Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/teofilobetancourt/Restaurant-Equis/llms.txt

Use this file to discover all available pages before exploring further.

Restaurant Equis is a self-hosted, internal tool designed for deployment on a private LAN or a dedicated VPS where the frontend and backend share the same server. The current version (1.1.0) does not implement token-based authentication — every /api/ endpoint is publicly accessible to any client that can reach the server. This is intentional: the system is built for a trusted internal network where a kitchen display, a cashier terminal, and a manager’s laptop are all on the same local network, not the open internet.

​
No Auth Required

All endpoints accept requests without any Authorization header. You do not need an API key, JWT, or session cookie. A bare curl call is sufficient: 
# List all orders — no token needed
curl http://localhost:5000/api/ordenes

# Create a new order — just send the JSON body
curl -X POST http://localhost:5000/api/ordenes \
  -H "Content-Type: application/json" \
  -d '{
    "tipo_pedido": "mesa",
    "cedula_cliente": "V-12345678",
    "id_mesa": 3,
    "detalles": [
      { "id_plato": 1, "cantidad": 2, "subtotal": 25.00 }
    ]
  }'
The absence of authentication is a deliberate design choice for v1.1. The security boundary is the network (Nginx + firewall rules), not the API layer. See the Production Security Recommendations section below for how to harden this correctly.

​
CORS Configuration

Although the API does not use tokens, the browser’s same-origin policy enforces a first layer of protection for web clients. FastAPI’s CORSMiddleware is added in backend/main.py. The exact middleware block from source is: 
raw_origins = os.getenv("CORS_ORIGINS", "http://localhost:5173,http://158.220.100.226,http://localhost:3000")
origins = [o.strip() for o in raw_origins.split(",") if o.strip()]

app.add_middleware(
    CORSMiddleware,
    allow_origins=["*"],
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)
CORS_ORIGINS does not currently affect the running middleware. The origins list is computed from the environment variable, but allow_origins=["*"] is hardcoded in the add_middleware call — the origins variable is never passed through. Every browser origin is permitted regardless of what CORS_ORIGINS is set to. To enforce origin restrictions, change allow_origins=["*"] to allow_origins=origins in backend/main.py and redeploy.
During local development no CORS_ORIGINS value needs to be set. The middleware permits requests from any browser origin (allow_origins=["*"]), including http://localhost:3000 and http://localhost:5173 (Vite’s default dev-server port).

​
Production Security Recommendations

Even without token-based authentication, a well-configured deployment is secure for an internal restaurant environment. Follow these steps:
1

Deploy behind Nginx — never expose port 5000 publicly

Uvicorn listens on 127.0.0.1:5000 (loopback only). Nginx is the only process that should bind to port 80/443 and forward /api/ requests internally. This means the FastAPI process is unreachable from outside the server.
2

Fix CORS origin wiring before restricting origins

The current allow_origins=["*"] is hardcoded. To lock down which browser origins can make cross-origin requests, replace that literal with the computed origins list and redeploy:
# backend/main.py — change this line:
allow_origins=["*"],
# to:
allow_origins=origins,
Then set CORS_ORIGINS in your .env or systemd unit to the exact frontend URL:
CORS_ORIGINS=http://restauranteequis.158.220.100.226.nip.io
3

Keep PostgreSQL port 5432 closed to the internet

PostgreSQL should only accept connections from localhost. Never open port 5432 to external IPs. Confirm with your firewall:
# With ufw
sudo ufw deny 5432
4

Use a strong DB_PASSWORD

Set a long, random password in the backend .env file. Avoid default or short passwords for the database user, even on a private network:
DB_PASSWORD=Str0ng!R4nd0mP4ssw0rd
5

Run behind HTTPS with a TLS certificate

Obtain a TLS certificate (for example via Let’s Encrypt / Certbot) and configure Nginx to terminate SSL on port 443. This prevents credentials, order data, and inventory figures from being transmitted in plaintext over the LAN or internet.

​
Network Boundary

The intended production topology is a single Linux VPS (or LAN server) where the React frontend build artifacts and the FastAPI backend run side by side. Nginx is the only publicly reachable process: 
Internet / LAN browser
        │
        ▼  port 80 / 443
    [ Nginx ]
     /      \
    /        \
   ▼          ▼
SPA files   /api/* → http://127.0.0.1:5000
(static)        │
                ▼
          [ Uvicorn / FastAPI ]
                │
                ▼
          [ PostgreSQL :5432 ]
          (localhost only)
This architecture means that even though the API has no token authentication, an external attacker cannot reach port 5000 or port 5432 at all — only the Nginx-served paths are exposed.
Never bind Uvicorn directly to 0.0.0.0:5000 on a public server. If port 5000 is reachable from the internet, any person can call every API endpoint without restriction — reading orders, creating or deleting inventory items, and wiping supplier records. Always bind Uvicorn to 127.0.0.1 (loopback) and let Nginx handle all inbound traffic.
Authentication is a planned enhancement for future versions of Restaurant Equis. Version 1.1 targets a closed, trusted LAN deployment where all users are physical staff inside the restaurant. A future release could introduce role-based JWT authentication — for example, restricting the DELETE endpoints to manager-level tokens and the reporting endpoints to supervisors — without breaking the existing endpoint structure.

Build docs developers (and LLMs) love

Get started for freeTalk to us