delpoyment with fully dockerized project on wixur.ir, dyolink docker hub created beside backend and frontend image is uploaded.

infrastructure/scripts/init-letsencrypt.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+INFRA_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+cd "$INFRA_DIR"
+
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+RED='\033[0;31m'
+NC='\033[0m'
+
+if [ ! -f .env ]; then
+  echo -e "${RED}Missing .env — copy deploy.prod.env.example to .env${NC}"
+  exit 1
+fi
+
+set -a
+# shellcheck disable=SC1091
+source .env
+set +a
+
+: "${DOMAIN:?Set DOMAIN in .env}"
+: "${LETSENCRYPT_EMAIL:?Set LETSENCRYPT_EMAIL in .env}"
+
+COMPOSE=(docker compose -f docker-compose.prod.yml --env-file .env)
+
+mkdir -p nginx/generated logs/nginx database/backups
+
+CERT_PATH="certbot_conf/live/${DOMAIN}/fullchain.pem"
+if docker volume inspect dyolink_certbot_conf >/dev/null 2>&1; then
+  if docker run --rm -v dyolink_certbot_conf:/etc/letsencrypt:ro alpine \
+    test -f "/etc/letsencrypt/live/${DOMAIN}/fullchain.pem"; then
+    echo -e "${GREEN}Certificate already exists for ${DOMAIN}${NC}"
+    ./scripts/render-nginx-ssl.sh
+    "${COMPOSE[@]}" up -d --force-recreate nginx
+    "${COMPOSE[@]}" up -d
+    exit 0
+  fi
+fi
+
+echo -e "${YELLOW}Phase 1: bootstrap nginx (HTTP) for ACME challenge...${NC}"
+cp nginx/nginx.bootstrap.conf nginx/generated/default.conf
+"${COMPOSE[@]}" up -d nginx
+
+echo -e "${YELLOW}Phase 2: request Let's Encrypt certificate...${NC}"
+CERTBOT_ARGS=(
+  certonly
+  --webroot
+  -w /var/www/certbot
+  --email "$LETSENCRYPT_EMAIL"
+  --agree-tos
+  --no-eff-email
+  -d "$DOMAIN"
+)
+
+if [ -n "${CERTBOT_EXTRA_DOMAINS:-}" ]; then
+  for extra in $CERTBOT_EXTRA_DOMAINS; do
+    CERTBOT_ARGS+=(-d "$extra")
+  done
+fi
+
+if [ "${LETSENCRYPT_STAGING:-0}" = "1" ]; then
+  CERTBOT_ARGS+=(--staging)
+  echo -e "${YELLOW}Using Let's Encrypt staging (test) certificates${NC}"
+fi
+
+"${COMPOSE[@]}" run --rm --entrypoint certbot certbot "${CERTBOT_ARGS[@]}"
+
+echo -e "${YELLOW}Phase 3: enable HTTPS nginx config...${NC}"
+./scripts/render-nginx-ssl.sh
+"${COMPOSE[@]}" up -d --force-recreate nginx
+"${COMPOSE[@]}" up -d
+
+echo -e "${GREEN}SSL ready for https://${DOMAIN}${NC}"
+echo -e "${GREEN}Certbot renewal container is running (checks every 12h).${NC}"