Studio guide (HTML)
Phase 6 ops
Readable in the browser. Use Print / Save PDF for a PDF copy. Source.md stays on PC for editing only.
Phase 6 Security, Stripe, Cloudflare (ops)
PURPOSE: Close downtime / pay automation / edge hardening.
UPDATED: 2026-07-31
MANUAL companions: SECURITY-HARDENING-PLAN.md · STRIPE-WEBHOOK-V2.md · CLOUDFLARE-EDGE-CHECKLIST.md
Live status (checked 2026-07-31)
| Item | Status | Evidence |
|---|---|---|
| Stack health | OK | verify-architecture.js → 24/24 |
| Portal / booking / brands | Up | :8091 ·:8090 · 8082 8086 |
| Firewall 100Club-Secure* | Installed & enabled | Block apps/RDP on Public; allow LAN/Tailscale |
| Nightly backup task | Ready | 100Club-NightlyBackup · last OK 2026-07-31 2:30 AM · next 8/1 2:30 AM |
| Backup run now | OK | Backups\100club-stack\backup-2026-07-31_1338.zip |
| Stripe webhook secret | Not configured | /api/health → stripeWebhookConfigured: false · no data/secrets.json whsec |
| Cloudflare edge | Manual checklist | Dashboard only see below |
Conclusion: Security install + nightly backup already done. You still need Stripe (if you want auto Mark paid) + Cloudflare checklist ticks.
A) Security + backup (already good)
You do not need to re-run install unless rules were deleted.
Location (if you ever reinstall Windows):
C:\Users\edwar\Documents\portal-app\scripts\INSTALL-SECURITY-AND-BACKUP.batRight-click → Run as administrator.
Manual backup anytime:
powershell -NoProfile -ExecutionPolicy Bypass -File "...\portal-app\scripts\BACKUP-NIGHTLY.ps1"Folder: %USERPROFILE%\Backups\100club-stack\
B) Stripe webhook (still open)
Goal: GET http://127.0.0.1:8091/api/health shows "stripeWebhookConfigured": true
Steps
- Stripe Dashboard → Developers → Webhooks → Add endpoint
- URL:
https://www.the100club.win/portal/api/stripe/webhook
- Events:
checkout.session.completed- (optional)
checkout.session.async_payment_succeeded - (optional)
payment_intent.succeeded
- Copy signing secret
whsec_… - Run:
Documents\portal-app\scripts\SETUP-STRIPE-WEBHOOK.bat
Paste secret → Enter
- Restart portal (Server Control or START-PORTAL)
- Open health URL confirm true
Without this, Mark paid stays manual (still works).
C) Cloudflare edge (you in dashboard)
Open CLOUDFLARE-EDGE-CHECKLIST.md and tick:
- [ ] Tunnel Healthy · cloudflared service Running
- [ ] Hostnames → correct
127.0.0.1ports · orange cloud - [ ] No WAN port-forward for 80/443/3389/809x
- [ ] Bot Fight / WAF / Security level
- [ ] Optional: Access on Studio admin
- [ ] Optional: rate limit rules on
/api/auth/
PC check only:
sc query cloudflared
node Documents\portal-app\scripts\verify-architecture.jsD) After you finish B + C
cd Documents\portal-app
node scripts\verify-architecture.js
node scripts\phase6-status.jsBrowser: Studio Social · Brain · one brand wiki · Open live site.
E) Related (already shipped on this stack)
| Item | Status |
|---|---|
| Firewall + nightly backup | Installed (see live status table) |
| Branded HTML emails | lib/mail.js + all portal send paths · guide emails.html |
| Email previews | node scripts\one-off\preview-email-themes.js |
| Studio Ops Phase 6 card | admin → Ops → Refresh status |
| CLI status JSON | node scripts\phase6-status.js --json |
| Editor audit | node scripts\audit-studio-editor.js · Ops → Editor audit |
Stripe + Cloudflare still need your dashboard steps above.
Sign-off
| Check | Done? |
|---|---|
| Firewall rules present | ☑ (2026-07-31) |
| Nightly backup task OK | ☑ |
| Manual backup works | ☑ |
| Stripe webhook configured | ☐ |
| Cloudflare checklist complete | ☐ |
| Verify 24/24 still green | ☑ |
When Stripe + CF boxes are ☑, Phase 6 is complete.