I. Document control

Version

Note

Date

1.0.0

Init document

04 Mar 2021

1.0.1

Update product type section

01 May 2021

1.0.2

Update Technical issues and Verotel

29 Sep 2021

1.0.3

Add CCBill cancelation section

30 Sep 2021

1.0.4

Add style question point

26 Oct 2021

1.0.5

Ad banner size

08 Nov 2022

1.0.6

Custom script

13 Sep 2023

2.0.0

Logo size

18 Nov 2023

II. General Questions

1. How to configure email

xFans provides 2 sections in the Admin settings for email

note

Note:-

  • You can use format “your name” <email-address> to admin email and sender email. Eg

  • xFans provides SMTP method for email only, almost services provide SMTP config, please check with your service and common list in our document.

Note:-

  • You can use format “your name” <email-address> to admin email and sender email. Eg

  • xFans provides SMTP method for email only, almost services provide SMTP config, please check with your service and common list in our document.

2. How to add Google analytics code

Go to Admin panel > Settings > System settings > Google Analytics and enter your GA code.

note

Note: GA code usually is formatted with G-xxxxxxxxxx

Note: GA code usually is formatted with G-xxxxxxxxxx

3. How to add custom script

Go to Admin panel > Settings > System settings > SEO > Custom. There are 2 section you can enter your custom script

note

Note:-

  • You can enter your GA script to one of these sections

  • Make sure you entered valid HTML or Javascript script. Otherwise it might break the system

Note:-

  • You can enter your GA script to one of these sections

  • Make sure you entered valid HTML or Javascript script. Otherwise it might break the system

4. How to update or change style

xFans does not provide option to change layout or style in the admin panel. However if you want to custom there are 2 solutions

5. How to setup xFans payment gateway

xFans just supports these payment gateways.

a. CCBill

note

Note:-

  • In CCBill we need 2 sub accounts for each model. one for recurring payment and one for single payment

  • You have to select correct payment type for that sub account when creating.

Note:-

  • In CCBill we need 2 sub accounts for each model. one for recurring payment and one for single payment

  • You have to select correct payment type for that sub account when creating.

b. Verotel Flexpay (since v2.1.4)

note

Note:

  • Verotel Flexpay doesn’t support split payment. Admin has to pay performer manually via payout request module

  • By default Verotel doesn’t enable yearly subscription. Please contact with them and get approval for this option.

  • Cancel subscription is not available on Verotel Flexpay for now (v2.1.4)

Note:

  • Verotel Flexpay doesn’t support split payment. Admin has to pay performer manually via payout request module

  • By default Verotel doesn’t enable yearly subscription. Please contact with them and get approval for this option.

  • Cancel subscription is not available on Verotel Flexpay for now (v2.1.4)

c. Other Payment Gateways

Please contact us for custom requirements.

6. How to add footer menu

Go to Admin panel > FE Menu. Here you can see the list and create or update existing menu.

xFans provides only option to change footer menu for now

7. SMTP common list and setup

Sendgrid

note

Note:-

Note:-

Gmail

note

Note:-

  • Sender email in Email tab must be same your gmail address.

  • Please enable less secure option here.

Note:-

  • Sender email in Email tab must be same your gmail address.

  • Please enable less secure option here.

M3 service

note

Note:-

  • Go to M3 control panel and register your email address, then fill to SMTP form

  • For Linode user, SMTP restrictions are in place by default for Linodes on accounts created after November 5th 2019. You'll need to configure rDNS for your instance and open a Support ticket confirming CAN-SPAM compliance, and Support should lift the restrictions pretty quickly. Check here for more details

Note:-

  • Go to M3 control panel and register your email address, then fill to SMTP form

  • For Linode user, SMTP restrictions are in place by default for Linodes on accounts created after November 5th 2019. You'll need to configure rDNS for your instance and open a Support ticket confirming CAN-SPAM compliance, and Support should lift the restrictions pretty quickly. Check here for more details

8. What are product types on xFans

xFans provide 2 product options

9. How can user cancel unsubscribe a model?

Our system supports to cancel CCBill subscription for now.

CCBill API Guide

CCBill API: Cancel Subscription

10. Banner & Logo sizes

III. Technical Questions

1. How does xFans storage asset files such as videos and images?

xFans supports Local storage (single machine) for now. We use nginx http_auth_module to protect assets. The download link usually is available in 4h, and have integrated business rules in our application.

2. Does xFans support S3 (Simple Storage Service) services like AWS S3 or Digital Ocean Space?

xFans supports local storage for now. If need S3 service you can customize our File module or contact for customization

3. Does xFans support FTP file server?

xFans supports local storage for now. If need FTP service you can customize our File module or contact for customization

4. Can we deploy xFans to AWS EC2?

Yes, xFans is able to be deployed to any VPS server, include AWC EC2

5. Does xFans support Kubernetes?

We have not supported for application container image in our script yet. So you have to create image eg with Docker and deploy application to Kubernetes. Or contact us for a customization.

6. Does xFans support Docker?

For now xFans does not provide Docker image yet. We will provide in future release.

7. Is xFans using CI/CD in our dev process?

Yes, we are using Jenkins for this purpose

8. How can we deliver the update efficiently?

We provide full source code, so you can do implementation if you want. Or we can provide Docker image for your customizations

9. How can we change style (CSS)?

We use less (https://lesscss.org/ ) to manage stylesheet. From source code you can

note

Note:- Not recommend to change style in the built .css

Note:- Not recommend to change style in the built .css

10. Can you confirm that your code set supports a PWA (not just web)?

It supports but not 100%, some we need to modify. basically we have no PWA yet

11. Do you use any design system that we should replicate for our bespoke UI to enable efficiency and speed in the dev process?

We just use ant design for our component design / approach.

12. Can you explain more about your approach to security, particularly how you manage authentication tokens and secure user data?

We do not provide server security or DDOS protection, we provide application only

Application below

Authentication Tokens:

• Secure Storage: Store tokens securely using methods like environment variables or dedicated secret management services. also support .env if needed

• Encryption: Encrypt tokens in transit and at rest to protect against interception and unauthorized access.

• Expiration and Rotation: Implement expiration dates for tokens with JWT Securing User Data:

• Data Encryption: Encrypt sensitive user data both in transit (using TLS/SSL) and at rest (using AES or similar algorithms).

• Access Controls: Enforce strict access controls and permissions to ensure that only authorized users and systems can access or modify data.

• Data Minimization: Collect and retain only the data that is necessary for the application to function, reducing the potential impact of a data breach.

13. How do you plan to handle error logging and monitoring in both the frontend and backend to ensure reliability and ease troubleshooting?

Backend we have request logs and httpexception log to track issues / exception. besides that we also have log tool to use in additional case In frontend we do not apply but we provide addon for Sentry log when having request from client

14. What strategies have you implemented for scalability, especially considering the hardcoded values and direct coupling seen in the snippets?

15. Could you discuss your approach to ensuring code maintainability, such as documentation standards, coding conventions, and review processes you follow?


Documentation Standards:

Coding Conventions:

Review Processes:

16. How do you ensure the application is secure against common web vulnerabilities (e.g., SQL injection, XSS, CSRF)?

we do not use SQL but no-sql. and we use mongoose framework with mongodb-driver, it will prevent sql injection. CSRF is not applied on our product, we use API with authentication header. XSS we provided setup on nginx, if neeed any we can update there. Check our nginx template for details

17. What is your approach to testing, both in terms of unit tests and integration tests, for the frontend and backend?

We do not have E2E or unit test right now. manual testing whole app

18. Can you explain the decision-making process behind the mix of local and global styling approaches seen in the frontend?

==> https://ant.design/docs/spec/values


19. What live websites or apps has xFans built that we could take a look at

You can have a look at our portfolio - https://adent.io/portfolio


20. Is application designed out of the box to scale horizontally (i.e. to be deployed on multiple instances/containers)?

=> partial support, If you want to support auto scaling - need to customize the file server as below,

database -> there is no problem with db - scale or separate db for each module file service -> converting, transcode (eg from mov to mp4 h264), image processing (eg crop, resize...) we need to create a separate file media service otherwise we cannot support horizontal scale properly.
queue / messaging service -> we are using Redis - need a shared Redis server for all instances


21. What is the plan for scaling on database side?

=> So far it is single database but it support scaling well. check https://www.mongodb.com/basics/scaling . if needed we can design / change DB connection for each module without issue as well.

22. Where users/passwords are stored?

In the DB we store hashed password. 1-way hash (sha1)

23. Which React libraries are you using in the project

Version ^18.2.0

24. What would be the process of “theming” to customize look and feel

=> Current version we are using ant design https://ant.design/(5.x) with its components
-> use scss superset to manage theme variable, theme size...
-> we can overwrite default ant design components if any (check antd custom theme https://ant.design/docs/react/customize-theme )

25. Walk-through session management

note: we allow 1 device (user) login 1 time only

Step 1: call login api /login
Step 2: create session record with unique random-token and return token to client side
Step 3: for auth request, send token to http header
Step 4: check / verify token before process next
Step 5: get user info and verify status (eg inactive) and allow/disallow to next step

26. If deployed on AWS – can it be S3?

=> Yes, it can be deployed. we can also use full AWS service if needed. step below

  1. Upload file to s3 server directly

  2. Listen uplaod success event and notify Lambda function

  3. Process media convert (for instance use AWS Media convert for video processing)

27. What do you use for video streaming?

=> default is nginx pseudo streaming -> for protected file we use nginx http_auth_request_module https://nginx.org/en/docs/http/ngx_http_auth_request_module.html to verify

28. High-level Deployment steps?