# Generate production secrets
openssl rand -base64 64  # For JWT_SECRET

# Configure in GitHub
gh secret set JWT_SECRET --body "YOUR_GENERATED_SECRET_HERE"
gh secret set FIRECRAWL_API_KEY --body "fc-YOUR_API_KEY"
gh secret set POSTGRES_PASSWORD --body "YOUR_SECURE_DB_PASSWORD"
gh secret set MAIL_PASSWORD --body "YOUR_EMAIL_APP_PASSWORD"

# Verify secrets are set
gh secret list

# Register domains at TransIP
# - interimplaza.nl
# - glorylabs.nl (optional)

# Configure DNS A records
# A record: @ → 136.144.174.219
# A record: www → 136.144.174.219
# A record: api → 136.144.174.219

# SSH to VPS
ssh root@136.144.174.219

# Install certbot
apt-get update
apt-get install certbot python3-certbot-nginx

# Generate certificates
certbot --nginx -d interimplaza.nl -d www.interimplaza.nl -d api.interimplaza.nl

# Auto-renewal is configured automatically
certbot renew --dry-run

cd backend

# Add dependency to pom.xml
# <dependency>
#   <groupId>com.bucket4j</groupId>
#   <artifactId>bucket4j-core</artifactId>
#   <version>8.7.0</version>
# </dependency>

# Follow guide in Rate-Limiting-Guide.md
# Estimated: 3-4 hours

// backend/src/main/java/nl/glorylabs/config/SecurityConfig.java
http.csrf(csrf -> csrf
    .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
);

// Create RequestLoggingFilter
// Log all API requests with: method, path, IP, user, timestamp

// Add more restrictive CSP
.contentSecurityPolicy(csp -> csp
    .policyDirectives("default-src 'self'; " +
        "script-src 'self'; " +  // Remove 'unsafe-inline'
        "style-src 'self'; " +
        "img-src 'self' data: https:;"))

// Step 1: Add service to components
constructor(private logger: LoggingService) {}

// Step 2: Replace console.log
// BEFORE:
console.log('User logged in', user);

// AFTER:
this.logger.info('User logged in', user);

// Files to update (23 occurrences):
// 1. main.ts (1)
// 2. error.interceptor.ts (4)
// 3. auth.service.ts (3)
// 4. app.config.ts (9 - keep for GlobalErrorHandler)
// 5. hibp.service.ts (2)
// 6. job-detail.component.ts (3)
// 7. job-list.ts (1)

# Backend tests (Priority: Auth, Job, Application services)
cd backend
./mvnw test

# Target: 70% coverage
# Current: ~20%
# Need: +50% coverage = ~15-20 new test classes

# frontend/recruitment-portal/e2e/features/

# Critical user flows:
1. User registration → verification → login
2. Job search → job detail → apply
3. Admin login → job management
4. Password reset flow

# Run coverage reports
cd backend
./mvnw clean test jacoco:report

# View report
open target/site/jacoco/index.html

# Identify uncovered critical paths
# Write tests for red areas

@Cacheable(value = "jobs", key = "#id")
public JobDto getJobById(Long id) {
    return jobRepository.findById(id)
        .map(this::mapToDto)
        .orElseThrow(() -> new ResourceNotFoundException("Job not found"));
}

@Cacheable(value = "jobList", key = "#filter.hashCode()")
public Page<JobDto> getJobs(JobFilterDto filter, Pageable pageable) {
    // existing implementation
}

// frontend: Use CDK virtual scrolling for long lists
import { ScrollingModule } from '@angular/cdk/scrolling';

<cdk-virtual-scroll-viewport itemSize="120" class="job-list-viewport">
  <div *cdkVirtualFor="let job of jobs" class="job-item">
    <!-- job content -->
  </div>
</cdk-virtual-scroll-viewport>

// Add indexes
@Table(name = "jobs", indexes = {
    @Index(name = "idx_job_title", columnList = "title"),
    @Index(name = "idx_job_location", columnList = "location"),
    @Index(name = "idx_job_created", columnList = "created_at")
})

// Use N+1 query prevention
@EntityGraph(attributePaths = {"company", "applications"})
List<Job> findAllWithDetails();

// Add @Timed annotations to critical endpoints
@Timed(value = "api.jobs.search", description = "Time taken to search jobs")
public Page<JobDto> searchJobs(String query) {
    // implementation
}

# Use LoggingService in all new components
constructor(private logger: LoggingService) {}
this.logger.debug('Component initialized', this.data);

# Always write tests BEFORE merging to main
./mvnw test
npm test

# Check code coverage locally
./mvnw clean test jacoco:report
npm run test:coverage

# Always test in Docker first
docker-compose up --build

# Verify all health checks pass
curl http://localhost:8080/api/actuator/health

# Check logs for errors
docker-compose logs -f backend

# Access Grafana
http://localhost:3000 (admin/admin)

# Check Prometheus metrics
http://localhost:9090

# View application metrics
http://localhost:8080/api/actuator/metrics