CLI tool to scaffold production-ready Express + Mongoose backend with security best practices
npm install nodejs-fsScaffold production-ready Express + MongoDB backends in seconds
Quick Start โข
Features โข
What's Included โข
Usage โข
API Docs
$3- JWT authentication - Bcrypt password hashing - Rate limiting & brute force protection - Helmet.js security headers - CORS configuration - Cookie parser |
$3- Express 5.x (latest) - Environment-based config - Winston logging - Global error handling - Joi validation - MongoDB connection pooling - Compression middleware |
$3- Clean MVC architecture - RESTful API design - Node.js watch mode (no nodemon) - Email templates - Image upload & processing - Comprehensive documentation |
bash
Create your project with npx (no installation needed)
npx create-nodejs-fs my-awesome-api
Navigate to your project
cd my-awesome-api
Configure environment
cp .env.example .env
Edit .env with your MongoDB URI and JWT secret
Start developing
npm run dev
`
That's it! You now have a fully-functional backend with auth, CRUD operations, and more. ๐
---
๐ฆ Installation & Usage
$3
No installation required - just run:
`bash
npx create-nodejs-fs my-project-name
`
$3
`bash
npm install -g nodejs-fs
create-nodejs-fs my-project-name
`
$3
The CLI will automatically:
1. Create the project structure
2. Copy all template files
3. Install dependencies (npm install)
4. Set up your backend with all configurations
$3
`bash
create-nodejs-fs [options]
Options:
--no-install Skip npm install
--git Initialize git repository
--verbose Show detailed logs
-v, --version Output version number
-h, --help Display help
`
๐ What's Included
$3
`
your-project/
โโโ ๐ src/
โ โโโ ๐ config/ # Configuration files
โ โ โโโ cloudinary.js # Image hosting setup
โ โ โโโ db.js # MongoDB connection
โ โ โโโ logger.js # Winston logger config
โ โ
โ โโโ ๐ controllers/ # Business logic
โ โ โโโ authController.js # Auth operations
โ โ โโโ productController.js # CRUD operations
โ โ
โ โโโ ๐ middlewares/ # Custom middleware
โ โ โโโ auth.js # JWT verification
โ โ โโโ errorHandler.js # Global error handler
โ โ โโโ rateLimiter.js # Rate limiting
โ โ โโโ validate.js # Input validation
โ โ
โ โโโ ๐ models/ # Database schemas
โ โ โโโ User.js # User model + methods
โ โ โโโ Product.js # Product model
โ โ
โ โโโ ๐ routes/ # API routes
โ โ โโโ authRoutes.js # /api/auth/*
โ โ โโโ productRoutes.js # /api/products/*
โ โ โโโ index.js # Route aggregator
โ โ
โ โโโ ๐ utils/ # Helper functions
โ โ โโโ imageProcessor.js # Image upload/resize
โ โ โโโ mailer.js # Email sending
โ โ โโโ slugifyUtil.js # URL-friendly slugs
โ โ
โ โโโ app.js # Express app configuration
โ โโโ index.js # Server entry point
โ
โโโ .env.example # Environment template
โโโ package.json
โโโ README.md # Complete documentation
`
$3
Core Framework:
- Express.js ^5.1.0 - Modern, fast web framework (Express 5)
- Mongoose ^8.x - MongoDB object modeling
Security:
- bcrypt - Password hashing with salt
- jsonwebtoken - JWT token generation & verification
- helmet - Security HTTP headers
- express-rate-limit - Brute force protection
- cors - Cross-origin resource sharing
Utilities:
- nodemailer - Email sending (password reset, notifications)
- cloudinary - Cloud image hosting & transformation
- sharp - High-performance image processing
- multer - Multipart/form-data file upload
- joi - Schema validation & sanitization
- winston - Comprehensive logging
- slugify - URL-friendly string conversion
- compression - Gzip compression middleware
- cookie-parser - Parse cookies
- dotenv - Environment variable management
Development:
- Node.js >=18.0.0 - Built-in watch mode with --watch flag
- morgan - HTTP request logger
---
โ๏ธ Configuration Guide
$3
`env
Server Configuration
PORT=5000 # Server port
NODE_ENV=development # development | production
Database
MONGODB_URI=mongodb://localhost:27017/mydb # MongoDB connection string
JWT Authentication
JWT_SECRET=your-256-bit-secret-key # Strong random string
JWT_EXPIRE=7d # Token expiration (7d, 24h, etc.)
JWT_COOKIE_EXPIRE=7 # Cookie expiration in days
`
$3
`env
Email Service (for password reset)
SMTP_HOST=smtp.gmail.com
SMTP_PORT=587
SMTP_USER=your-email@gmail.com
SMTP_PASSWORD=your-app-specific-password
FROM_EMAIL=noreply@yourapp.com
FROM_NAME=Your App Name
Cloudinary (for image uploads)
CLOUDINARY_CLOUD_NAME=your-cloud-name
CLOUDINARY_API_KEY=your-api-key
CLOUDINARY_API_SECRET=your-api-secret
Frontend URL (for CORS and email links)
CLIENT_URL=http://localhost:3000
`
$3
MongoDB Options:
- ๐ฅ๏ธ Local: Install MongoDB Community Server
- โ๏ธ Cloud: Use MongoDB Atlas (free tier available)
Email Service:
- Use Gmail with App Password
- Or try SendGrid, Mailgun, AWS SES
Image Hosting:
- Sign up at Cloudinary (free tier: 25GB storage, 25GB bandwidth)
---
๐ฏ Use Cases
Perfect for building:
- ๐๏ธ E-commerce APIs - Product management, user auth, order processing
- ๐ฑ Mobile App Backends - REST API for iOS/Android apps
- ๐ฌ Social Platforms - User profiles, posts, comments, likes
- ๐ฐ Blog/CMS Systems - Content management with authentication
- ๐ Learning Management - Course platforms, student portals
- ๐ข Business Applications - CRM, inventory management, booking systems
- ๐ฎ Gaming Backends - Player data, leaderboards, achievements
---
๐ก๏ธ Security Best Practices
Our template implements enterprise-grade security:
| Security Layer | Implementation |
|---------------|----------------|
| ๐ Authentication | JWT tokens with secure secret key |
| ๐ Password Storage | Bcrypt hashing (10 salt rounds) |
| ๐ก๏ธ HTTP Headers | Helmet.js (XSS, clickjacking, etc.) |
| ๐ฆ Rate Limiting | Max 100 requests per 15 min per IP |
| โ
Validation | Joi schema validation on all inputs |
| ๐ CORS | Configurable allowed origins |
| ๐ช Cookies | HttpOnly, Secure, SameSite flags |
| ๐ Logging | Winston for security audits |
| ๐๏ธ Compression | Gzip compression for responses |
---
๐ Available Scripts
`bash
npm run dev # Start with Node.js watch mode (auto-reload)
npm start # Start production server
`
---
๐ค Contributing
We welcome contributions! Here's how you can help:
1. ๐ Report bugs - Open an issue
2. ๐ก Suggest features - Share your ideas
3. ๐ง Submit PRs - Fork, code, and create pull requests
4. โญ Star the repo - Show your support
---
๐ License
MIT ยฉ MERN Stack Hero
Free to use for personal and commercial projects.
---
๐ฌ Support & Community
Need help? We've got you covered:
- ๐ Documentation: GitHub Wiki
- ๐ Bug Reports: GitHub Issues
- ๐ก Feature Requests: GitHub Discussions
- โญ Star us on GitHub to stay updated
---
๐บ๏ธ Roadmap
Coming soon:
- [ ] TypeScript template option
- [ ] GraphQL API template
- [ ] WebSocket support
- [ ] Redis caching integration
- [ ] Stripe payment integration
- [ ] Social OAuth (Google, GitHub, Facebook)
- [ ] Swagger/OpenAPI documentation
- [ ] Docker configuration
- [ ] CI/CD templates (GitHub Actions, GitLab CI)
- [ ] Testing setup (Jest, Supertest)
---
๐ API Documentation
$3
| Method | Endpoint | Description | Auth Required |
|--------|----------|-------------|---------------|
| POST | /api/auth/register | Register new user | โ |
| POST | /api/auth/login | Login user | โ |
| POST | /api/auth/forgot-password | Request password reset | โ |
| POST | /api/auth/reset-password/:token | Reset password with token | โ |
| GET | /api/auth/me | Get current user profile | โ
|
$3
| Method | Endpoint | Description | Auth Required |
|--------|----------|-------------|---------------|
| GET | /api/products | Get all products (paginated) | โ |
| GET | /api/products/:id | Get single product | โ |
| POST | /api/products | Create new product | โ
|
| PUT | /api/products/:id | Update product | โ
|
| DELETE | /api/products/:id | Delete product | โ
|
๐ Click to see API examples
Register a new user:
`bash
curl -X POST http://localhost:5000/api/auth/register \
-H "Content-Type: application/json" \
-d '{
"name": "John Doe",
"email": "john@example.com",
"password": "securePassword123"
}'
`
Login:
`bash
curl -X POST http://localhost:5000/api/auth/login \
-H "Content-Type: application/json" \
-d '{
"email": "john@example.com",
"password": "securePassword123"
}'
`
Create a product (with auth):
`bash
curl -X POST http://localhost:5000/api/products \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_JWT_TOKEN" \
-d '{
"name": "Awesome Product",
"description": "This is an awesome product",
"price": 99.99,
"category": "Electronics"
}'
`
Configuration
After generating your project, create a .env file based on .env.example:
`env
Server
PORT=5000
NODE_ENV=development
Database
MONGODB_URI=mongodb://localhost:27017/your-database
JWT
JWT_SECRET=your-super-secret-jwt-key
JWT_EXPIRE=7d
JWT_COOKIE_EXPIRE=7
Email
SMTP_HOST=smtp.gmail.com
SMTP_PORT=587
SMTP_USER=your-email@gmail.com
SMTP_PASSWORD=your-email-password
FROM_EMAIL=noreply@yourapp.com
FROM_NAME=Your App Name
Cloudinary
CLOUDINARY_CLOUD_NAME=your-cloud-name
CLOUDINARY_API_KEY=your-api-key
CLOUDINARY_API_SECRET=your-api-secret
Client URL
CLIENT_URL=http://localhost:3000
`
---
๐ Getting Started Guide
$3
`bash
npx create-nodejs-fs my-awesome-api
Or if installed globally:
create-nodejs-fs my-awesome-api
`
The CLI accepts a project name as an argument (no interactive prompts).
Available options:
- --no-install - Skip dependency installation
- --git - Initialize git repository
- --verbose - Show detailed logs
$3
`bash
cd my-awesome-api
`
$3
`bash
cp .env.example .env
`
Edit .env with your credentials:
`env
Minimum required configuration
MONGODB_URI=mongodb://localhost:27017/your-database
JWT_SECRET=your-super-secret-key-change-this
PORT=5000
`
$3
`bash
npm run dev
`
Your API is now running at http://localhost:5000 ๐
Uses Node.js built-in --watch flag (Node 18+) - no nodemon needed!
$3
`bash
Health check
curl http://localhost:5000
Register a user
curl -X POST http://localhost:5000/api/auth/register \
-H "Content-Type: application/json" \
-d '{"name":"Test User","email":"test@example.com","password":"password123"}'
``
| Manual Setup | Express Generator | Other Boilerplates | nodejs-fs โญ |
|---|---|---|---|
|
โ Hours of setup โ Security gaps โ No auth included โ Basic structure โ No best practices |
โ ๏ธ Minimal setup โ No database โ No authentication โ Outdated patterns โ ๏ธ Basic only |
โ ๏ธ Overengineered โ ๏ธ Too opinionated โ Steep learning curve โ ๏ธ Hard to modify โ ๏ธ Limited docs |
โ 60-second setup โ Production-ready โ Full auth system โ Modern patterns โ Well documented โ Easy to customize โ Actively maintained |