diff --git a/controller/build_channel.go b/controller/build_channel.go
index 1c58d3e..efb8d38 100644
--- a/controller/build_channel.go
+++ b/controller/build_channel.go
@@ -13,6 +13,17 @@ import (
 func registerBuildChannel(server *socketio.Server) {
 	// Example: When clients join "build" namespace or room
 	server.OnEvent("/", "subscribe:build", func(s socketio.Conn) {
+		host, err := os.Hostname()
+		if err != nil {
+			server.BroadcastToRoom("/", "build", "buildlogs", "Could not retrieve hostname")
+			return
+		}
+
+		if strings.Contains(host, "VMS") || strings.Contains(host, "vms") {
+			server.BroadcastToRoom("/", "build", "buildlogs", "You are not allowed to run the build on a production server")
+			return
+		}
+
 		s.Join("build")
 		s.Emit("buildlogs", "👋 Connected to build channel") // this is where all the messages are actually sent to
 
@@ -23,16 +34,6 @@ func registerBuildChannel(server *socketio.Server) {
 		fmt.Println("🔨 Build triggered:", target)
 
 		go func() {
-			host, err := os.Hostname()
-			if err != nil {
-				server.BroadcastToRoom("/", "build", "buildlogs", "Could not retrieve hostname")
-				return
-			}
-
-			if strings.Contains(host, "VMS") || strings.Contains(host, "vms") {
-				server.BroadcastToRoom("/", "build", "buildlogs", "You are not allowed to run the build on a production server")
-				return
-			}
 
 			server.BroadcastToRoom("/", "build", "buildlogs", "🔨 Starting build: Old App")
 			if err := runNpmV2Build(server); err != nil {
diff --git a/controller/main.go b/controller/main.go
index 06f83bd..5252615 100644
--- a/controller/main.go
+++ b/controller/main.go
@@ -4,19 +4,33 @@ import (
 	"fmt"
 	"log"
 	"net/http"
+	"os"
 	"time"
 
+	"github.com/gin-gonic/gin"
 	socketio "github.com/googollee/go-socket.io"
 	"github.com/joho/godotenv"
+	router "lst.net/internal/route_handler"
 )
 
 func main() {
 	err := godotenv.Load("../.env")
 	if err != nil {
-		//log := logger.New()
-		//log.Info("Warning: .env file not found (ok in Docker/production)", "system", map[string]interface{}{})
 		fmt.Println("Warning: .env file not found")
 	}
+
+	port := os.Getenv("PORT")
+	if port == "" {
+		port = "8080"
+	}
+
+	// gin stuff
+	basePath := "/api/controller"
+	if os.Getenv("NODE_ENV") != "production" {
+		basePath = "/lst/api/controller"
+	}
+	r := router.Setup(basePath) // returns *gin.Engine
+
 	server := socketio.NewServer(nil)
 
 	server.OnConnect("/", func(s socketio.Conn) error {
@@ -91,12 +105,16 @@ func main() {
 	go server.Serve()
 	defer server.Close()
 
-	// Enable CORS wrapper for Socket.IO route
-	http.Handle("/socket.io/", withCORS(server))
-	http.Handle("/", http.FileServer(http.Dir("./static")))
+	// mount socket.io on /socket.io/*
+	r.Any("/socket.io/*any", gin.WrapH(withCORS(server)))
 
-	fmt.Println("🚀 Socket.IO server running on :8000")
-	log.Fatal(http.ListenAndServe(":8000", nil))
+	// mount a static dir (like http.FileServer)
+	//r.Static("/", "./static")
+
+	fmt.Println("🚀 Server running on :" + port)
+	if err := r.Run(":" + port); err != nil {
+		log.Fatal("Server failed:", err)
+	}
 }
 
 // Reuse your proper CORS handler
@@ -104,12 +122,15 @@ func withCORS(h http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		origin := r.Header.Get("Origin")
 		if origin != "" {
+			// 🔑 Echo the request Origin, not "*"
 			w.Header().Set("Access-Control-Allow-Origin", origin)
 			w.Header().Set("Vary", "Origin")
 		}
+
 		w.Header().Set("Access-Control-Allow-Methods", "GET,POST,OPTIONS")
 		w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization")
 		w.Header().Set("Access-Control-Allow-Credentials", "true")
+
 		if r.Method == http.MethodOptions {
 			w.WriteHeader(http.StatusNoContent)
 			return