the latest production deployment.
+
+## Reporting a Vulnerability
+
+Please report vulnerabilities privately to the maintainers.
+
+- Preferred: open a private security advisory on GitHub.
+- Alternative: contact project maintainers via direct admin channel.
+
+When reporting, include:
+
+- A clear description of the issue
+- Steps to reproduce
+- Potential impact
+- Suggested mitigation (if available)
+
+We aim to acknowledge reports within 72 hours and provide remediation guidance as quickly as possible.

deploy.sh

@@ -189,6 +189,8 @@ NPM_CMD="npm install --omit=dev"
 NPM_OUT=""
 if NPM_OUT=$(${NPM_CMD} 2>&1); then
     say "Dependencies installed."
+    mkdir -p "$PROJECT_DIR/data" "$PROJECT_DIR/logs"
+    touch "$PROJECT_DIR/data/sshv-sessions.json" "$PROJECT_DIR/data/admin-events.log"
 else
     warn "npm install failed — restarting bot on existing node_modules"
     warn "npm output: $NPM_OUT"