Harden Rust backend deployment

ecosystem.config.cjs

@@ -1,3 +1,35 @@
+const fs = require('node:fs')
+const path = require('node:path')
+
+function loadEnvFile() {
+  const envPath = path.join(__dirname, '.env')
+  if (!fs.existsSync(envPath)) return
+
+  const lines = fs.readFileSync(envPath, 'utf8').split(/\r?\n/)
+  for (const line of lines) {
+    const trimmed = line.trim()
+    if (!trimmed || trimmed.startsWith('#')) continue
+
+    const separatorIndex = trimmed.indexOf('=')
+    if (separatorIndex === -1) continue
+
+    const key = trimmed.slice(0, separatorIndex).trim()
+    let value = trimmed.slice(separatorIndex + 1).trim()
+    if (
+      (value.startsWith('"') && value.endsWith('"')) ||
+      (value.startsWith("'") && value.endsWith("'"))
+    ) {
+      value = value.slice(1, -1)
+    }
+
+    if (key && (!process.env[key] || process.env[key] === '')) {
+      process.env[key] = value
+    }
+  }
+}
+
+loadEnvFile()
+
 module.exports = {
   apps: [
     {
@@ -52,6 +84,8 @@ module.exports = {
       env: {
         NODE_ENV: 'production',
         BACKEND_PORT: process.env.BACKEND_PORT || 6000,
+        BACKEND_HOST: process.env.BACKEND_HOST || '127.0.0.1',
+        BACKEND_ALLOWED_ORIGINS: process.env.BACKEND_ALLOWED_ORIGINS || process.env.PUBLIC_ORIGIN || '',
         TSS_BATTLES_DB: process.env.TSS_BATTLES_DB || 'tss_battles.db',
         TSS_TEAMS_DB: process.env.TSS_TEAMS_DB || 'tss_teams.db',
       },