diff --git a/.gitea/workflows/registry-build-deploy.yml b/.gitea/workflows/registry-build-deploy.yml index 84e81a1..496160f 100644 --- a/.gitea/workflows/registry-build-deploy.yml +++ b/.gitea/workflows/registry-build-deploy.yml @@ -1,31 +1,32 @@ # Staging: build backend/frontend images, push to Gitea Container Registry, deploy on self-hosted runner. # # Triggers: push to master/main, or manual workflow_dispatch. +# Production (nudentic.ir / git tags) is a separate later workflow — this file is Windows staging only. # # Repository Variables (Settings → Actions → Variables): -# REGISTRY_HOST Docker registry host:port (no http/https). Same PC as Gitea → 127.0.0.1:3000 +# REGISTRY_HOST Docker registry host:port (no http/https). Windows Docker Desktop → host.docker.internal:3000 # REGISTRY_OWNER Gitea user or org that owns the packages -# PUBLIC_BASE_URL URL users sopen in browser, e.g. http://178.131.50.201:8088 (no trailing slash) +# PUBLIC_BASE_URL URL users open in the browser, e.g. http://wixur.ir (no trailing slash, no :8088) # DEPLOY_SECRETS_DIR absolute path on runner, e.g. C:/dyolink/secrets # # Optional: -# STAGING_HTTP_PORT public port (default 8088) — Windows portproxy listens here -# STAGING_LOCAL_PORT Docker bind on 127.0.0.1 (default 18088) — must not equal 8088 if portproxy owns 8088 +# STAGING_HTTP_PORT public HTTP port (default 80) — Windows portproxy listens here → 18088 +# STAGING_LOCAL_PORT Docker bind on 127.0.0.1 (default 18088) — must not equal the public port if portproxy owns it # CLONE_HOST git clone host when runner = Gitea host → 127.0.0.1:3000 # # Same Windows PC runs Gitea + runner + deploy: # CLONE_HOST → 127.0.0.1:3000 (git runs on Windows host) # REGISTRY_HOST → host.docker.internal:3000 (docker commands run inside Docker Desktop VM) -# Gitea app.ini ROOT_URL → http://host.docker.internal:3000/ -# PUBLIC_BASE_URL → public IP:8088 (browser URL for staging app) +# Gitea app.ini ROOT_URL → http://host.docker.internal:3000/ (Docker registry auth; browsers use http://wixur.ir:3000) +# PUBLIC_BASE_URL → http://wixur.ir (staging app; Gitea stays on :3000) # -# Add host.docker.internal:3000 to Docker Desktop insecure-registries. +# Add host.docker.internal:3000 (and wixur.ir:3000 if you pull by public hostname) to Docker Desktop insecure-registries. # # Repository Secrets (Settings → Actions → Secrets): # REGISTRY_USERNAME Gitea username for docker login # REGISTRY_PASSWORD Gitea access token (packages:read/write) or account password # -# Docker on runner: add registry hosts to insecure-registries, e.g. ["127.0.0.1:3000","178.131.50.201:3000"] +# Docker on runner: insecure-registries e.g. ["host.docker.internal:3000","wixur.ir:3000"] # # Runner: self-hosted with Docker + git. Default shell is powershell (Windows act_runner). @@ -162,7 +163,7 @@ jobs: exit 1 } $stagingPort = '${{ vars.STAGING_HTTP_PORT }}'.Trim() - if ([string]::IsNullOrWhiteSpace($stagingPort)) { $stagingPort = '8088' } + if ([string]::IsNullOrWhiteSpace($stagingPort)) { $stagingPort = '80' } $localPort = '${{ vars.STAGING_LOCAL_PORT }}'.Trim() if ([string]::IsNullOrWhiteSpace($localPort)) { $localPort = '18088' } $imageTag = "${{ needs.build-and-push.outputs.image_tag }}" diff --git a/AGENTS.md b/AGENTS.md index 8236b0f..73666c6 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -10,7 +10,7 @@ Dental clinic ↔ lab platform (monorepo): |------|--------| | `backend/` | NestJS, Prisma, PostgreSQL | | `frontend/` | Next.js 16, React 19, next-intl, Tailwind | -| `infrastructure/` | Docker, nginx, deploy scripts — prod: `DEPLOY.md`, staging: `STAGING-DEPLOY.md` | +| `infrastructure/` | Docker — staging `http://wixur.ir` (Windows, `STAGING-DEPLOY.md`); prod `https://nudentic.ir` (Linux, `DEPLOY.md`) | **Organization types:** `CLINIC` (patients, appointments, treatment) and `LAB` (cases, tasks). Many features are org-type-specific. Permissions use `TAB_*_READ` / `TAB_*_EDIT` codes — see `backend/src/common/permissions.ts`. diff --git a/README.md b/README.md index 2302c2f..998a9c7 100644 --- a/README.md +++ b/README.md @@ -46,7 +46,7 @@ SSL is issued automatically via **Certbot** (`scripts/init-letsencrypt.sh`). Ngi **Full guide:** [`infrastructure/STAGING-DEPLOY.md`](infrastructure/STAGING-DEPLOY.md) -Merge or push to **`master`** → Gitea Actions builds images → deploys to `http://:8088`. +Merge or push to **`master`** → Gitea Actions builds images → deploys to `http://wixur.ir` (Gitea: `http://wixur.ir:3000`). Workflow: [`.gitea/workflows/registry-build-deploy.yml`](.gitea/workflows/registry-build-deploy.yml) diff --git a/infrastructure/STAGING-DEPLOY.md b/infrastructure/STAGING-DEPLOY.md index f402ff2..eff91d5 100644 --- a/infrastructure/STAGING-DEPLOY.md +++ b/infrastructure/STAGING-DEPLOY.md @@ -2,9 +2,12 @@ Automatic staging on a **self-hosted Gitea** machine: merge (or push) to **`master`** → build Docker images → push to Gitea Container Registry → deploy on the same host. -**Example:** Gitea at `http://178.131.50.201:3000`, staging app at `http://178.131.50.201:8088`. +| Public URL | What | +|------------|------| +| `http://wixur.ir` | Staging app (port **80** → Docker nginx) | +| `http://wixur.ir:3000` | Gitea + container registry | -Production (`nudentic.ir` on Linux, tag-based releases) is documented in [`DEPLOY.md`](DEPLOY.md). +DNS `wixur.ir` must point at the **Windows** host. Production (`https://nudentic.ir` on Linux) is separate — see [`DEPLOY.md`](DEPLOY.md). Do **not** point `wixur.ir` at the Linux VPS. --- @@ -19,7 +22,8 @@ Build backend + frontend → push to Gitea registry ↓ docker compose pull + up -d (docker-compose.registry.yml) ↓ -http://:8088 → nginx → frontend / backend → postgres +http://wixur.ir → portproxy :80 → nginx :18088 → frontend / backend → postgres +http://wixur.ir:3000 → Gitea (native, no Docker) ``` | Service | Image source | @@ -29,7 +33,26 @@ http://:8088 → nginx → frontend / backend → postgres | frontend | `//dyolink-frontend:` | | nginx | `nginx:alpine` | -Frontend public URLs are **baked in at build time** via `PUBLIC_BASE_URL`. +Frontend public URLs are **baked in at build time** via `PUBLIC_BASE_URL`. After changing the public URL, re-run the Gitea workflow (or push to `master`) and set `FRONTEND_URL` in `C:\dyolink\secrets\backend.staging.env` to the same origin. + +--- + +## Cut over from `:8088` to `http://wixur.ir` + +DNS A record for `wixur.ir` → Windows IP (already done if `http://wixur.ir:3000` and `:8088` work). + +On Windows (Admin PowerShell): portproxy **80 → 18088**, firewall + router **port 80** — see §6–7. + +In Gitea → repo → **Settings → Actions → Variables**: + +- `PUBLIC_BASE_URL` = `http://wixur.ir` +- `STAGING_HTTP_PORT` = `80` (optional; workflow default is 80) + +On disk: `FRONTEND_URL=http://wixur.ir` in `C:\dyolink\secrets\backend.staging.env`. + +Then run the **Registry — build, push, deploy** workflow so the frontend image is rebuilt without `:8088`. + +--- --- @@ -59,8 +82,7 @@ Workflow file: [`.gitea/workflows/registry-build-deploy.yml`](../.gitea/workflow "insecure-registries": [ "host.docker.internal:3000", "127.0.0.1:3000", - "178.131.50.201:3000", - "192.168.1.100:3000" + "wixur.ir:3000" ] } ``` @@ -130,7 +152,7 @@ Copy examples and edit: Rules: - `DATABASE_URL` password must match `POSTGRES_PASSWORD`. -- `FRONTEND_URL` must match `PUBLIC_BASE_URL` (e.g. `http://178.131.50.201:8088`). +- `FRONTEND_URL` must match `PUBLIC_BASE_URL` (`http://wixur.ir`). - Replace JWT secrets with long random values (not `CHANGE_ME`). ### 4. Gitea repository Variables @@ -139,13 +161,13 @@ Rules: | Name | Example | Notes | |------|---------|--------| -| `REGISTRY_HOST` | `host.docker.internal:3000` | **Windows + Docker Desktop:** Docker runs in a Linux VM — `127.0.0.1` is the VM, not Gitea. Use `host.docker.internal:3000`. Also set Gitea `ROOT_URL` to match (see below). | +| `REGISTRY_HOST` | `host.docker.internal:3000` | **Windows + Docker Desktop:** Docker runs in a Linux VM — `127.0.0.1` is the VM, not Gitea. Use `host.docker.internal:3000`. Gitea `ROOT_URL` should match this so registry login from CI works. Browsers and the Linux VPS use `http://wixur.ir:3000`. | | `REGISTRY_OWNER` | `admin` | Gitea user/org owning packages | -| `PUBLIC_BASE_URL` | `http://178.131.50.201:8088` | How **users** open staging in a browser (public IP OK) | +| `PUBLIC_BASE_URL` | `http://wixur.ir` | How **users** open staging (no `:8088`, no trailing slash). Requires portproxy **80 → 18088** + router forward 80. | | `DEPLOY_SECRETS_DIR` | `C:/dyolink/secrets` | Forward slashes OK on Windows | | `CLONE_HOST` | `127.0.0.1:3000` | Git clone (runs on Windows host, not inside Docker VM) | -| `STAGING_HTTP_PORT` | `8088` | Public port (router + portproxy). Optional. | -| `STAGING_LOCAL_PORT` | `18088` | Docker bind on `127.0.0.1`. Must not be `8088` if portproxy already uses 8088. | +| `STAGING_HTTP_PORT` | `80` | Public HTTP port (portproxy). Optional; workflow default is 80. | +| `STAGING_LOCAL_PORT` | `18088` | Docker bind on `127.0.0.1`. Must not be `80` if portproxy already uses 80. | **Naming note:** Gitea rejects variable names starting with `GITEA_` or `GITHUB_`. Use `CLONE_HOST`, not `GITEA_CLONE_URL`. @@ -163,42 +185,48 @@ Create token: profile → **Settings → Applications → Generate New Token**. ### 6. Firewall (once) ```powershell +New-NetFirewallRule -DisplayName "Dyolink Staging HTTP 80" -Direction Inbound -Protocol TCP -LocalPort 80 -Action Allow +# Optional fallback while cutting over from :8088 New-NetFirewallRule -DisplayName "Dyolink Staging 8088" -Direction Inbound -Protocol TCP -LocalPort 8088 -Action Allow ``` ### 7. External access on Windows + Docker Desktop (portproxy) -Gitea on **:3000** runs natively on Windows. Staging nginx binds **127.0.0.1:18088** (not 8088). Windows **portproxy** then maps public **8088 → 18088**. Do **not** bind Docker on 8088 — portproxy already owns that port (`bind: access permissions` if you try). +Gitea on **:3000** runs natively on Windows (`http://wixur.ir:3000`). Staging nginx binds **127.0.0.1:18088** (not 80). Windows **portproxy** maps public **80 → 18088** so users open **`http://wixur.ir`**. Do **not** bind Docker on 80 — portproxy already owns that port (`bind: access permissions` if you try). -Run **once** in **PowerShell as Administrator** (replace the old 8088→8088 rule if you had one): +If IIS or another service already listens on 80, stop it first or portproxy will fail. + +Run **once** in **PowerShell as Administrator**: ```powershell -netsh interface portproxy delete v4tov4 listenaddress=0.0.0.0 listenport=8088 -netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=8088 connectaddress=127.0.0.1 connectport=18088 +netsh interface portproxy delete v4tov4 listenaddress=0.0.0.0 listenport=80 +netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=80 connectaddress=127.0.0.1 connectport=18088 +# Keep :8088 as a fallback until http://wixur.ir works, then you can delete it: +# netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=8088 connectaddress=127.0.0.1 connectport=18088 netsh interface portproxy show all Start-Service iphlpsvc Set-Service iphlpsvc -StartupType Automatic ``` -Verify on the server: +Verify on the Windows PC: ```powershell curl http://127.0.0.1:18088/health -curl http://127.0.0.1:8088/health +curl http://127.0.0.1/health ``` -From your Mac: +From another machine (DNS `wixur.ir` → this PC): ```bash -curl http://178.131.50.201:8088/health +curl http://wixur.ir/health ``` -If the public IP still fails but LAN works, add **router port forward 8088** → Windows PC (same as Gitea **3000**). +If LAN works but the public hostname fails, add **router port forward 80** → Windows PC (same as Gitea **3000**). -To remove portproxy later: +To remove the HTTP proxy later: ```powershell -netsh interface portproxy delete v4tov4 listenaddress=0.0.0.0 listenport=8088 +netsh interface portproxy delete v4tov4 listenaddress=0.0.0.0 listenport=80 ``` --- @@ -240,13 +268,13 @@ Expect: `dyolink_nginx_staging`, `dyolink_backend_staging`, `dyolink_frontend_st **From browser or another machine:** ```text -http://178.131.50.201:8088 +http://wixur.ir ``` **Health check:** ```powershell -curl http://178.131.50.201:8088/api/health +curl http://wixur.ir/api/health ``` Expected: `{"status":"ok",...}` @@ -263,7 +291,7 @@ On the Windows host, from repo `infrastructure/`: 1. Create `deploy.registry.env` from [`deploy.registry.env.example`](deploy.registry.env.example) 2. Set `REGISTRY_PREFIX`, `IMAGE_TAG`, `STAGING_HTTP_PORT`, `DEPLOY_SECRETS_DIR` -3. `docker login 178.131.50.201:3000 -u ` +3. `docker login host.docker.internal:3000 -u ` (on Windows Docker Desktop; Linux prod will use `wixur.ir:3000`) 4. `docker compose -f docker-compose.registry.yml --env-file deploy.registry.env pull backend frontend` 5. `docker compose -f docker-compose.registry.yml --env-file deploy.registry.env up -d` @@ -282,8 +310,10 @@ On the Windows host, from repo `infrastructure/`: | `Missing database.staging.env` | Check `DEPLOY_SECRETS_DIR` path and file names | | `docker login` denied | Token needs package permissions; check username/secret | | Git clone fails in workflow | Set `CLONE_HOST=127.0.0.1:3000` | +| Port 80 bind forbidden / access permissions | Portproxy already owns 80. Bind Docker to `18088` and point portproxy **80 → 127.0.0.1:18088**. Free IIS if it holds 80. | +| `http://wixur.ir` unreachable / empty reply | Docker Desktop: run **portproxy** (§7). `127.0.0.1:18088/health` must work on Windows first. Router must forward **80**. | | Port 8088 bind forbidden / access permissions | Portproxy already owns 8088. Bind Docker to `18088` and point portproxy **8088 → 127.0.0.1:18088**. | -| Port 8088 unreachable from Mac / empty reply | Docker Desktop: run **portproxy** (§7). `127.0.0.1:18088/health` must work on Windows first. | +| Port 8088 unreachable from Mac / empty reply | Legacy URL. Prefer `http://wixur.ir`. Same 18088 backend; add portproxy 8088 only as fallback. | | Backend restart loop | JWT secrets still placeholder; fix `backend.staging.env` | | Backend DB auth error | `DATABASE_URL` password ≠ `POSTGRES_PASSWORD` | | `dumb-init docker-entrypoint.sh: No such file or directory` | Windows CRLF in shell scripts — fixed in Dockerfiles (rebuild images). | @@ -319,4 +349,4 @@ docker logs dyolink_frontend_staging --tail 50 | Staging | Push/merge to `master` | Windows + Gitea | | Production | Git tag `v*.*.*` | Linux + `nudentic.ir` | -Production flow will use Docker Hub (or registry) + [`DEPLOY.md`](DEPLOY.md) — not yet wired to the same workflow. +Production tag deploy (Gitea registry → Linux `nudentic.ir`) is **not** in this workflow yet. This file is Windows staging only. diff --git a/infrastructure/backend.staging.env.example b/infrastructure/backend.staging.env.example index 6ae019f..6c68292 100644 --- a/infrastructure/backend.staging.env.example +++ b/infrastructure/backend.staging.env.example @@ -10,7 +10,7 @@ JWT_REFRESH_SECRET=another_long_random_secret_different_from_JWT_SECRET JWT_REFRESH_EXPIRES_IN=30d # CORS, cookies, and invite links — must match how users open the app (nginx host port) -FRONTEND_URL=http://178.131.50.201:8088 +FRONTEND_URL=http://wixur.ir # HTTP staging — keep false unless you terminate TLS in front of the app COOKIE_SECURE=false diff --git a/infrastructure/deploy.registry.env.example b/infrastructure/deploy.registry.env.example index 61c4389..b45fae9 100644 --- a/infrastructure/deploy.registry.env.example +++ b/infrastructure/deploy.registry.env.example @@ -6,14 +6,15 @@ # --- Registry boundary (swap when moving Gitea → Docker Hub) --- # Gitea: REGISTRY_PREFIX = :/ # Hub: REGISTRY_PREFIX = docker.io/ (or your username for implicit hub) -REGISTRY_PREFIX=178.131.50.201:3000/yourgiteauser +# Windows CI pushes via host.docker.internal:3000; browsers/Linux use wixur.ir:3000 (same Gitea). +REGISTRY_PREFIX=wixur.ir:3000/yourgiteauser # Short git SHA from CI, or "latest" after a manual pull of :latest IMAGE_TAG=latest -# Public URL port (router + Windows portproxy listen here) -STAGING_HTTP_PORT=8088 -# Docker nginx bind on localhost only (must differ from 8088 when portproxy owns 8088) +# Public HTTP port (router + Windows portproxy listen here) — 80 so users open http://wixur.ir +STAGING_HTTP_PORT=80 +# Docker nginx bind on localhost only (must differ from 80 if portproxy owns 80) STAGING_LOCAL_PORT=18088 # Absolute path on the server where database.staging.env and backend.staging.env live. diff --git a/infrastructure/docker-compose.registry.yml b/infrastructure/docker-compose.registry.yml index 7c708d8..add60a9 100644 --- a/infrastructure/docker-compose.registry.yml +++ b/infrastructure/docker-compose.registry.yml @@ -2,7 +2,7 @@ # No backend/frontend source on the deployment host except this compose file + config + secrets. # # Required env (see deploy.registry.env.example): -# REGISTRY_PREFIX e.g. 178.131.50.201:3000/yourgiteauser (no protocol, no trailing slash) +# REGISTRY_PREFIX e.g. host.docker.internal:3000/admin (Windows CI) or wixur.ir:3000/admin (no protocol) # IMAGE_TAG short sha or "latest" (CI sets this per deploy) # Optional: # DEPLOY_SECRETS_DIR absolute path on the server to database/backend *.env files (see below) @@ -91,8 +91,8 @@ services: frontend: condition: service_healthy ports: - # Bind a private localhost port — Windows portproxy already owns public 8088. - # See STAGING-DEPLOY.md §7: portproxy 0.0.0.0:8088 → 127.0.0.1:18088 + # Bind a private localhost port — Windows portproxy owns public 80 (http://wixur.ir). + # See STAGING-DEPLOY.md §7: portproxy 0.0.0.0:80 → 127.0.0.1:18088 - "127.0.0.1:${STAGING_LOCAL_PORT:-18088}:80" volumes: - ./nginx/http-only.conf:/etc/nginx/conf.d/default.conf:ro diff --git a/infrastructure/docker-compose.staging.yml b/infrastructure/docker-compose.staging.yml index 13ed5ca..9c8465c 100644 --- a/infrastructure/docker-compose.staging.yml +++ b/infrastructure/docker-compose.staging.yml @@ -60,8 +60,8 @@ services: context: ../frontend dockerfile: Dockerfile args: - NEXT_PUBLIC_API_URL: ${STAGING_NEXT_PUBLIC_API_URL:-http://178.131.50.201:8088/api} - NEXT_PUBLIC_APP_URL: ${STAGING_NEXT_PUBLIC_APP_URL:-http://178.131.50.201:8088} + NEXT_PUBLIC_API_URL: ${STAGING_NEXT_PUBLIC_API_URL:-http://wixur.ir/api} + NEXT_PUBLIC_APP_URL: ${STAGING_NEXT_PUBLIC_APP_URL:-http://wixur.ir} NEXT_PUBLIC_APP_NAME: ${STAGING_NEXT_PUBLIC_APP_NAME:-Dyolink} container_name: dyolink_frontend_staging depends_on: diff --git a/infrastructure/env.staging.example b/infrastructure/env.staging.example index afa238a..895ed65 100644 --- a/infrastructure/env.staging.example +++ b/infrastructure/env.staging.example @@ -1,13 +1,13 @@ # Copy to .env.staging next to docker-compose.staging.yml (optional). # Used only for compose variable substitution (build args, host port). -STAGING_HTTP_PORT=8088 +STAGING_HTTP_PORT=80 # Public URLs baked into the frontend image at build time — must match how users open the app. -STAGING_NEXT_PUBLIC_API_URL=http://178.131.50.201:8088/api -STAGING_NEXT_PUBLIC_APP_URL=http://178.131.50.201:8088 +STAGING_NEXT_PUBLIC_API_URL=http://wixur.ir/api +STAGING_NEXT_PUBLIC_APP_URL=http://wixur.ir STAGING_NEXT_PUBLIC_APP_NAME=Dyolink -# Change the IP/port if your server address differs. +# Must match how users open staging (http://wixur.ir). # Registry / pull-only deploy (see deploy.registry.env.example + docker-compose.registry.yml).