diff --git a/.github/workflows/ec2-cd.yml b/.github/workflows/ec2-cd.yml
index 850e4b1..b0ea36c 100644
--- a/.github/workflows/ec2-cd.yml
+++ b/.github/workflows/ec2-cd.yml
@@ -49,24 +49,15 @@ jobs:
     runs-on: self-hosted
     needs: build
     steps:
-      - name: Download math result for job 1
+      - name: Download build files
         uses: actions/download-artifact@v4
         with:
           name: mchat_build
 
       - name: Move static files
         run: |
-          sudo rm -rf /var/www/html/*
-          sudo mv web/dist/* /var/www/html/
-          sudo rm -rf web/dist
-
-      - name: Reload caddy service
-        run: |
-          sudo systemctl reload caddy
-
-      # - name: Set server env file
-      #   run:
-      #     cd server && cp .env.example .env
+          sudo mv web/dist server/
+          rm -rf server/src
         
       - name: Restart application
         run: pm2 restart mchat
diff --git a/infra/ec2/Caddyfile b/infra/ec2/Caddyfile
index 497e85e..b5da3ea 100644
--- a/infra/ec2/Caddyfile
+++ b/infra/ec2/Caddyfile
@@ -1,6 +1,4 @@
 mchat.aseerkt.com {
-  root * /var/www/html
   encode zstd gzip
-  file_server 
-  reverse_proxy /api/* 127.0.0.1:5000
+  reverse_proxy * 127.0.0.1:5000
 }
diff --git a/infra/ec2/init.sh b/infra/ec2/init.sh
index afe1f82..9b859ac 100644
--- a/infra/ec2/init.sh
+++ b/infra/ec2/init.sh
@@ -49,3 +49,5 @@ cp ./Caddyfile /etc/caddy/Caddyfile
 ./reload-caddy.sh
 
 ./docker-up.sh
+
+# configure env file by hand
diff --git a/server/.env.example b/server/.env.example
index 8ccc46c..12b06a7 100644
--- a/server/.env.example
+++ b/server/.env.example
@@ -1,5 +1,7 @@
 PORT=5000
-JWT_SECRET=
+NODE_ENV=
+ACCESS_TOKEN_SECRET=
+REFRESH_TOKEN_SECRET=
 DB_URL="postgresql://postgres:secret@localhost:5432/mchat"
 REDIS_HOST=
 REDIS_PORT=
diff --git a/server/src/index.ts b/server/src/index.ts
index f44367e..5e55532 100644
--- a/server/src/index.ts
+++ b/server/src/index.ts
@@ -39,10 +39,14 @@ const createApp = async () => {
   app.use(
     express.urlencoded({ extended: true }),
     express.json(),
-    cors({ origin: config.corsOrigin, credentials: true }),
     helmet(),
     morgan(config.isProd ? 'combined' : 'dev'),
   )
+
+  if (!config.isProd) {
+    app.use(cors({ origin: config.corsOrigin, credentials: true }))
+  }
+
   app.use(cookieParser())
 
   const server = createServer(app)
@@ -53,7 +57,9 @@ const createApp = async () => {
     InterServerEvents,
     SocketData
   >(server, {
-    cors: { origin: config.corsOrigin, credentials: true },
+    cors: config.isProd
+      ? undefined
+      : { origin: config.corsOrigin, credentials: true },
     adapter: createAdapter(redisClient),
   })