# Notes

A small self-hosted notes app. Write in Markdown, preview instantly, and reach
the same notes from any device — because they all talk to the one server,
there's nothing to "sync." Only one account can log in, and there's no
sign-up page, so it's safe to expose beyond your LAN.

## Set up

```sh
pnpm install
cp .env.example .env
```

Generate a password hash and put it in `.env`:

```sh
pnpm run hash-password "your-password"
```

This prints an `ADMIN_PASSWORD_HASH=...` line — paste it into `.env`. Also
set `ADMIN_USERNAME` and a random `SESSION_SECRET` in `.env` (instructions are
in `.env.example`). `PORT` and `COOKIE_SECURE` are explained below.

## Start it

```sh
pnpm start
```

The server prints something like:

```
Notes app running.

  Local:    http://localhost:3000
  Network:  http://192.168.1.142:3000

Open the Network URL from any device on the same Wi-Fi/LAN.
```

Open the printed URL and log in with the `ADMIN_USERNAME` / password you
picked above. Check "Remember me" to stay logged in for 30 days; leave it
unchecked to be logged out when you close the browser.

If another device can't connect, check that your firewall allows inbound
connections on the port you're using, and that both devices are on the same
network (not one on Wi-Fi guest network / VPN while the other isn't).

## How notes are stored

Each note is a plain `.md` file in `data/notes/`, with a small header for the
title and timestamps. Since every device talks to the same server, edits from
any device land in the same files — open a note on your laptop, keep editing
it on your phone, and it's the same note. The most recent save wins if you
somehow edit the exact same note from two devices at once.

Because they're just Markdown files, you can back them up, put `data/notes/`
under version control, or edit them directly with another editor if you want.

## Using it

- **New note** — the `+` button in the sidebar, or Ctrl/Cmd+N.
- **Edit / Split / Preview** — toggle at the top of the editor. Split shows
  the Markdown source and the rendered preview side by side, updated as you
  type.
- Notes save automatically shortly after you stop typing (the status in the
  toolbar shows Saving… / Saved).
- **Delete** removes a note permanently.

## Keeping it running

By default the app stops when you close the terminal. If you want it always
available, run it in a way that survives logout — e.g. inside `tmux`/`screen`,
with a process manager like `pm2`, or as a `systemd` service.

Example `systemd` unit (adjust paths and user):

```ini
[Unit]
Description=Notes app
After=network.target

[Service]
WorkingDirectory=/home/elise/Dev/notes
ExecStart=/usr/bin/pnpm start
EnvironmentFile=/home/elise/Dev/notes/.env
Restart=on-failure
User=elise

[Install]
WantedBy=multi-user.target
```

## Hosting it on a public server (e.g. OVH)

Once this is reachable from the internet rather than just your LAN, two
things matter:

**1. Put it behind HTTPS.** The app itself only speaks plain HTTP. Run a
reverse proxy in front of it — Caddy is the least fuss (automatic
certificates):

```
notes.example.com {
  reverse_proxy localhost:3000
}
```

nginx + certbot works too if you already run nginx. Once HTTPS is actually
working end-to-end, set `COOKIE_SECURE=true` in `.env` and restart — this
tells the browser to only ever send your login cookie over HTTPS.

**2. Firewall the port the app listens on.** With a reverse proxy handling
public traffic on 443, block direct external access to the app's own port
(3000 by default) — e.g. with `ufw`, only allow it from `localhost`. Only the
proxy should be able to reach it directly.

Login attempts are already rate-limited (10 per 15 minutes per IP), and there
is no sign-up route at all — the only way in is the one account in `.env`.

## Changing the port

```sh
PORT=4000 pnpm start
```