From 573e5e0886788e4ad4f0fa0b10d23d300f817e75 Mon Sep 17 00:00:00 2001 From: rameen Date: Sat, 29 Aug 2026 16:25:27 +0330 Subject: [PATCH] auto deploy on production server now finalized ready for smoke test. --- .gitea/workflows/prod-tag-deploy.yml | 217 +++++++++++++++++++ .gitea/workflows/registry-build-deploy.yml | 2 +- AGENTS.md | 2 +- README.md | 36 +-- infrastructure/DEPLOY.md | 101 ++++++++- infrastructure/STAGING-DEPLOY.md | 8 +- infrastructure/backend.prod.env.example | 2 +- infrastructure/deploy.prod.env.example | 22 +- infrastructure/docker-compose.prod.yml | 21 +- infrastructure/scripts/prod-remote-deploy.sh | 26 +++ 10 files changed, 373 insertions(+), 64 deletions(-) create mode 100644 .gitea/workflows/prod-tag-deploy.yml create mode 100755 infrastructure/scripts/prod-remote-deploy.sh diff --git a/.gitea/workflows/prod-tag-deploy.yml b/.gitea/workflows/prod-tag-deploy.yml new file mode 100644 index 0000000..0b7195f --- /dev/null +++ b/.gitea/workflows/prod-tag-deploy.yml @@ -0,0 +1,217 @@ +# Production: build images for https://nudentic.ir, push :v* to Gitea (not :latest), +# SCP compose to Linux, docker login wixur.ir:3000, compose pull + up. +# +# Triggers: git tag v1.0.1 (and v*.*.*), or Actions → this workflow → Run (input tag). +# Staging stays on master: .gitea/workflows/registry-build-deploy.yml +# +# Do NOT push :latest — staging already uses :latest with the wixur.ir frontend bake. +# +# Variables: +# REGISTRY_HOST Windows Docker push host, e.g. host.docker.internal:3000 +# REGISTRY_OWNER Gitea user/org for packages +# CLONE_HOST git clone, e.g. 127.0.0.1:3000 +# PROD_PUBLIC_BASE_URL https://nudentic.ir (no trailing slash) +# PROD_REGISTRY_HOST Linux pull host, e.g. wixur.ir:3000 (HTTP; insecure-registries on the VPS) +# PROD_INFRA_DIR /opt/dyolink/infrastructure +# +# Secrets (in addition to REGISTRY_USERNAME / REGISTRY_PASSWORD): +# PROD_SSH_HOST Linux public IP or hostname +# PROD_SSH_USER e.g. dyolink +# PROD_SSH_KEY OpenSSH private key (full PEM) +# PROD_SSH_PORT optional, default 22 +# +# One-time on Linux: insecure-registries ["wixur.ir:3000"], .env REGISTRY_PREFIX + DOMAIN=nudentic.ir +# See infrastructure/DEPLOY.md + +name: Production — tag build, push, deploy + +on: + push: + tags: + - 'v*.*.*' + workflow_dispatch: + inputs: + tag: + description: 'Release tag to build and deploy (e.g. v1.0.1)' + required: true + +defaults: + run: + shell: powershell + +jobs: + build-and-push: + runs-on: windows + outputs: + image_tag: ${{ steps.meta.outputs.image_tag }} + steps: + - name: Checkout (this Gitea) + run: | + $ErrorActionPreference = 'Stop' + $cloneHost = '${{ vars.CLONE_HOST }}'.Trim() + if ([string]::IsNullOrWhiteSpace($cloneHost)) { + $Server = "${{ github.server_url }}".TrimEnd('/') + } elseif ($cloneHost -match '^https?://') { + $Server = $cloneHost.TrimEnd('/') + } else { + $Server = 'http://' + $cloneHost + } + $Repo = "${{ github.repository }}" + $dispatchTag = '${{ github.event.inputs.tag }}'.Trim() + if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) { + $Branch = $dispatchTag + } else { + $Branch = "${{ github.ref_name }}" + } + $Token = "${{ github.token }}" + $Actor = "${{ github.actor }}" + $hp = $Server -replace '^https?://', '' + if ($Server.StartsWith('https')) { + $cloneUrl = 'https://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git' + } else { + $cloneUrl = 'http://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git' + } + $env:GIT_TERMINAL_PROMPT = '0' + git clone --depth 1 --branch $Branch $cloneUrl . + + - name: Resolve image tag (v*.*.* only) + id: meta + run: | + $ErrorActionPreference = 'Stop' + $dispatchTag = '${{ github.event.inputs.tag }}'.Trim() + if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) { + $tag = $dispatchTag + } else { + $tag = "${{ github.ref_name }}" + } + if ($tag -notmatch '^v\d+\.\d+\.\d+') { + Write-Host "Production images must be tagged vMAJOR.MINOR.PATCH (got: $tag)" + exit 1 + } + $utf8 = New-Object System.Text.UTF8Encoding $false + [System.IO.File]::AppendAllText($env:GITHUB_OUTPUT, "image_tag=$tag`n", $utf8) + $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}" + [System.IO.File]::AppendAllText($env:GITHUB_ENV, "REGISTRY_PREFIX=$prefix`n", $utf8) + Write-Host "image_tag=$tag REGISTRY_PREFIX=$prefix" + + - name: Log in to container registry + run: | + $ErrorActionPreference = 'Stop' + $pass = @' + ${{ secrets.REGISTRY_PASSWORD }} + '@ + $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin + + - name: Build and push backend (tag only, not :latest) + run: | + $ErrorActionPreference = 'Stop' + $tag = "${{ steps.meta.outputs.image_tag }}" + docker build -t "$env:REGISTRY_PREFIX/dyolink-backend:$tag" ./backend + docker push "$env:REGISTRY_PREFIX/dyolink-backend:$tag" + + - name: Build and push frontend (nudentic.ir baked in) + env: + PROD_PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }} + run: | + $ErrorActionPreference = 'Stop' + $tag = "${{ steps.meta.outputs.image_tag }}" + $base = $env:PROD_PUBLIC_BASE_URL.Trim() + if ([string]::IsNullOrWhiteSpace($base)) { $base = 'https://nudentic.ir' } + $base = $base.TrimEnd('/') + docker build ` + --build-arg "NEXT_PUBLIC_API_URL=$base/api" ` + --build-arg "NEXT_PUBLIC_APP_URL=$base" ` + --build-arg "NEXT_PUBLIC_APP_NAME=Dyolink" ` + -t "$env:REGISTRY_PREFIX/dyolink-frontend:$tag" ` + ./frontend + docker push "$env:REGISTRY_PREFIX/dyolink-frontend:$tag" + + deploy: + needs: build-and-push + runs-on: windows + steps: + - name: Checkout (tagged tree for compose file) + run: | + $ErrorActionPreference = 'Stop' + $cloneHost = '${{ vars.CLONE_HOST }}'.Trim() + if ([string]::IsNullOrWhiteSpace($cloneHost)) { + $Server = "${{ github.server_url }}".TrimEnd('/') + } elseif ($cloneHost -match '^https?://') { + $Server = $cloneHost.TrimEnd('/') + } else { + $Server = 'http://' + $cloneHost + } + $Repo = "${{ github.repository }}" + $dispatchTag = '${{ github.event.inputs.tag }}'.Trim() + if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) { + $Branch = $dispatchTag + } else { + $Branch = "${{ github.ref_name }}" + } + $Token = "${{ github.token }}" + $Actor = "${{ github.actor }}" + $hp = $Server -replace '^https?://', '' + if ($Server.StartsWith('https')) { + $cloneUrl = 'https://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git' + } else { + $cloneUrl = 'http://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git' + } + $env:GIT_TERMINAL_PROMPT = '0' + git clone --depth 1 --branch $Branch $cloneUrl . + + - name: Write SSH key + run: | + $ErrorActionPreference = 'Stop' + $raw = @' + ${{ secrets.PROD_SSH_KEY }} + '@ + $key = $raw.Trim() + if ($key -notmatch 'BEGIN') { + Write-Host "Set secret PROD_SSH_KEY to an OpenSSH private key" + exit 1 + } + $keyPath = Join-Path $env:RUNNER_TEMP 'prod_ssh' + $normalized = $key.Replace("`r`n", "`n").TrimEnd() + "`n" + [System.IO.File]::WriteAllText($keyPath, $normalized) + icacls $keyPath /inheritance:r | Out-Null + icacls $keyPath /grant:r "$($env:USERNAME):(R)" | Out-Null + [System.IO.File]::AppendAllText($env:GITHUB_ENV, "PROD_SSH_KEY_PATH=$keyPath`n") + + - name: Copy compose + deploy script to Linux + run: | + $ErrorActionPreference = 'Stop' + $hostName = '${{ secrets.PROD_SSH_HOST }}'.Trim() + $user = '${{ secrets.PROD_SSH_USER }}'.Trim() + $port = '${{ secrets.PROD_SSH_PORT }}'.Trim() + if ([string]::IsNullOrWhiteSpace($port)) { $port = '22' } + $infra = '${{ vars.PROD_INFRA_DIR }}'.Trim() + if ([string]::IsNullOrWhiteSpace($infra)) { $infra = '/opt/dyolink/infrastructure' } + $ssh = @('-i', $env:PROD_SSH_KEY_PATH, '-o', 'StrictHostKeyChecking=accept-new') + ssh.exe @ssh -p $port "${user}@${hostName}" "mkdir -p $infra/scripts" + scp.exe @ssh -P $port ` + infrastructure/docker-compose.prod.yml ` + "${user}@${hostName}:${infra}/docker-compose.prod.yml" + scp.exe @ssh -P $port ` + infrastructure/scripts/prod-remote-deploy.sh ` + "${user}@${hostName}:${infra}/scripts/prod-remote-deploy.sh" + ssh.exe @ssh -p $port "${user}@${hostName}" "chmod +x $infra/scripts/prod-remote-deploy.sh" + + - name: Login on Linux and deploy tag + run: | + $ErrorActionPreference = 'Stop' + $hostName = '${{ secrets.PROD_SSH_HOST }}'.Trim() + $user = '${{ secrets.PROD_SSH_USER }}'.Trim() + $port = '${{ secrets.PROD_SSH_PORT }}'.Trim() + if ([string]::IsNullOrWhiteSpace($port)) { $port = '22' } + $infra = '${{ vars.PROD_INFRA_DIR }}'.Trim() + if ([string]::IsNullOrWhiteSpace($infra)) { $infra = '/opt/dyolink/infrastructure' } + $regHost = '${{ vars.PROD_REGISTRY_HOST }}'.Trim() + if ([string]::IsNullOrWhiteSpace($regHost)) { $regHost = 'wixur.ir:3000' } + $tag = "${{ needs.build-and-push.outputs.image_tag }}" + $pass = @' + ${{ secrets.REGISTRY_PASSWORD }} + '@ + $regUser = '${{ secrets.REGISTRY_USERNAME }}' + $ssh = @('-i', $env:PROD_SSH_KEY_PATH, '-o', 'StrictHostKeyChecking=accept-new') + $remote = "docker login $regHost -u $regUser --password-stdin && PROD_INFRA_DIR=$infra $infra/scripts/prod-remote-deploy.sh $tag" + $pass.Trim() | ssh.exe @ssh -p $port "${user}@${hostName}" $remote diff --git a/.gitea/workflows/registry-build-deploy.yml b/.gitea/workflows/registry-build-deploy.yml index 496160f..a544c71 100644 --- a/.gitea/workflows/registry-build-deploy.yml +++ b/.gitea/workflows/registry-build-deploy.yml @@ -1,7 +1,7 @@ # Staging: build backend/frontend images, push to Gitea Container Registry, deploy on self-hosted runner. # # Triggers: push to master/main, or manual workflow_dispatch. -# Production (nudentic.ir / git tags) is a separate later workflow — this file is Windows staging only. +# Production (nudentic.ir / git tags): .gitea/workflows/prod-tag-deploy.yml — this file is Windows staging only. # # Repository Variables (Settings → Actions → Variables): # REGISTRY_HOST Docker registry host:port (no http/https). Windows Docker Desktop → host.docker.internal:3000 diff --git a/AGENTS.md b/AGENTS.md index 73666c6..7d64495 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -10,7 +10,7 @@ Dental clinic ↔ lab platform (monorepo): |------|--------| | `backend/` | NestJS, Prisma, PostgreSQL | | `frontend/` | Next.js 16, React 19, next-intl, Tailwind | -| `infrastructure/` | Docker — staging `http://wixur.ir` (Windows, `STAGING-DEPLOY.md`); prod `https://nudentic.ir` (Linux, `DEPLOY.md`) | +| `infrastructure/` | Docker — staging `https://wixur.ir` (Windows, `STAGING-DEPLOY.md`); prod `https://nudentic.ir` (Linux, `DEPLOY.md`) | **Organization types:** `CLINIC` (patients, appointments, treatment) and `LAB` (cases, tasks). Many features are org-type-specific. Permissions use `TAB_*_READ` / `TAB_*_EDIT` codes — see `backend/src/common/permissions.ts`. diff --git a/README.md b/README.md index 998a9c7..a5c49a7 100644 --- a/README.md +++ b/README.md @@ -8,45 +8,21 @@ Local development: see **`backend/README.md`** and **`frontend/README.md`**. --- -## Production deploy (Docker Hub + HTTPS + Let's Encrypt) +## Production deploy (`https://nudentic.ir`) -**Full step-by-step guide:** [`infrastructure/DEPLOY.md`](infrastructure/DEPLOY.md) +**Full guide:** [`infrastructure/DEPLOY.md`](infrastructure/DEPLOY.md) -Minimal server setup: install Docker, create `.env` + `secrets/`, `docker login`, run one script. +Git tag **`v1.0.1`** → Gitea workflow [`.gitea/workflows/prod-tag-deploy.yml`](.gitea/workflows/prod-tag-deploy.yml) builds images (URLs baked for nudentic.ir), pushes to Gitea registry, SSH-deploys the Linux stack. -| On server (once) | In repo / Docker | -|------------------|------------------| -| DNS A record → server IP | `docker-compose.prod.yml`, nginx, certbot | -| `docker login` (private Hub) | Build & push images from dev machine | -| `secrets/database.env`, `secrets/backend.env` | Examples: `database.prod.env.example`, `backend.prod.env.example` | -| `infrastructure/.env` (`DOMAIN`, `LETSENCRYPT_EMAIL`) | `deploy.prod.env.example` | - -**Dev machine** — build frontend with the public domain baked in, push to Docker Hub: - -```bash -./infrastructure/scripts/build-and-push-prod.sh wixur.ir latest -``` - -**Server** — from `infrastructure/`: - -```bash -cp deploy.prod.env.example .env # edit DOMAIN, paths -mkdir -p ../secrets && cp database.prod.env.example ../secrets/database.env -cp backend.prod.env.example ../secrets/backend.env # set passwords + FRONTEND_URL -docker login -chmod +x scripts/*.sh -./scripts/deploy-prod.sh -``` - -SSL is issued automatically via **Certbot** (`scripts/init-letsencrypt.sh`). Nginx config is generated from `DOMAIN` in `.env`. When you move to another domain (e.g. `dyolink.com`), update `.env` + `backend.env`, re-run `init-letsencrypt.sh`, and **rebuild the frontend image** with the new URL. +First-time SSL / Hub fallback: same `DEPLOY.md`. --- -## Staging deploy (Gitea Actions + Windows) +## Staging deploy (`https://wixur.ir`) **Full guide:** [`infrastructure/STAGING-DEPLOY.md`](infrastructure/STAGING-DEPLOY.md) -Merge or push to **`master`** → Gitea Actions builds images → deploys to `http://wixur.ir` (Gitea: `http://wixur.ir:3000`). +Merge or push to **`master`** → Gitea Actions builds images → deploys to `https://wixur.ir` (Gitea: `http://wixur.ir:3000`). Workflow: [`.gitea/workflows/registry-build-deploy.yml`](.gitea/workflows/registry-build-deploy.yml) diff --git a/infrastructure/DEPLOY.md b/infrastructure/DEPLOY.md index 79828e4..cef2225 100644 --- a/infrastructure/DEPLOY.md +++ b/infrastructure/DEPLOY.md @@ -1,13 +1,84 @@ # Dyolink — Production Server Deploy Guide -Deploy the full stack (Postgres, NestJS API, Next.js, Nginx, Let's Encrypt) on a fresh Linux server using **Docker Hub** images. +Linux VPS serves **`https://nudentic.ir` only**. Images come from the **Gitea registry** (`wixur.ir:3000`) on git tags. Staging is Windows (`https://wixur.ir`) — see [`STAGING-DEPLOY.md`](STAGING-DEPLOY.md). -**Example used in production:** `https://wixur.ir` on server `185.243.48.140`. +**Automated path:** tag `v1.0.1` → [`.gitea/workflows/prod-tag-deploy.yml`](../.gitea/workflows/prod-tag-deploy.yml) (Windows runner builds, SSH to this server). + +**Manual / first SSL:** Docker Hub + [`scripts/build-and-push-prod.sh`](scripts/build-and-push-prod.sh) is still documented below as a fallback. + +**Example host:** `https://nudentic.ir` (do not point `wixur.ir` at this VPS). + +--- + +## Automated deploy (Gitea tags) + +``` +git tag v1.0.1 && git push origin v1.0.1 + ↓ +Windows act_runner builds frontend with https://nudentic.ir + ↓ +Push wixur.ir:3000//dyolink-*:v1.0.1 (never :latest) + ↓ +SSH → Linux docker login wixur.ir:3000 → compose pull + up + ↓ +https://nudentic.ir +``` + +`:latest` is **staging only** (wixur.ir baked in). Production compose must pin `TAG=v1.0.1`. + +### One-time on the Linux server + +1. **HTTP registry** — Gitea is `http://wixur.ir:3000`. In `/etc/docker/daemon.json`: + +```json +{ + "insecure-registries": ["wixur.ir:3000"] +} +``` + +Then `sudo systemctl restart docker` (containers restart). + +2. **`.env`** in `/opt/dyolink/infrastructure/` — from [`deploy.prod.env.example`](deploy.prod.env.example): + +- `DOMAIN=nudentic.ir` +- `REGISTRY_PREFIX=wixur.ir:3000/` (same owner as Gitea `REGISTRY_OWNER`) +- `TAG=v1.0.1` (CI overrides per release) + +3. **`secrets/backend.env`:** `FRONTEND_URL=https://nudentic.ir`, `COOKIE_SECURE=true` + +4. **SSH** — user that can run `docker` (e.g. `dyolink` in the `docker` group). Put the matching **public** key in `~/.ssh/authorized_keys`. + +5. **Test pull** (after a staging or prod image exists): + +```bash +docker login wixur.ir:3000 -u +docker pull wixur.ir:3000//dyolink-backend: +``` + +### Gitea (same repo as staging) + +**Variables:** `PROD_PUBLIC_BASE_URL=https://nudentic.ir`, `PROD_REGISTRY_HOST=wixur.ir:3000`, `PROD_INFRA_DIR=/opt/dyolink/infrastructure`, plus existing `REGISTRY_HOST` / `REGISTRY_OWNER` / `CLONE_HOST`. + +**Secrets:** `PROD_SSH_HOST`, `PROD_SSH_USER`, `PROD_SSH_KEY` (private key). Reuse `REGISTRY_USERNAME` / `REGISTRY_PASSWORD`. Optional `PROD_SSH_PORT` (default 22). + +OpenSSH must be on the Windows runner (`ssh.exe` / `scp.exe`). + +### Release + +```bash +git tag v1.0.1 +git push origin v1.0.1 +``` + +Or Gitea → Actions → **Production — tag build, push, deploy** → Run → tag `v1.0.1`. + +Check `https://nudentic.ir/api/health`. --- ## Architecture + ``` Internet → Nginx (:80 / :443) ├── / → frontend:3000 (Next.js) @@ -18,8 +89,8 @@ Internet → Nginx (:80 / :443) | Service | Image | Notes | |-----------|------------------------------------|--------------------------------| | postgres | `postgres:15-alpine` | Data in Docker volume | -| backend | `dyolink/dyolink-backend:latest` | Runs migrations + seed on start | -| frontend | `dyolink/dyolink-frontend:latest` | URLs baked in at **build time** | +| backend | `REGISTRY_PREFIX/dyolink-backend:TAG` | Gitea `v*` or Hub `dyolink/…` | +| frontend | `REGISTRY_PREFIX/dyolink-frontend:TAG` | URLs baked in at **build time** | | nginx | `nginx:alpine` | SSL termination + reverse proxy | | certbot | `certbot/certbot` | Auto-renews certificates | @@ -289,16 +360,19 @@ Open `https://YOUR_DOMAIN` in a browser. ## Updating the app (new release) -**On Mac** — build & push: +**Preferred:** `git tag vX.Y.Z && git push origin vX.Y.Z` (Gitea production workflow). + +**Fallback (Docker Hub from a Mac):** ```bash -./infrastructure/scripts/build-and-push-prod.sh wixur.ir latest +./infrastructure/scripts/build-and-push-prod.sh nudentic.ir v1.0.1 ``` -**On server:** +**On server** (if not using CI): ```bash cd /opt/dyolink/infrastructure +# TAG in .env or: TAG=v1.0.1 docker compose -f docker-compose.prod.yml --env-file .env pull backend frontend docker compose -f docker-compose.prod.yml --env-file .env pull backend frontend docker compose -f docker-compose.prod.yml --env-file .env up -d ``` @@ -361,6 +435,10 @@ docker volume rm dyolink_postgres_data_prod ./scripts/deploy-prod.sh ``` +### Docker login to `wixur.ir:3000`: `http response to HTTPS client` + +Add `"insecure-registries": ["wixur.ir:3000"]` to `/etc/docker/daemon.json` and restart Docker. + ### View logs ```bash @@ -385,12 +463,13 @@ docker compose -f docker-compose.prod.yml --env-file .env exec frontend \ | Path on server | Purpose | |----------------|---------| -| `/opt/dyolink/infrastructure/.env` | Domain, Docker Hub user, Let's Encrypt email | +| `/opt/dyolink/infrastructure/.env` | `DOMAIN`, `REGISTRY_PREFIX`, `TAG`, Let's Encrypt email | | `/opt/dyolink/secrets/database.env` | Postgres credentials | -| `/opt/dyolink/secrets/backend.env` | API secrets, DATABASE_URL, JWT, SMS | +| `/opt/dyolink/secrets/backend.env` | API secrets, DATABASE_URL, JWT, SMS, `FRONTEND_URL` | | `/opt/dyolink/infrastructure/nginx/generated/default.conf` | Auto-generated nginx SSL config | -| `/opt/dyolink/infrastructure/scripts/deploy-prod.sh` | Main deploy entry point | -| `/opt/dyolink/infrastructure/scripts/build-and-push-prod.sh` | Build & push (run on Mac) | +| `/opt/dyolink/infrastructure/scripts/prod-remote-deploy.sh` | Tag deploy (CI SSH) | +| `/opt/dyolink/infrastructure/scripts/deploy-prod.sh` | First-time SSL + stack up | +| `.gitea/workflows/prod-tag-deploy.yml` | CI: build, push `:v*`, SSH deploy | --- diff --git a/infrastructure/STAGING-DEPLOY.md b/infrastructure/STAGING-DEPLOY.md index 33ee6ec..ab1fc1d 100644 --- a/infrastructure/STAGING-DEPLOY.md +++ b/infrastructure/STAGING-DEPLOY.md @@ -338,11 +338,11 @@ docker logs dyolink_frontend_staging --tail 50 --- -## Production (later) +## Production (Linux + tags) | Environment | Trigger | Host | |-------------|---------|------| -| Staging | Push/merge to `master` | Windows + Gitea | -| Production | Git tag `v*.*.*` | Linux + `nudentic.ir` | +| Staging | Push/merge to `master` | Windows + `https://wixur.ir` | +| Production | Git tag `v*.*.*` | Linux + `https://nudentic.ir` | -Production tag deploy (Gitea registry → Linux `nudentic.ir`) is **not** in this workflow yet. This file is Windows staging only. +Workflow: [`.gitea/workflows/prod-tag-deploy.yml`](../.gitea/workflows/prod-tag-deploy.yml). Do **not** push production images as `:latest`. Setup: [`DEPLOY.md`](DEPLOY.md). diff --git a/infrastructure/backend.prod.env.example b/infrastructure/backend.prod.env.example index 323cc86..56d4a07 100644 --- a/infrastructure/backend.prod.env.example +++ b/infrastructure/backend.prod.env.example @@ -12,7 +12,7 @@ JWT_REFRESH_SECRET=replace_with_a_different_openssl_rand_hex_32_output JWT_REFRESH_EXPIRES_IN=30d # Must match DOMAIN in .env — used for CORS, invite links, cookies -FRONTEND_URL=https://wixur.ir +FRONTEND_URL=https://nudentic.ir # Required for HTTPS — browsers reject Secure cookies over plain HTTP COOKIE_SECURE=true diff --git a/infrastructure/deploy.prod.env.example b/infrastructure/deploy.prod.env.example index f8adc1f..3cef703 100644 --- a/infrastructure/deploy.prod.env.example +++ b/infrastructure/deploy.prod.env.example @@ -1,15 +1,27 @@ -# Copy to infrastructure/.env on the server (not committed). +# Copy to infrastructure/.env on the Linux server (not committed). # docker compose -f docker-compose.prod.yml --env-file .env ... -DOMAIN=wixur.ir +DOMAIN=nudentic.ir + +# Gitea Container Registry (tag auto-deploy). Same packages Windows CI pushes +# via host.docker.internal:3000 — Linux pulls via this hostname. +# Format: :/ — no http:// +REGISTRY_PREFIX=wixur.ir:3000/admin + +# Image tag — CI sets this per release (v1.0.1). Do not use latest for Gitea prod +# (staging already owns :latest with the wixur.ir frontend bake). +TAG=v1.0.1 + +# Hub-only fallback: comment out REGISTRY_PREFIX and use: +# REGISTRY_PREFIX=dyolink +# TAG=latest DOCKER_USERNAME=dyolink -TAG=latest # Let's Encrypt — certificate issuance and renewal notices LETSENCRYPT_EMAIL=rameen.naghdi@gmail.com -# Optional: extra hostnames on the same cert (space-separated), e.g. www.wixur.ir -# CERTBOT_EXTRA_DOMAINS=www.wixur.ir +# Optional: extra hostnames on the same cert (space-separated) +# CERTBOT_EXTRA_DOMAINS=www.nudentic.ir # Optional: use Let's Encrypt staging while testing (avoids rate limits) # LETSENCRYPT_STAGING=1 diff --git a/infrastructure/docker-compose.prod.yml b/infrastructure/docker-compose.prod.yml index 7c00395..69fa50e 100644 --- a/infrastructure/docker-compose.prod.yml +++ b/infrastructure/docker-compose.prod.yml @@ -1,13 +1,11 @@ -# Production stack — pull images from Docker Hub, HTTPS via Let's Encrypt (certbot). +# Production stack — pull backend/frontend from Gitea (or Docker Hub fallback). +# HTTPS via Let's Encrypt (certbot) on this host only (nudentic.ir). # -# Server setup (minimal): -# 1. Copy deploy.prod.env.example → .env (DOMAIN, DOCKER_USERNAME, LETSENCRYPT_EMAIL) -# 2. Copy secrets/*.example → ../secrets/ (database.env, backend.env) — outside git -# 3. docker login (private Docker Hub images) -# 4. ./scripts/init-letsencrypt.sh (first time only) -# 5. docker compose -f docker-compose.prod.yml --env-file .env up -d +# Gitea tag deploy: set REGISTRY_PREFIX=wixur.ir:3000/ and TAG=v1.0.1 in .env +# Hub fallback: omit REGISTRY_PREFIX, set DOCKER_USERNAME=dyolink (image dyolink/dyolink-*). # -# Updates: docker compose pull && docker compose up -d +# First SSL: ./scripts/init-letsencrypt.sh then up -d +# Tag updates: CI runs scripts/prod-remote-deploy.sh (or pull + up locally) name: dyolink-prod @@ -39,7 +37,7 @@ services: start_period: 40s backend: - image: ${DOCKER_USERNAME}/dyolink-backend:${TAG:-latest} + image: ${REGISTRY_PREFIX:-dyolink}/dyolink-backend:${TAG:-latest} container_name: dyolink_backend_prod depends_on: postgres: @@ -68,7 +66,7 @@ services: start_period: 60s frontend: - image: ${DOCKER_USERNAME}/dyolink-frontend:${TAG:-latest} + image: ${REGISTRY_PREFIX:-dyolink}/dyolink-frontend:${TAG:-latest} container_name: dyolink_frontend_prod depends_on: - backend @@ -88,7 +86,8 @@ services: max-size: "10m" max-file: "3" healthcheck: - test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:3000/', (r) => {if(r.statusCode!==200)process.exit(1)})"] + # Next.js `/` redirects to `/en` — accept 2xx/3xx. + test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:3000/', (r) => { process.exit(r.statusCode >= 200 && r.statusCode < 400 ? 0 : 1); }).on('error', () => process.exit(1))"] interval: 30s timeout: 10s retries: 3 diff --git a/infrastructure/scripts/prod-remote-deploy.sh b/infrastructure/scripts/prod-remote-deploy.sh new file mode 100755 index 0000000..9700cdb --- /dev/null +++ b/infrastructure/scripts/prod-remote-deploy.sh @@ -0,0 +1,26 @@ +#!/usr/bin/env bash +# Run on the Linux production host (CI SSHs here after pushing :v* images). +# Usage: ./prod-remote-deploy.sh v1.0.1 +set -euo pipefail + +TAG="${1:?usage: prod-remote-deploy.sh v1.0.1}" +INFRA="${PROD_INFRA_DIR:-/opt/dyolink/infrastructure}" +cd "$INFRA" + +if [ ! -f .env ]; then + echo "Missing $INFRA/.env — copy deploy.prod.env.example and set DOMAIN=nudentic.ir REGISTRY_PREFIX=wixur.ir:3000/" + exit 1 +fi + +if ! grep -q '^REGISTRY_PREFIX=.\+' .env; then + echo "Set REGISTRY_PREFIX in .env (Gitea registry, e.g. wixur.ir:3000/admin). Do not use Docker Hub :latest for tag deploys." + exit 1 +fi + +export TAG +echo "Pulling backend/frontend :$TAG from Gitea (REGISTRY_PREFIX in .env)" +docker compose -f docker-compose.prod.yml --env-file .env pull backend frontend +docker compose -f docker-compose.prod.yml --env-file .env up -d +echo "=== Status ===" +docker compose -f docker-compose.prod.yml --env-file .env ps +echo "Health: https://nudentic.ir/api/health"