51 lines
2.0 KiB
Markdown
51 lines
2.0 KiB
Markdown
# Kinship Directory
|
|
|
|
A private, multi-tenant community directory built with Next.js, Node.js, Tailwind CSS, and MongoDB.
|
|
|
|
## Features
|
|
|
|
- Organization-level tenant isolation on every directory and image query
|
|
- Globally unique account email, limiting each person to one organization
|
|
- Family-level write authorization, including for administrators
|
|
- Parent/adult and under-18 child profiles
|
|
- Family and individual photo uploads stored in MongoDB
|
|
- Admin-controlled organization name, logo, app icon, colors, and typography
|
|
- Invite-code member registration
|
|
- Responsive, installable Progressive Web App
|
|
|
|
## Run with Docker
|
|
|
|
Docker is the quickest option because it starts both the web application and MongoDB.
|
|
|
|
```bash
|
|
AUTH_SECRET="$(openssl rand -hex 32)" docker compose up --build
|
|
```
|
|
|
|
Open [http://localhost:3000](http://localhost:3000), choose **Create your directory**, and register the first organization administrator.
|
|
|
|
## Run with Node.js
|
|
|
|
Requirements: Node.js 22+, Yarn 1.22.22, and MongoDB 7+.
|
|
|
|
```bash
|
|
cp .env.example .env.local
|
|
yarn install
|
|
yarn dev
|
|
```
|
|
|
|
Set a random `AUTH_SECRET` of at least 32 characters in `.env.local` before deployment.
|
|
|
|
## Install on iPhone
|
|
|
|
1. Open the deployed HTTPS site in Safari and sign in.
|
|
2. Tap **Share**.
|
|
3. Tap **Add to Home Screen**.
|
|
|
|
The uploaded admin app icon is used for the favicon, PWA manifest, and iPhone home-screen icon. Use a square 512 x 512 PNG for best results.
|
|
|
|
## Security model
|
|
|
|
Account emails are normalized to lowercase and protected by a global unique MongoDB index. Directory reads always include the session organization ID. Family updates do not accept a family ID from the browser; they derive it from the signed, HTTP-only session cookie and require both family and organization IDs to match. Branding endpoints require the organization admin role. Mutating requests validate their origin, and uploaded files are size- and MIME-restricted.
|
|
|
|
For production, terminate TLS at a reverse proxy, back up the MongoDB volume, and rotate `AUTH_SECRET` using your hosting provider's secret manager.
|