eLegal Software

All-in-one practice management for law firms. Single Node app that serves both the React SPA and the API on one port — designed to run behind Plesk's Node.js extension on a single domain.

Stack

• Frontend — Vite + React 18 + TypeScript + Tailwind + Framer Motion + Recharts + lucide-react
• API — Fastify 5 + TypeScript + Zod
• DB — Drizzle ORM → DigitalOcean Managed Postgres (TLS)
• Auth — local: argon2id passwords + Postgres-backed sessions in httpOnly cookies (no third-party auth provider)
• Storage — DigitalOcean Spaces (S3-compatible, presigned uploads)
• Email — Resend
• Payments — Stripe
• Hosting — Plesk + Phusion Passenger (Node 20 LTS)

Repository layout

.
├── apps/
│   ├── api/           # Fastify server (also serves built web/dist in prod)
│   └── web/           # Vite + React SPA
├── packages/
│   └── db/            # Drizzle schema + migrations (shared)
├── certs/             # DO Postgres CA cert (do-ca.crt) — not in git
├── scripts/
│   └── plesk-deploy.sh
├── tmp/restart.txt    # touched by deploy script to bounce Passenger
└── app.js             # Plesk entrypoint (loads apps/api/dist/server.js)

Local development

Prerequisites: Node 20+, pnpm 9+, a Postgres database (managed DO instance, or local).

cp .env.example .env
# fill in DATABASE_URL, SESSION_SECRET, CSRF_SECRET (generate with `node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"`)

pnpm install
pnpm db:generate          # generate SQL migrations from schema
pnpm db:migrate           # apply to the DB

pnpm dev                  # starts api on :8080 and web on :5173 (proxies /api → :8080)

Visit http://localhost:5173.

Production build

pnpm build                # builds packages/db → apps/web → apps/api
pnpm start                # runs node app.js → apps/api/dist/server.js

The API serves apps/web/dist at / with SPA fallback and routes /api/* to Fastify handlers.

Plesk deployment (single domain)

1. Create the domain in Plesk and enable Let's Encrypt TLS.
2. Install Node.js extension (Plesk → Extensions → "Node.js"). Set Node version to 20.x in the domain's Node.js settings.
3. Pull the repo into the domain's document root via Plesk → Git, or git clone over SSH into /var/www/vhosts/yourdomain.com/httpdocs.
4. Node.js settings in the Plesk panel for that domain:
   • Application root → the repo root
   • Document root → leave as default; nginx will proxy to Passenger
   • Application startup file → app.js
   • Custom environment variables → set every entry from .env.example (Passenger does not read .env files)
5. Add DigitalOcean's Postgres CA to certs/do-ca.crt (download from the DO Postgres dashboard) and set DATABASE_CA_CERT_PATH=./certs/do-ca.crt.
6. Run the deploy script over SSH:

   bash scripts/plesk-deploy.sh
   

   This installs deps, builds, runs migrations, then touch tmp/restart.txt to bounce Passenger.
7. Stripe webhook — add https://yourdomain.com/api/stripe/webhook in the Stripe dashboard. In Plesk → Apache & nginx → "Additional nginx directives" add:

   location /api/stripe/webhook {
       proxy_request_buffering off;
   }
   

8. Auto-deploy on push (optional) — in Plesk → Git, enable "Enable additional deploy actions" and set the script to bash scripts/plesk-deploy.sh.

Environment variables

See .env.example for the full list. Highlights:

Var	Purpose
DATABASE_URL	DO Managed Postgres connection string (?sslmode=require)
DATABASE_CA_CERT_PATH	Path to DO CA cert (recommended for rejectUnauthorized: true)
SESSION_SECRET	32+ byte hex used to sign cookies and as Fastify cookie secret
CSRF_SECRET	32+ byte hex for CSRF token derivation
SPACES_*	DigitalOcean Spaces credentials + bucket
RESEND_API_KEY	Transactional email
STRIPE_*	Billing
PORT	Port for Fastify (Plesk usually injects this; falls back to 8080)
COOKIE_DOMAIN	Set to your apex domain in production (e.g. lawdesk.com); leave blank in dev

Database commands

pnpm db:generate    # create a new migration from schema changes
pnpm db:migrate     # apply pending migrations
pnpm --filter @lawdesk/db studio   # open Drizzle Studio

Auth model

• Passwords hashed with argon2id (64MB memory cost).
• Cookie holds a 32-byte random token; the DB stores its SHA-256 hash (so a DB read can't impersonate users).
• Sessions are 30-day sliding (touched on every request).
• Login rate limited: 5 failed attempts per email per 15 minutes.
• All /api/* requests automatically attach req.user if a valid session cookie is present. Use app.requireAuth / app.requireFirm as preHandler guards on protected routes.

What's next

• Wire DO Spaces upload routes for documents
• Build the /app dashboard (cases, time tracking, invoices)
• Free public tools (/tools/*)
• Stripe checkout + webhook
• Email templates via Resend
• pg-boss background jobs