ForgePM — Orlando Enterprise

Run & Deploy

Requirements

Node.js >= 22.5 (uses the built-in node:sqlite). Verified on v24.12.

Run locally

cd app
npm start
# ForgePM listening on http://127.0.0.1:4317

First run seeds a demo organization (Sunset Coast Rentals). The database lives at app/data/forgepm.db by default.

Configuration (environment)

Variable	Default	Purpose
`FORGEPM_PORT`	`4317`	HTTP port
`FORGEPM_HOST`	`127.0.0.1`	Bind address
`FORGEPM_DB`	`data/forgepm.db`	SQLite path
`FORGEPM_SESSION_SECRET`	random per process	Set in production so sessions survive restarts
`FORGEPM_SESSION_TTL_MS`	12h	Session lifetime
`NODE_ENV`	`development`	`production` adds the `Secure` cookie flag

Operations

npm run migrate     # apply DB migrations (idempotent)
npm run backup      # checkpoint WAL + copy DB to backups/
npm run verify      # full 70-check verification suite

Production hardening path (the disclosed seams)

This reproducible build runs single-node. For a true production go-live:

TLS — terminate HTTPS at a reverse proxy/load balancer; set

NODE_ENV=production and a strong FORGEPM_SESSION_SECRET.

Identity — wire the SSO seam (sso_subject) to your OIDC/SAML IdP and

enforce MFA for accounts flagged mfa_enabled.

Database — swap node:sqlite for managed Postgres; the repository

interface is the single integration point. Define RPO/RTO and automate backups.

Scale & HA — run multiple stateless app nodes behind the load balancer

(sessions already live in the database).

Payments — connect the payment seam (Stripe/Plaid or ACH) to the

recordPayment flow.

Observability — ship structured logs and /metrics to your stack;

alert on forgepm_responses_5xx_total and forgepm_auth_failures_total.