Refactor environment configuration and enhance application security checks

- Updated `.env.example` to include new environment variables for email delivery and site metadata, improving configuration clarity for deployment.
- Added a new function in `lib.rs` to enforce production environment checks, ensuring critical secrets and configurations are set before application startup.
- Removed outdated Docker and Railway configuration files to streamline the project structure and reduce maintenance overhead.

These changes enhance the security and clarity of the application's configuration, ensuring safer deployments.

Author: infinitedim

.env.example

@@ -24,12 +24,12 @@ LOG_LEVEL=debug
 # Directory used for daily-rotated log files. File logging is opt-in.
 #   - Set to a writable path (e.g. `/var/log/portfolio-backend`) to enable
 #     rotating `app.log.<date>` and `error.log.<date>` files.
-#   - Leave unset on ephemeral container platforms (Railway, Fly.io,
-#     Kubernetes, etc.) — logs stream to stdout and the platform aggregates
+#   - Leave unset on ephemeral container platforms (Fly.io, Kubernetes,
+#     etc.) — logs stream to stdout and the platform aggregates
 #     them. Writing to disk inside an ephemeral / read-only container will
 #     just panic the process at startup.
 #   - Local development defaults to `./logs` when this variable is unset.
-# LOG_DIR=logs
+LOG_DIR=logs
 
 # ----------------------------------------------------------------------------
 # Database
@@ -55,6 +55,12 @@ DB_CONNECT_TIMEOUT=30
 # Seconds before an idle connection is dropped from the pool
 DB_IDLE_TIMEOUT=600
 
+# Total time budget (in seconds) the app will keep retrying the initial DB
+# connection at startup before giving up. Defaults to 60 — enough to absorb
+# docker-compose / Railway DNS races without letting a misconfiguration
+# hang the container indefinitely.
+# DB_CONNECT_RETRY_SECS=60
+
 # ----------------------------------------------------------------------------
 # CORS
 # ----------------------------------------------------------------------------
@@ -73,11 +79,75 @@ JWT_SECRET=change_me_to_a_long_random_secret
 # Secret used to sign refresh tokens — must differ from JWT_SECRET
 REFRESH_TOKEN_SECRET=change_me_to_another_long_random_secret
 
+# `iss` claim embedded in issued JWTs (and validated on incoming tokens).
+# Defaults to "portfolio-backend" when unset.
+# JWT_ISSUER=portfolio-backend
+
+# `aud` claim embedded in issued JWTs (and validated on incoming tokens).
+# Defaults to "portfolio-frontend" when unset.
+# JWT_AUDIENCE=portfolio-frontend
+
+# ----------------------------------------------------------------------------
+# Two-Factor Authentication (TOTP)
+# ----------------------------------------------------------------------------
+# Issuer label shown in authenticator apps (Google Authenticator, 1Password,
+# Authy, etc.) when scanning the admin's TOTP QR code. Set this to your
+# real domain so users can identify the entry. Defaults to
+# "infinitedim.site" when unset.
+# TOTP_ISSUER=infinitedim.site
+
+# ----------------------------------------------------------------------------
+# Email Delivery (Contact Form)
+# ----------------------------------------------------------------------------
+# Resend API key used to deliver contact-form messages. When unset, the
+# mailer is disabled — contact submissions are still persisted to the DB
+# so the admin inbox keeps working, but no notification email is sent.
+# Get a key at https://resend.com.
+RESEND_API_KEY=re_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+
+# `from` address on outgoing emails. Must belong to a domain you have
+# verified in Resend. Defaults to "noreply@example.com" (which Resend will
+# reject).
+RESEND_FROM=noreply@yourdomain.com
+
+# Recipient address for contact-form notifications. Defaults to RESEND_FROM
+# when unset (i.e. the message is sent to yourself).
+CONTACT_EMAIL=you@yourdomain.com
+
 # ----------------------------------------------------------------------------
-# Redis
+# Site Metadata (RSS feed)
 # ----------------------------------------------------------------------------
-# Redis connection URL (used for rate limiting and caching)
-# For local Docker setup: redis://localhost:6379
+# Public URL of the frontend site. Used as the canonical link in the RSS
+# feed and as the base URL for blog post links. Defaults to
+# "https://infinitedim.vercel.app".
+SITE_URL=https://infinitedim.vercel.app
+
+# Title shown at the top of the RSS feed. Defaults to
+# "Terminal Portfolio Blog".
+SITE_TITLE=Terminal Portfolio Blog
+
+# Description shown in the RSS feed metadata.
+SITE_DESCRIPTION=Latest writings on engineering, design, and craft.
+
+# ----------------------------------------------------------------------------
+# Uploads
+# ----------------------------------------------------------------------------
+# On-disk directory used to store images uploaded via the admin panel.
+# Defaults to "uploads/blog" (relative to the working directory).
+#   - On ephemeral container platforms (Fly.io, etc.) the runtime
+#     filesystem is read-only and any value here will fail with a
+#     PermissionDenied error on first upload. Mount a persistent volume
+#     and point UPLOAD_DIR at it, or use object storage (S3/R2/etc.)
+#     instead.
+UPLOAD_DIR=uploads/blog
+
+# ----------------------------------------------------------------------------
+# Redis (reserved — not yet integrated)
+# ----------------------------------------------------------------------------
+# Redis is provisioned in docker-compose for future rate-limiting / caching
+# work but the backend code does NOT currently read REDIS_URL. Setting this
+# variable today has no effect; it is documented here only so the
+# docker-compose stack and forthcoming features stay in sync.
 REDIS_URL=redis://localhost:6379
 
 # ----------------------------------------------------------------------------
@@ -104,3 +174,13 @@ ADMIN_HASH_PASSWORD=
 # JWT bearer token from roadmap.sh — used server-side to proxy API calls.
 # Never expose this to the browser.
 ROADMAP_AUTH_TOKEN=Bearer <your_roadmap_jwt_token>
+
+# ----------------------------------------------------------------------------
+# API Documentation (Swagger UI)
+# ----------------------------------------------------------------------------
+# Whether to mount the interactive Swagger UI at `/api/docs`. The raw
+# OpenAPI spec is always served at `/api/docs/openapi.json` regardless.
+#   - Defaults to `true` (UI mounted).
+#   - Set to `false` (or `0`) to keep the spec accessible while hiding
+#     the interactive UI from public consumers in production.
+ENABLE_SWAGGER_UI=true

.github/workflows/cd-production.yml

@@ -12,7 +12,7 @@ debug/
 target/
 
 # Cargo.lock is intentionally tracked: this crate is a deployable binary, so we
-# need reproducible builds for Railway/Docker and supply-chain auditing.
+# need reproducible builds for Docker and supply-chain auditing.
 # See https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html
 
 # These are backup files generated by rustfmt

.gitignore

@@ -18,7 +18,7 @@ tower-http = { version = "0.6", features = [
   "fs",
 ] }
 # Production-grade rate limiter. Replaces the in-memory HashMap that was
-# broken behind the Railway/Vercel proxy (no X-Forwarded-For parsing) and
+# broken behind reverse proxies without X-Forwarded-For parsing and
 # allowed unbounded memory growth.
 tower_governor = { version = "0.8", default-features = false, features = [
   "axum",