admin/dyolink
0
0
Fork 0
Code Issues 24 Pull Requests 1 Actions Packages Projects 1 Releases Wiki Activity

migrate from http://178.131.50.201:8088 to wixur.ir

Browse Source
This commit is contained in:
rameen
2026-08-29 12:09:50 +03:30
parent d8efaa6f2f
commit c40e276b8a
9 changed files with 84 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files

84
infrastructure/STAGING-DEPLOY.md
View File

@@ -2,9 +2,12 @@
Automatic staging on a **self-hosted Gitea** machine: merge (or push) to **`master`** → build Docker images → push to Gitea Container Registry → deploy on the same host.
**Example:** Gitea at `http://178.131.50.201:3000`, staging app at `http://178.131.50.201:8088`.
| Public URL | What |
|------------|------|
| `http://wixur.ir` | Staging app (port **80** → Docker nginx) |
| `http://wixur.ir:3000` | Gitea + container registry |
Production (`nudentic.ir` on Linux, tag-based releases) is documented in [`DEPLOY.md`](DEPLOY.md).
DNS `wixur.ir` must point at the **Windows** host. Production (`https://nudentic.ir` on Linux) is separate — see [`DEPLOY.md`](DEPLOY.md). Do **not** point `wixur.ir` at the Linux VPS.
---
@@ -19,7 +22,8 @@ Build backend + frontend → push to Gitea registry
↓
docker compose pull + up -d (docker-compose.registry.yml)
↓
http://<host-ip>:8088 → nginx → frontend / backend → postgres
http://wixur.ir → portproxy :80 → nginx :18088 → frontend / backend → postgres
http://wixur.ir:3000 → Gitea (native, no Docker)
```
| Service | Image source |
@@ -29,7 +33,26 @@ http://<host-ip>:8088 → nginx → frontend / backend → postgres
| frontend | `<REGISTRY_HOST>/<owner>/dyolink-frontend:<sha>` |
| nginx | `nginx:alpine` |
Frontend public URLs are **baked in at build time** via `PUBLIC_BASE_URL`.
Frontend public URLs are **baked in at build time** via `PUBLIC_BASE_URL`. After changing the public URL, re-run the Gitea workflow (or push to `master`) and set `FRONTEND_URL` in `C:\dyolink\secrets\backend.staging.env` to the same origin.
---
## Cut over from `:8088` to `http://wixur.ir`
DNS A record for `wixur.ir` → Windows IP (already done if `http://wixur.ir:3000` and `:8088` work).
On Windows (Admin PowerShell): portproxy **80 → 18088**, firewall + router **port 80** — see §6–7.
In Gitea → repo → **Settings → Actions → Variables**:
- `PUBLIC_BASE_URL` = `http://wixur.ir`
- `STAGING_HTTP_PORT` = `80` (optional; workflow default is 80)
On disk: `FRONTEND_URL=http://wixur.ir` in `C:\dyolink\secrets\backend.staging.env`.
Then run the **Registry — build, push, deploy** workflow so the frontend image is rebuilt without `:8088`.
---
---
@@ -59,8 +82,7 @@ Workflow file: [`.gitea/workflows/registry-build-deploy.yml`](../.gitea/workflow
"insecure-registries": [
"host.docker.internal:3000",
"127.0.0.1:3000",
"178.131.50.201:3000",
"192.168.1.100:3000"
"wixur.ir:3000"
]
}
```
@@ -130,7 +152,7 @@ Copy examples and edit:
Rules:
- `DATABASE_URL` password must match `POSTGRES_PASSWORD`.
- `FRONTEND_URL` must match `PUBLIC_BASE_URL` (e.g. `http://178.131.50.201:8088`).
- `FRONTEND_URL` must match `PUBLIC_BASE_URL` (`http://wixur.ir`).
- Replace JWT secrets with long random values (not `CHANGE_ME`).
### 4. Gitea repository Variables
@@ -139,13 +161,13 @@ Rules:
| Name | Example | Notes |
|------|---------|--------|
| `REGISTRY_HOST` | `host.docker.internal:3000` | **Windows + Docker Desktop:** Docker runs in a Linux VM — `127.0.0.1` is the VM, not Gitea. Use `host.docker.internal:3000`. Also set Gitea `ROOT_URL` to match (see below). |
| `REGISTRY_HOST` | `host.docker.internal:3000` | **Windows + Docker Desktop:** Docker runs in a Linux VM — `127.0.0.1` is the VM, not Gitea. Use `host.docker.internal:3000`. Gitea `ROOT_URL` should match this so registry login from CI works. Browsers and the Linux VPS use `http://wixur.ir:3000`. |
| `REGISTRY_OWNER` | `admin` | Gitea user/org owning packages |
| `PUBLIC_BASE_URL` | `http://178.131.50.201:8088` | How **users** open staging in a browser (public IP OK) |
| `PUBLIC_BASE_URL` | `http://wixur.ir` | How **users** open staging (no `:8088`, no trailing slash). Requires portproxy **80 → 18088** + router forward 80. |
| `DEPLOY_SECRETS_DIR` | `C:/dyolink/secrets` | Forward slashes OK on Windows |
| `CLONE_HOST` | `127.0.0.1:3000` | Git clone (runs on Windows host, not inside Docker VM) |
| `STAGING_HTTP_PORT` | `8088` | Public port (router + portproxy). Optional. |
| `STAGING_LOCAL_PORT` | `18088` | Docker bind on `127.0.0.1`. Must not be `8088` if portproxy already uses 8088. |
| `STAGING_HTTP_PORT` | `80` | Public HTTP port (portproxy). Optional; workflow default is 80. |
| `STAGING_LOCAL_PORT` | `18088` | Docker bind on `127.0.0.1`. Must not be `80` if portproxy already uses 80. |
**Naming note:** Gitea rejects variable names starting with `GITEA_` or `GITHUB_`. Use `CLONE_HOST`, not `GITEA_CLONE_URL`.
@@ -163,42 +185,48 @@ Create token: profile → **Settings → Applications → Generate New Token**.
### 6. Firewall (once)
```powershell
New-NetFirewallRule -DisplayName "Dyolink Staging HTTP 80" -Direction Inbound -Protocol TCP -LocalPort 80 -Action Allow
# Optional fallback while cutting over from :8088
New-NetFirewallRule -DisplayName "Dyolink Staging 8088" -Direction Inbound -Protocol TCP -LocalPort 8088 -Action Allow
```
### 7. External access on Windows + Docker Desktop (portproxy)
Gitea on **:3000** runs natively on Windows. Staging nginx binds **127.0.0.1:18088** (not 8088). Windows **portproxy** then maps public **8088 → 18088**. Do **not** bind Docker on 8088 — portproxy already owns that port (`bind: access permissions` if you try).
Gitea on **:3000** runs natively on Windows (`http://wixur.ir:3000`). Staging nginx binds **127.0.0.1:18088** (not 80). Windows **portproxy** maps public **80 → 18088** so users open **`http://wixur.ir`**. Do **not** bind Docker on 80 — portproxy already owns that port (`bind: access permissions` if you try).
Run **once** in **PowerShell as Administrator** (replace the old 8088→8088 rule if you had one):
If IIS or another service already listens on 80, stop it first or portproxy will fail.
Run **once** in **PowerShell as Administrator**:
```powershell
netsh interface portproxy delete v4tov4 listenaddress=0.0.0.0 listenport=8088
netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=8088 connectaddress=127.0.0.1 connectport=18088
netsh interface portproxy delete v4tov4 listenaddress=0.0.0.0 listenport=80
netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=80 connectaddress=127.0.0.1 connectport=18088
# Keep :8088 as a fallback until http://wixur.ir works, then you can delete it:
# netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=8088 connectaddress=127.0.0.1 connectport=18088
netsh interface portproxy show all
Start-Service iphlpsvc
Set-Service iphlpsvc -StartupType Automatic
```
Verify on the server:
Verify on the Windows PC:
```powershell
curl http://127.0.0.1:18088/health
curl http://127.0.0.1:8088/health
curl http://127.0.0.1/health
```
From your Mac:
From another machine (DNS `wixur.ir` → this PC):
```bash
curl http://178.131.50.201:8088/health
curl http://wixur.ir/health
```
If the public IP still fails but LAN works, add **router port forward 8088** → Windows PC (same as Gitea **3000**).
If LAN works but the public hostname fails, add **router port forward 80** → Windows PC (same as Gitea **3000**).
To remove portproxy later:
To remove the HTTP proxy later:
```powershell
netsh interface portproxy delete v4tov4 listenaddress=0.0.0.0 listenport=8088
netsh interface portproxy delete v4tov4 listenaddress=0.0.0.0 listenport=80
```
---
@@ -240,13 +268,13 @@ Expect: `dyolink_nginx_staging`, `dyolink_backend_staging`, `dyolink_frontend_st
**From browser or another machine:**
```text
http://178.131.50.201:8088
http://wixur.ir
```
**Health check:**
```powershell
curl http://178.131.50.201:8088/api/health
curl http://wixur.ir/api/health
```
Expected: `{"status":"ok",...}`
@@ -263,7 +291,7 @@ On the Windows host, from repo `infrastructure/`:
1. Create `deploy.registry.env` from [`deploy.registry.env.example`](deploy.registry.env.example)
2. Set `REGISTRY_PREFIX`, `IMAGE_TAG`, `STAGING_HTTP_PORT`, `DEPLOY_SECRETS_DIR`
3. `docker login 178.131.50.201:3000 -u <user>`
3. `docker login host.docker.internal:3000 -u <user>` (on Windows Docker Desktop; Linux prod will use `wixur.ir:3000`)
4. `docker compose -f docker-compose.registry.yml --env-file deploy.registry.env pull backend frontend`
5. `docker compose -f docker-compose.registry.yml --env-file deploy.registry.env up -d`
@@ -282,8 +310,10 @@ On the Windows host, from repo `infrastructure/`:
| `Missing database.staging.env` | Check `DEPLOY_SECRETS_DIR` path and file names |
| `docker login` denied | Token needs package permissions; check username/secret |
| Git clone fails in workflow | Set `CLONE_HOST=127.0.0.1:3000` |
| Port 80 bind forbidden / access permissions | Portproxy already owns 80. Bind Docker to `18088` and point portproxy **80 → 127.0.0.1:18088**. Free IIS if it holds 80. |
| `http://wixur.ir` unreachable / empty reply | Docker Desktop: run **portproxy** (§7). `127.0.0.1:18088/health` must work on Windows first. Router must forward **80**. |
| Port 8088 bind forbidden / access permissions | Portproxy already owns 8088. Bind Docker to `18088` and point portproxy **8088 → 127.0.0.1:18088**. |
| Port 8088 unreachable from Mac / empty reply | Docker Desktop: run **portproxy** (§7). `127.0.0.1:18088/health` must work on Windows first. |
| Port 8088 unreachable from Mac / empty reply | Legacy URL. Prefer `http://wixur.ir`. Same 18088 backend; add portproxy 8088 only as fallback. |
| Backend restart loop | JWT secrets still placeholder; fix `backend.staging.env` |
| Backend DB auth error | `DATABASE_URL` password ≠ `POSTGRES_PASSWORD` |
| `dumb-init docker-entrypoint.sh: No such file or directory` | Windows CRLF in shell scripts — fixed in Dockerfiles (rebuild images). |
@@ -319,4 +349,4 @@ docker logs dyolink_frontend_staging --tail 50
| Staging | Push/merge to `master` | Windows + Gitea |
| Production | Git tag `v*.*.*` | Linux + `nudentic.ir` |
Production flow will use Docker Hub (or registry) + [`DEPLOY.md`](DEPLOY.md) — not yet wired to the same workflow.
Production tag deploy (Gitea registry → Linux `nudentic.ir`) is **not** in this workflow yet. This file is Windows staging only.

2
infrastructure/backend.staging.env.example
View File

@@ -10,7 +10,7 @@ JWT_REFRESH_SECRET=another_long_random_secret_different_from_JWT_SECRET
JWT_REFRESH_EXPIRES_IN=30d
# CORS, cookies, and invite links — must match how users open the app (nginx host port)
FRONTEND_URL=http://178.131.50.201:8088
FRONTEND_URL=http://wixur.ir
# HTTP staging — keep false unless you terminate TLS in front of the app
COOKIE_SECURE=false

9
infrastructure/deploy.registry.env.example
View File

@@ -6,14 +6,15 @@
# --- Registry boundary (swap when moving Gitea → Docker Hub) ---
# Gitea: REGISTRY_PREFIX = <host>:<port>/<owner>
# Hub: REGISTRY_PREFIX = docker.io/<user> (or your username for implicit hub)
REGISTRY_PREFIX=178.131.50.201:3000/yourgiteauser
# Windows CI pushes via host.docker.internal:3000; browsers/Linux use wixur.ir:3000 (same Gitea).
REGISTRY_PREFIX=wixur.ir:3000/yourgiteauser
# Short git SHA from CI, or "latest" after a manual pull of :latest
IMAGE_TAG=latest
# Public URL port (router + Windows portproxy listen here)
STAGING_HTTP_PORT=8088
# Docker nginx bind on localhost only (must differ from 8088 when portproxy owns 8088)
# Public HTTP port (router + Windows portproxy listen here) — 80 so users open http://wixur.ir
STAGING_HTTP_PORT=80
# Docker nginx bind on localhost only (must differ from 80 if portproxy owns 80)
STAGING_LOCAL_PORT=18088
# Absolute path on the server where database.staging.env and backend.staging.env live.

6
infrastructure/docker-compose.registry.yml
View File

@@ -2,7 +2,7 @@
# No backend/frontend source on the deployment host except this compose file + config + secrets.
#
# Required env (see deploy.registry.env.example):
# REGISTRY_PREFIX e.g. 178.131.50.201:3000/yourgiteauser (no protocol, no trailing slash)
# REGISTRY_PREFIX e.g. host.docker.internal:3000/admin (Windows CI) or wixur.ir:3000/admin (no protocol)
# IMAGE_TAG short sha or "latest" (CI sets this per deploy)
# Optional:
# DEPLOY_SECRETS_DIR absolute path on the server to database/backend *.env files (see below)
@@ -91,8 +91,8 @@ services:
frontend:
condition: service_healthy
ports:
# Bind a private localhost port — Windows portproxy already owns public 8088.
# See STAGING-DEPLOY.md §7: portproxy 0.0.0.0:8088 → 127.0.0.1:18088
# Bind a private localhost port — Windows portproxy owns public 80 (http://wixur.ir).
# See STAGING-DEPLOY.md §7: portproxy 0.0.0.0:80 → 127.0.0.1:18088
- "127.0.0.1:${STAGING_LOCAL_PORT:-18088}:80"
volumes:
- ./nginx/http-only.conf:/etc/nginx/conf.d/default.conf:ro

4
infrastructure/docker-compose.staging.yml
View File

@@ -60,8 +60,8 @@ services:
context: ../frontend
dockerfile: Dockerfile
args:
NEXT_PUBLIC_API_URL: ${STAGING_NEXT_PUBLIC_API_URL:-http://178.131.50.201:8088/api}
NEXT_PUBLIC_APP_URL: ${STAGING_NEXT_PUBLIC_APP_URL:-http://178.131.50.201:8088}
NEXT_PUBLIC_API_URL: ${STAGING_NEXT_PUBLIC_API_URL:-http://wixur.ir/api}
NEXT_PUBLIC_APP_URL: ${STAGING_NEXT_PUBLIC_APP_URL:-http://wixur.ir}
NEXT_PUBLIC_APP_NAME: ${STAGING_NEXT_PUBLIC_APP_NAME:-Dyolink}
container_name: dyolink_frontend_staging
depends_on:

8
infrastructure/env.staging.example
View File

@@ -1,13 +1,13 @@
# Copy to .env.staging next to docker-compose.staging.yml (optional).
# Used only for compose variable substitution (build args, host port).
STAGING_HTTP_PORT=8088
STAGING_HTTP_PORT=80
# Public URLs baked into the frontend image at build time — must match how users open the app.
STAGING_NEXT_PUBLIC_API_URL=http://178.131.50.201:8088/api
STAGING_NEXT_PUBLIC_APP_URL=http://178.131.50.201:8088
STAGING_NEXT_PUBLIC_API_URL=http://wixur.ir/api
STAGING_NEXT_PUBLIC_APP_URL=http://wixur.ir
STAGING_NEXT_PUBLIC_APP_NAME=Dyolink
# Change the IP/port if your server address differs.
# Must match how users open staging (http://wixur.ir).
# Registry / pull-only deploy (see deploy.registry.env.example + docker-compose.registry.yml).