Merge pull request 'feature/ci-cd' (#70) from feature/ci-cd into master

Reviewed-on: #70
Reviewed-by: admin <admin@localhost>

.cursor/rules/dyolink-overview.mdc

@@ -40,7 +40,7 @@ QR + URL for **sent** cases; focus page `/lab-case/[token]`. Auth redirect via `
 
 ## API errors
 
-Logical failures: `AppException(ErrorCode.X)` → `errors.X` in en/fa/nl. UI: `getUserFacingError`. Skill: `.cursor/skills/api-errors/SKILL.md`. Appointments/working hours: client IANA `timeZone` (never Node local `getHours()`).
+Logical failures: `AppException(ErrorCode.X)` → `errors.X` in en/fa/nl. UI: `getUserFacingError`. Unexpected 500s / client crashes: GlitchTip via Sentry SDKs (`SENTRY_DSN` / `NEXT_PUBLIC_SENTRY_DSN`). Skill: `.cursor/skills/api-errors/SKILL.md`. Appointments/working hours: client IANA `timeZone` (never Node local `getHours()`).
 
 ## Notifications (inbox + live tabs)
 

.cursor/rules/error-tracking.mdc

@@ -0,0 +1,20 @@
+---
+description: GlitchTip error tracking via Sentry SDKs — 500s only, no PHI
+alwaysApply: true
+---
+
+# Error tracking (GlitchTip)
+
+Self-hosted GlitchTip at `https://errors.wixur.ir`. Apps use official Sentry SDKs (`@sentry/nestjs`, `@sentry/nextjs`) pointed at that DSN — not sentry.io.
+
+## What to report
+
+- Backend: HTTP **500+** in `HttpExceptionFilter` only. Do **not** send `AppException` 4xx.
+- Frontend: render crashes (`error.tsx` / `global-error.tsx`) and axios **5xx / network** failures only.
+- No session replay. Scrub cookies, JWT, request bodies, emails.
+
+## Config
+
+- Backend DSN: `SENTRY_DSN` in `backend.env` / `backend.staging.env` (runtime).
+- Frontend DSN: `NEXT_PUBLIC_SENTRY_DSN` baked at Docker build (Gitea var `NEXT_PUBLIC_SENTRY_DSN`).
+- Empty DSN = tracking off (local default).

.gitattributes

@@ -0,0 +1,2 @@
+# Shell scripts must use LF — CRLF breaks Alpine entrypoints ("No such file or directory").
+*.sh text eol=lf

.gitea/workflows/prod-tag-deploy.yml

@@ -0,0 +1,221 @@
+# Production: build images for https://nudentic.ir, push :v* to Gitea (not :latest),
+# SCP compose to Linux, docker login wixur.ir:3000, compose pull + up.
+#
+# Triggers: git tag v1.0.1 (and v*.*.*), or Actions → this workflow → Run (input tag).
+# Staging stays on master: .gitea/workflows/registry-build-deploy.yml
+#
+# Do NOT push :latest — staging already uses :latest with the wixur.ir frontend bake.
+#
+# Variables:
+#   REGISTRY_HOST          Windows Docker push host, e.g. host.docker.internal:3000
+#   REGISTRY_OWNER         Gitea user/org for packages
+#   CLONE_HOST             git clone, e.g. 127.0.0.1:3000
+#   PROD_PUBLIC_BASE_URL   https://nudentic.ir  (no trailing slash)
+#   NEXT_PUBLIC_SENTRY_DSN  GlitchTip frontend project DSN
+#   PROD_REGISTRY_HOST     Linux pull host, e.g. wixur.ir:3000  (HTTP; insecure-registries on the VPS)
+#   PROD_INFRA_DIR         /opt/dyolink/infrastructure
+#
+# Secrets (in addition to REGISTRY_USERNAME / REGISTRY_PASSWORD):
+#   PROD_SSH_HOST          Linux public IP or hostname
+#   PROD_SSH_USER          e.g. dyolink
+#   PROD_SSH_KEY           OpenSSH private key (full PEM)
+#   PROD_SSH_PORT          optional, default 22
+#
+# One-time on Linux: insecure-registries ["wixur.ir:3000"], .env REGISTRY_PREFIX + DOMAIN=nudentic.ir
+# See infrastructure/DEPLOY.md
+
+name: Production — tag build, push, deploy
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag to build and deploy (e.g. v1.0.1)'
+        required: true
+
+defaults:
+  run:
+    shell: powershell
+
+jobs:
+  build-and-push:
+    runs-on: windows
+    outputs:
+      image_tag: ${{ steps.meta.outputs.image_tag }}
+    steps:
+      - name: Checkout (this Gitea)
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $cloneHost = '${{ vars.CLONE_HOST }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($cloneHost)) {
+            $Server = "${{ github.server_url }}".TrimEnd('/')
+          } elseif ($cloneHost -match '^https?://') {
+            $Server = $cloneHost.TrimEnd('/')
+          } else {
+            $Server = 'http://' + $cloneHost
+          }
+          $Repo = "${{ github.repository }}"
+          $dispatchTag = '${{ github.event.inputs.tag }}'.Trim()
+          if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) {
+            $Branch = $dispatchTag
+          } else {
+            $Branch = "${{ github.ref_name }}"
+          }
+          $Token = "${{ github.token }}"
+          $Actor = "${{ github.actor }}"
+          $hp = $Server -replace '^https?://', ''
+          if ($Server.StartsWith('https')) {
+            $cloneUrl = 'https://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
+          } else {
+            $cloneUrl = 'http://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
+          }
+          $env:GIT_TERMINAL_PROMPT = '0'
+          git clone --depth 1 --branch $Branch $cloneUrl .
+
+      - name: Resolve image tag (v*.*.* only)
+        id: meta
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $dispatchTag = '${{ github.event.inputs.tag }}'.Trim()
+          if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) {
+            $tag = $dispatchTag
+          } else {
+            $tag = "${{ github.ref_name }}"
+          }
+          if ($tag -notmatch '^v\d+\.\d+\.\d+') {
+            Write-Host "Production images must be tagged vMAJOR.MINOR.PATCH (got: $tag)"
+            exit 1
+          }
+          $utf8 = New-Object System.Text.UTF8Encoding $false
+          [System.IO.File]::AppendAllText($env:GITHUB_OUTPUT, "image_tag=$tag`n", $utf8)
+          $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}"
+          [System.IO.File]::AppendAllText($env:GITHUB_ENV, "REGISTRY_PREFIX=$prefix`n", $utf8)
+          Write-Host "image_tag=$tag REGISTRY_PREFIX=$prefix"
+
+      - name: Log in to container registry
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $pass = @'
+          ${{ secrets.REGISTRY_PASSWORD }}
+          '@
+          $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+
+      - name: Build and push backend (tag only, not :latest)
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $tag = "${{ steps.meta.outputs.image_tag }}"
+          docker build -t "$env:REGISTRY_PREFIX/dyolink-backend:$tag" ./backend
+          docker push "$env:REGISTRY_PREFIX/dyolink-backend:$tag"
+
+      - name: Build and push frontend (nudentic.ir baked in)
+        env:
+          PROD_PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
+          NEXT_PUBLIC_SENTRY_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_DSN }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $tag = "${{ steps.meta.outputs.image_tag }}"
+          $base = $env:PROD_PUBLIC_BASE_URL.Trim()
+          if ([string]::IsNullOrWhiteSpace($base)) { $base = 'https://nudentic.ir' }
+          $base = $base.TrimEnd('/')
+          docker build `
+            --build-arg "NEXT_PUBLIC_API_URL=$base/api" `
+            --build-arg "NEXT_PUBLIC_APP_URL=$base" `
+            --build-arg "NEXT_PUBLIC_APP_NAME=Dyolink" `
+            --build-arg "NEXT_PUBLIC_SENTRY_DSN=$env:NEXT_PUBLIC_SENTRY_DSN" `
+            --build-arg "NEXT_PUBLIC_SENTRY_ENVIRONMENT=production" `
+            -t "$env:REGISTRY_PREFIX/dyolink-frontend:$tag" `
+            ./frontend
+          docker push "$env:REGISTRY_PREFIX/dyolink-frontend:$tag"
+
+  deploy:
+    needs: build-and-push
+    runs-on: windows
+    steps:
+      - name: Checkout (tagged tree for compose file)
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $cloneHost = '${{ vars.CLONE_HOST }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($cloneHost)) {
+            $Server = "${{ github.server_url }}".TrimEnd('/')
+          } elseif ($cloneHost -match '^https?://') {
+            $Server = $cloneHost.TrimEnd('/')
+          } else {
+            $Server = 'http://' + $cloneHost
+          }
+          $Repo = "${{ github.repository }}"
+          $dispatchTag = '${{ github.event.inputs.tag }}'.Trim()
+          if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) {
+            $Branch = $dispatchTag
+          } else {
+            $Branch = "${{ github.ref_name }}"
+          }
+          $Token = "${{ github.token }}"
+          $Actor = "${{ github.actor }}"
+          $hp = $Server -replace '^https?://', ''
+          if ($Server.StartsWith('https')) {
+            $cloneUrl = 'https://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
+          } else {
+            $cloneUrl = 'http://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
+          }
+          $env:GIT_TERMINAL_PROMPT = '0'
+          git clone --depth 1 --branch $Branch $cloneUrl .
+
+      - name: Write SSH key
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $raw = @'
+          ${{ secrets.PROD_SSH_KEY }}
+          '@
+          $key = $raw.Trim()
+          if ($key -notmatch 'BEGIN') {
+            Write-Host "Set secret PROD_SSH_KEY to an OpenSSH private key"
+            exit 1
+          }
+          $keyPath = Join-Path $env:RUNNER_TEMP 'prod_ssh'
+          $normalized = $key.Replace("`r`n", "`n").TrimEnd() + "`n"
+          [System.IO.File]::WriteAllText($keyPath, $normalized)
+          icacls $keyPath /inheritance:r | Out-Null
+          icacls $keyPath /grant:r "$($env:USERNAME):(R)" | Out-Null
+          [System.IO.File]::AppendAllText($env:GITHUB_ENV, "PROD_SSH_KEY_PATH=$keyPath`n")
+
+      - name: Copy compose + deploy script to Linux
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $hostName = '${{ secrets.PROD_SSH_HOST }}'.Trim()
+          $user = '${{ secrets.PROD_SSH_USER }}'.Trim()
+          $port = '${{ secrets.PROD_SSH_PORT }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($port)) { $port = '22' }
+          $infra = '${{ vars.PROD_INFRA_DIR }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($infra)) { $infra = '/opt/dyolink/infrastructure' }
+          $ssh = @('-i', $env:PROD_SSH_KEY_PATH, '-o', 'StrictHostKeyChecking=accept-new')
+          ssh.exe @ssh -p $port "${user}@${hostName}" "mkdir -p $infra/scripts"
+          scp.exe @ssh -P $port `
+            infrastructure/docker-compose.prod.yml `
+            "${user}@${hostName}:${infra}/docker-compose.prod.yml"
+          scp.exe @ssh -P $port `
+            infrastructure/scripts/prod-remote-deploy.sh `
+            "${user}@${hostName}:${infra}/scripts/prod-remote-deploy.sh"
+          ssh.exe @ssh -p $port "${user}@${hostName}" "chmod +x $infra/scripts/prod-remote-deploy.sh"
+
+      - name: Login on Linux and deploy tag
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $hostName = '${{ secrets.PROD_SSH_HOST }}'.Trim()
+          $user = '${{ secrets.PROD_SSH_USER }}'.Trim()
+          $port = '${{ secrets.PROD_SSH_PORT }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($port)) { $port = '22' }
+          $infra = '${{ vars.PROD_INFRA_DIR }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($infra)) { $infra = '/opt/dyolink/infrastructure' }
+          $regHost = '${{ vars.PROD_REGISTRY_HOST }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($regHost)) { $regHost = 'wixur.ir:3000' }
+          $tag = "${{ needs.build-and-push.outputs.image_tag }}"
+          $pass = @'
+          ${{ secrets.REGISTRY_PASSWORD }}
+          '@
+          $regUser = '${{ secrets.REGISTRY_USERNAME }}'
+          $ssh = @('-i', $env:PROD_SSH_KEY_PATH, '-o', 'StrictHostKeyChecking=accept-new')
+          $remote = "docker login $regHost -u $regUser --password-stdin && PROD_INFRA_DIR=$infra $infra/scripts/prod-remote-deploy.sh $tag"
+          $pass.Trim() | ssh.exe @ssh -p $port "${user}@${hostName}" $remote

.gitea/workflows/registry-build-deploy.yml

@@ -1,30 +1,35 @@
-# Build backend/frontend images, push to Gitea Container Registry, deploy with pull-only compose.
+# Staging: build backend/frontend images, push to Gitea Container Registry, deploy on self-hosted runner.
 #
-# Repository Variables (Settings → Actions → Variables) — non-secret:
+# Triggers: push to master/main, or manual workflow_dispatch.
-#   REGISTRY_HOST        e.g. 178.131.50.201:3000   (no http/https)
+# Production (nudentic.ir / git tags): .gitea/workflows/prod-tag-deploy.yml — this file is Windows staging only.
-#   REGISTRY_OWNER       Gitea user or org that owns the packages (same as image namespace)
+#
-#   PUBLIC_BASE_URL      URL users open in browser, e.g. http://178.131.50.201:8088  (no trailing slash)
+# Repository Variables (Settings → Actions → Variables):
+#   REGISTRY_HOST        Docker registry host:port (no http/https). Windows Docker Desktop → host.docker.internal:3000
+#   REGISTRY_OWNER       Gitea user or org that owns the packages
+#   PUBLIC_BASE_URL      URL users open in the browser, e.g. http://wixur.ir  (no trailing slash, no :8088)
+#   NEXT_PUBLIC_SENTRY_DSN  GlitchTip frontend project DSN (https://…@errors.wixur.ir/…)
+#   DEPLOY_SECRETS_DIR   absolute path on runner, e.g. C:/dyolink/secrets
+#
+# Optional:
+#   STAGING_HTTP_PORT    public HTTP port (default 80) — Windows portproxy listens here → 18088
+#   STAGING_LOCAL_PORT   Docker bind on 127.0.0.1 (default 18088) — must not equal the public port if portproxy owns it
+#   CLONE_HOST           git clone host when runner = Gitea host → 127.0.0.1:3000
+#
+# Same Windows PC runs Gitea + runner + deploy:
+#   CLONE_HOST           → 127.0.0.1:3000  (git runs on Windows host)
+#   REGISTRY_HOST        → host.docker.internal:3000  (docker commands run inside Docker Desktop VM)
+#   Gitea app.ini ROOT_URL → http://host.docker.internal:3000/  (Docker registry auth; browsers use http://wixur.ir:3000)
+#   PUBLIC_BASE_URL      → http://wixur.ir  (staging app; Gitea stays on :3000)
+#
+# Add host.docker.internal:3000 (and wixur.ir:3000 if you pull by public hostname) to Docker Desktop insecure-registries.
 #
 # Repository Secrets (Settings → Actions → Secrets):
 #   REGISTRY_USERNAME    Gitea username for docker login
 #   REGISTRY_PASSWORD    Gitea access token (packages:read/write) or account password
 #
-# HTTP registry (typical self-hosted Gitea): Docker defaults to HTTPS. If login/push fails with
+# Docker on runner: insecure-registries e.g. ["host.docker.internal:3000","wixur.ir:3000"]
-#   "server gave HTTP response to HTTPS client", add REGISTRY_HOST (e.g. 192.168.1.100:3000) to the
-#   Docker daemon "insecure-registries" on the RUNNER machine, then restart Docker (Docker Desktop
-#   → Settings → Docker Engine → JSON → "insecure-registries": ["host:port"]).
 #
-# Optional:
+# Runner: self-hosted with Docker + git. Default shell is powershell (Windows act_runner).
-#   STAGING_HTTP_PORT       host port for nginx (default 8088)
-#
-# Required for deploy job (absolute path on the runner host):
-#   DEPLOY_SECRETS_DIR      folder containing database.staging.env + backend.staging.env
-#
-# Runner: self-hosted with Docker. Default shell is powershell (Windows act_runner often has no WSL bash).
-# For a Linux runner, change defaults.run.shell to bash and restore bash syntax if needed.
-#
-# We do NOT use gitea.com/actions/checkout — many restricted networks cannot reach gitea.com.
-# Checkout is a plain git clone from the same Gitea host.
 
 name: Registry — build, push, deploy
 
@@ -38,189 +43,155 @@ defaults:
     shell: powershell
 
 jobs:
-  temp-success:
+  build-and-push:
-    runs-on: self-hosted
+    runs-on: windows
+    outputs:
+      image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
-      - name: Temporary placeholder (always success)
+      - name: Checkout (clone from this Gitea — no gitea.com)
         run: |
           $ErrorActionPreference = 'Stop'
-          Write-Host "Temporary workflow is active."
+          $cloneHost = '${{ vars.CLONE_HOST }}'.Trim()
-          Write-Host "Trigger: ${{ github.event_name }}"
+          if ([string]::IsNullOrWhiteSpace($cloneHost)) {
-          Write-Host "Branch:  ${{ github.ref_name }}"
+            $Server = "${{ github.server_url }}".TrimEnd('/')
-          Write-Host "Commit:  ${{ github.sha }}"
+          } elseif ($cloneHost -match '^https?://') {
-          Write-Host "Production build/push/deploy steps are intentionally commented."
+            $Server = $cloneHost.TrimEnd('/')
-          exit 0
+          } else {
+            $Server = 'http://' + $cloneHost
+          }
+          $Repo = "${{ github.repository }}"
+          $Branch = "${{ github.ref_name }}"
+          $Token = "${{ github.token }}"
+          $Actor = "${{ github.actor }}"
+          $hp = $Server -replace '^https?://', ''
+          if ($Server.StartsWith('https')) {
+            $cloneUrl = 'https://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
+          } else {
+            $cloneUrl = 'http://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
+          }
+          $env:GIT_TERMINAL_PROMPT = '0'
+          git clone --depth 1 --branch $Branch $cloneUrl .
 
-  # ---------------------------------------------------------------------------
+      - name: Image tag and registry prefix
-  # Production pipeline is temporarily disabled.
+        id: meta
-  # Uncomment these jobs after split-DNS / registry reachability is fixed.
+        run: |
-  # ---------------------------------------------------------------------------
+          $ErrorActionPreference = 'Stop'
-  #
+          $short = (git rev-parse --short HEAD).Trim()
-  # build-and-push:
+          $utf8 = New-Object System.Text.UTF8Encoding $false
-  #   runs-on: self-hosted
+          [System.IO.File]::AppendAllText($env:GITHUB_OUTPUT, "image_tag=$short`n", $utf8)
-  #   outputs:
+          $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}"
-  #     image_tag: ${{ steps.meta.outputs.image_tag }}
+          [System.IO.File]::AppendAllText($env:GITHUB_ENV, "REGISTRY_PREFIX=$prefix`n", $utf8)
-  #   steps:
-  #     - name: Checkout (clone from this Gitea — no gitea.com)
-  #     - name: Image tag and registry prefix
-  #     - name: Log in to container registry
-  #     - name: Build and push backend
-  #     - name: Build and push frontend
-  #
-  # deploy:
-  #   needs: build-and-push
-  #   runs-on: self-hosted
-  #   steps:
-  #     - name: Checkout (shallow clone from this Gitea — no gitea.com)
-  #     - name: Write deploy.registry.env and validate secrets path
-  #     - name: Log in to container registry (for pull)
-  #     - name: Pull and start stack
 
+      - name: Log in to container registry
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $pass = @'
+          ${{ secrets.REGISTRY_PASSWORD }}
+          '@
+          $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
 
+      - name: Build and push backend
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $tag = "${{ steps.meta.outputs.image_tag }}"
+          docker build `
+            -t "$env:REGISTRY_PREFIX/dyolink-backend:$tag" `
+            -t "$env:REGISTRY_PREFIX/dyolink-backend:latest" `
+            ./backend
+          docker push "$env:REGISTRY_PREFIX/dyolink-backend:$tag"
+          docker push "$env:REGISTRY_PREFIX/dyolink-backend:latest"
 
-  ####SAMPLE
+      - name: Build and push frontend
-  # name: Registry — build, push, deploy
+        env:
+          PUBLIC_BASE_URL: ${{ vars.PUBLIC_BASE_URL }}
+          NEXT_PUBLIC_SENTRY_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_DSN }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $tag = "${{ steps.meta.outputs.image_tag }}"
+          $base = $env:PUBLIC_BASE_URL
+          docker build `
+            --build-arg "NEXT_PUBLIC_API_URL=$base/api" `
+            --build-arg "NEXT_PUBLIC_APP_URL=$base" `
+            --build-arg "NEXT_PUBLIC_APP_NAME=Dyolink" `
+            --build-arg "NEXT_PUBLIC_SENTRY_DSN=$env:NEXT_PUBLIC_SENTRY_DSN" `
+            --build-arg "NEXT_PUBLIC_SENTRY_ENVIRONMENT=staging" `
+            -t "$env:REGISTRY_PREFIX/dyolink-frontend:$tag" `
+            -t "$env:REGISTRY_PREFIX/dyolink-frontend:latest" `
+            ./frontend
+          docker push "$env:REGISTRY_PREFIX/dyolink-frontend:$tag"
+          docker push "$env:REGISTRY_PREFIX/dyolink-frontend:latest"
 
-  # on:
+  deploy:
-  #   push:
+    needs: build-and-push
-  #     branches: [main, master]
+    runs-on: windows
-  #   workflow_dispatch:
+    steps:
+      - name: Checkout (shallow clone from this Gitea — no gitea.com)
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $cloneHost = '${{ vars.CLONE_HOST }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($cloneHost)) {
+            $Server = "${{ github.server_url }}".TrimEnd('/')
+          } elseif ($cloneHost -match '^https?://') {
+            $Server = $cloneHost.TrimEnd('/')
+          } else {
+            $Server = 'http://' + $cloneHost
+          }
+          $Repo = "${{ github.repository }}"
+          $Branch = "${{ github.ref_name }}"
+          $Token = "${{ github.token }}"
+          $Actor = "${{ github.actor }}"
+          $hp = $Server -replace '^https?://', ''
+          if ($Server.StartsWith('https')) {
+            $cloneUrl = 'https://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
+          } else {
+            $cloneUrl = 'http://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
+          }
+          $env:GIT_TERMINAL_PROMPT = '0'
+          git clone --depth 1 --branch $Branch $cloneUrl .
 
-  # defaults:
+      - name: Write deploy.registry.env and validate secrets path
-  #   run:
+        run: |
-  #     shell: powershell
+          $ErrorActionPreference = 'Stop'
+          $SD = '${{ vars.DEPLOY_SECRETS_DIR }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($SD)) {
+            Write-Host "Set repository variable DEPLOY_SECRETS_DIR to the absolute path on this runner"
+            Write-Host "where database.staging.env and backend.staging.env live (not in git)."
+            exit 1
+          }
+          if (-not (Test-Path (Join-Path $SD "database.staging.env"))) {
+            Write-Host "Missing $(Join-Path $SD 'database.staging.env')"
+            exit 1
+          }
+          if (-not (Test-Path (Join-Path $SD "backend.staging.env"))) {
+            Write-Host "Missing $(Join-Path $SD 'backend.staging.env')"
+            exit 1
+          }
+          $stagingPort = '${{ vars.STAGING_HTTP_PORT }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($stagingPort)) { $stagingPort = '80' }
+          $localPort = '${{ vars.STAGING_LOCAL_PORT }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($localPort)) { $localPort = '18088' }
+          $imageTag = "${{ needs.build-and-push.outputs.image_tag }}"
+          $lines = @(
+            "REGISTRY_PREFIX=${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}",
+            "IMAGE_TAG=$imageTag",
+            "STAGING_HTTP_PORT=$stagingPort",
+            "STAGING_LOCAL_PORT=$localPort",
+            "DEPLOY_SECRETS_DIR=$SD"
+          )
+          Set-Location infrastructure
+          $lines | Set-Content -Path deploy.registry.env -Encoding utf8
 
-  # jobs:
+      - name: Log in to container registry (for pull)
-  #   build-and-push:
+        run: |
-  #     runs-on: self-hosted
+          $ErrorActionPreference = 'Stop'
-  #     outputs:
+          $pass = @'
-  #       image_tag: ${{ steps.meta.outputs.image_tag }}
+          ${{ secrets.REGISTRY_PASSWORD }}
-  #     steps:
+          '@
-  #       - name: Checkout (clone from this Gitea — no gitea.com)
+          $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-  #         run: |
-  #           $ErrorActionPreference = 'Stop'
-  #           $Server = "${{ github.server_url }}".TrimEnd('/')
-  #           $Repo = "${{ github.repository }}"
-  #           $Branch = "${{ github.ref_name }}"
-  #           $Token = "${{ github.token }}"
-  #           $Actor = "${{ github.actor }}"
-  #           $hp = $Server -replace '^https?://', ''
-  #           if ($Server.StartsWith('https')) {
-  #             $cloneUrl = 'https://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
-  #           } else {
-  #             $cloneUrl = 'http://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
-  #           }
-  #           $env:GIT_TERMINAL_PROMPT = '0'
-  #           git clone --depth 1 --branch $Branch $cloneUrl .
-
-  #       - name: Image tag and registry prefix
-  #         id: meta
-  #         run: |
-  #           $ErrorActionPreference = 'Stop'
-  #           $short = (git rev-parse --short HEAD).Trim()
-  #           $utf8 = New-Object System.Text.UTF8Encoding $false
-  #           [System.IO.File]::AppendAllText($env:GITHUB_OUTPUT, "image_tag=$short`n", $utf8)
-  #           $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}"
-  #           [System.IO.File]::AppendAllText($env:GITHUB_ENV, "REGISTRY_PREFIX=$prefix`n", $utf8)
-
-  #       - name: Log in to container registry
-  #         run: |
-  #           $ErrorActionPreference = 'Stop'
-  #           $pass = @'
-  #           ${{ secrets.REGISTRY_PASSWORD }}
-  #           '@
-  #           $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-
-  #       - name: Build and push backend
-  #         run: |
-  #           $ErrorActionPreference = 'Stop'
-  #           $tag = "${{ steps.meta.outputs.image_tag }}"
-  #           docker build `
-  #             -t "$env:REGISTRY_PREFIX/dyolink-backend:$tag" `
-  #             -t "$env:REGISTRY_PREFIX/dyolink-backend:latest" `
-  #             ./backend
-  #           docker push "$env:REGISTRY_PREFIX/dyolink-backend:$tag"
-  #           docker push "$env:REGISTRY_PREFIX/dyolink-backend:latest"
-
-  #       - name: Build and push frontend
-  #         env:
-  #           PUBLIC_BASE_URL: ${{ vars.PUBLIC_BASE_URL }}
-  #         run: |
-  #           $ErrorActionPreference = 'Stop'
-  #           $tag = "${{ steps.meta.outputs.image_tag }}"
-  #           $base = $env:PUBLIC_BASE_URL
-  #           docker build `
-  #             --build-arg "NEXT_PUBLIC_API_URL=$base/api" `
-  #             --build-arg "NEXT_PUBLIC_APP_URL=$base" `
-  #             --build-arg "NEXT_PUBLIC_APP_NAME=Dyolink" `
-  #             -t "$env:REGISTRY_PREFIX/dyolink-frontend:$tag" `
-  #             -t "$env:REGISTRY_PREFIX/dyolink-frontend:latest" `
-  #             ./frontend
-  #           docker push "$env:REGISTRY_PREFIX/dyolink-frontend:$tag"
-  #           docker push "$env:REGISTRY_PREFIX/dyolink-frontend:latest"
-
-  #   deploy:
-  #     needs: build-and-push
-  #     runs-on: self-hosted
-  #     steps:
-  #       - name: Checkout (shallow clone from this Gitea — no gitea.com)
-  #         run: |
-  #           $ErrorActionPreference = 'Stop'
-  #           $Server = "${{ github.server_url }}".TrimEnd('/')
-  #           $Repo = "${{ github.repository }}"
-  #           $Branch = "${{ github.ref_name }}"
-  #           $Token = "${{ github.token }}"
-  #           $Actor = "${{ github.actor }}"
-  #           $hp = $Server -replace '^https?://', ''
-  #           if ($Server.StartsWith('https')) {
-  #             $cloneUrl = 'https://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
-  #           } else {
-  #             $cloneUrl = 'http://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
-  #           }
-  #           $env:GIT_TERMINAL_PROMPT = '0'
-  #           git clone --depth 1 --branch $Branch $cloneUrl .
-
-  #       - name: Write deploy.registry.env and validate secrets path
-  #         run: |
-  #           $ErrorActionPreference = 'Stop'
-  #           $SD = '${{ vars.DEPLOY_SECRETS_DIR }}'.Trim()
-  #           if ([string]::IsNullOrWhiteSpace($SD)) {
-  #             Write-Host "Set repository variable DEPLOY_SECRETS_DIR to the absolute path on this runner"
-  #             Write-Host "where database.staging.env and backend.staging.env live (not in git)."
-  #             exit 1
-  #           }
-  #           if (-not (Test-Path (Join-Path $SD "database.staging.env"))) {
-  #             Write-Host "Missing $(Join-Path $SD 'database.staging.env')"
-  #             exit 1
-  #           }
-  #           if (-not (Test-Path (Join-Path $SD "backend.staging.env"))) {
-  #             Write-Host "Missing $(Join-Path $SD 'backend.staging.env')"
-  #             exit 1
-  #           }
-  #           $stagingPort = '${{ vars.STAGING_HTTP_PORT }}'.Trim()
-  #           if ([string]::IsNullOrWhiteSpace($stagingPort)) { $stagingPort = '8088' }
-  #           $imageTag = "${{ needs.build-and-push.outputs.image_tag }}"
-  #           $lines = @(
-  #             "REGISTRY_PREFIX=${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}",
-  #             "IMAGE_TAG=$imageTag",
-  #             "STAGING_HTTP_PORT=$stagingPort",
-  #             "DEPLOY_SECRETS_DIR=$SD"
-  #           )
-  #           Set-Location infrastructure
-  #           $lines | Set-Content -Path deploy.registry.env -Encoding utf8
-
-  #       - name: Log in to container registry (for pull)
-  #         run: |
-  #           $ErrorActionPreference = 'Stop'
-  #           $pass = @'
-  #           ${{ secrets.REGISTRY_PASSWORD }}
-  #           '@
-  #           $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-
-  #       - name: Pull and start stack
-  #         run: |
-  #           $ErrorActionPreference = 'Stop'
-  #           Set-Location infrastructure
-  #           docker compose -f docker-compose.registry.yml --env-file deploy.registry.env pull backend frontend
-  #           docker compose -f docker-compose.registry.yml --env-file deploy.registry.env up -d
 
+      - name: Pull and start stack
+        run: |
+          $ErrorActionPreference = 'Stop'
+          Set-Location infrastructure
+          docker compose -f docker-compose.registry.yml --env-file deploy.registry.env pull backend frontend
+          docker compose -f docker-compose.registry.yml --env-file deploy.registry.env up -d

AGENTS.md

@@ -10,7 +10,7 @@ Dental clinic ↔ lab platform (monorepo):
 |------|--------|
 | `backend/` | NestJS, Prisma, PostgreSQL |
 | `frontend/` | Next.js 16, React 19, next-intl, Tailwind |
-| `infrastructure/` | Docker, nginx, deploy scripts |
+| `infrastructure/` | Docker — staging `https://wixur.ir` (Windows, `STAGING-DEPLOY.md`); prod `https://nudentic.ir` (Linux, `DEPLOY.md`) |
 
 **Organization types:** `CLINIC` (patients, appointments, treatment) and `LAB` (cases, tasks). Many features are org-type-specific. Permissions use `TAB_*_READ` / `TAB_*_EDIT` codes — see `backend/src/common/permissions.ts`.
 
@@ -85,7 +85,7 @@ backend/src/
   prisma/                       → schema, migrations, seed
 ```
 
-Errors: `AppException` + `ErrorCode` → frontend `getUserFacingError()`. Never throw raw strings for user-facing failures.
+Errors: `AppException` + `ErrorCode` → frontend `getUserFacingError()`. Unexpected 500s: GlitchTip (`SENTRY_DSN`). Never throw raw strings for user-facing failures.
 
 ## Git & commits
 

README.md

@@ -8,137 +8,23 @@ Local development: see **`backend/README.md`** and **`frontend/README.md`**.
 
 ---
 
-## Production deploy (Docker Hub + HTTPS + Let's Encrypt)
+## Production deploy (`https://nudentic.ir`)
 
-**Full step-by-step guide:** [`infrastructure/DEPLOY.md`](infrastructure/DEPLOY.md)
+**Full guide:** [`infrastructure/DEPLOY.md`](infrastructure/DEPLOY.md)
 
-Minimal server setup: install Docker, create `.env` + `secrets/`, `docker login`, run one script.
+Git tag **`v1.0.1`** → Gitea workflow [`.gitea/workflows/prod-tag-deploy.yml`](.gitea/workflows/prod-tag-deploy.yml) builds images (URLs baked for nudentic.ir), pushes to Gitea registry, SSH-deploys the Linux stack.
 
-| On server (once) | In repo / Docker |
+First-time SSL / Hub fallback: same `DEPLOY.md`.
-|------------------|------------------|
-| DNS A record → server IP | `docker-compose.prod.yml`, nginx, certbot |
-| `docker login` (private Hub) | Build & push images from dev machine |
-| `secrets/database.env`, `secrets/backend.env` | Examples: `database.prod.env.example`, `backend.prod.env.example` |
-| `infrastructure/.env` (`DOMAIN`, `LETSENCRYPT_EMAIL`) | `deploy.prod.env.example` |
-
-**Dev machine** — build frontend with the public domain baked in, push to Docker Hub:
-
-```bash
-./infrastructure/scripts/build-and-push-prod.sh wixur.ir latest
-```
-
-**Server** — from `infrastructure/`:
-
-```bash
-cp deploy.prod.env.example .env          # edit DOMAIN, paths
-mkdir -p ../secrets && cp database.prod.env.example ../secrets/database.env
-cp backend.prod.env.example ../secrets/backend.env   # set passwords + FRONTEND_URL
-docker login
-chmod +x scripts/*.sh
-./scripts/deploy-prod.sh
-```
-
-SSL is issued automatically via **Certbot** (`scripts/init-letsencrypt.sh`). Nginx config is generated from `DOMAIN` in `.env`. When you move to another domain (e.g. `dyolink.com`), update `.env` + `backend.env`, re-run `init-letsencrypt.sh`, and **rebuild the frontend image** with the new URL.
 
 ---
 
-## Deploy on your own server (Docker + Gitea)
+## Staging deploy (`https://wixur.ir`)
 
-High level: **build container images → push to a registry → server pulls images and runs Compose**. Optionally **Gitea Actions** automates that on every merge to `main` / `master`.
+**Full guide:** [`infrastructure/STAGING-DEPLOY.md`](infrastructure/STAGING-DEPLOY.md)
 
-### 1. One-time server preparation
+Merge or push to **`master`** → Gitea Actions builds images → deploys to `https://wixur.ir` (Gitea: `http://wixur.ir:3000`).
 
-1. Install **Docker** and **Docker Compose** on the server.
+Workflow: [`.gitea/workflows/registry-build-deploy.yml`](.gitea/workflows/registry-build-deploy.yml)
-2. Run **Gitea** with the **container registry** enabled (same host/port you use for `docker login`, e.g. `178.131.50.201:3000`).
-3. Copy the repo (or deploy only `infrastructure/` + secrets). You need at least:
-
-   - `infrastructure/docker-compose.registry.yml`
-   - `infrastructure/nginx/` configs referenced by that compose file
-   - `infrastructure/database/init.sql` if used by your Postgres service
-
-4. **Secrets on the server** (never commit real values):
-
-   - Copy `infrastructure/database.staging.env.example` → **`database.staging.env`** (Postgres user/password/db).
-   - Copy `infrastructure/backend.staging.env.example` → **`backend.staging.env`** (e.g. `DATABASE_URL`, JWT, pointing at the compose Postgres service name).
-   - Put both files in one directory on the server, e.g. `/opt/dyolink/secrets/`.
-
-5. **Registry login from the server** (same credentials you use for `docker push`):
-
-   ```bash
-   docker login <registry-host>:<port> -u <user>
-   ```
-
-   For HTTP registries, Docker may require **`insecure-registries`** on the daemon.
-
-### 2. Manual deploy (build images elsewhere, run on server)
-
-On your **dev machine** (after successful local builds):
-
-```powershell
-$REG = "<registry-host>:<port>"
-$OWN = "<registry-owner>"
-$TAG = "manual"
-
-docker build -t "${REG}/${OWN}/dyolink-backend:${TAG}" -t "${REG}/${OWN}/dyolink-backend:latest" ./backend
-
-docker build `
-  --build-arg NEXT_PUBLIC_API_URL="http://<your-public-ip>:<nginx-port>/api" `
-  --build-arg NEXT_PUBLIC_APP_URL="http://<your-public-ip>:<nginx-port>" `
-  --build-arg NEXT_PUBLIC_APP_NAME="Dyolink" `
-  -t "${REG}/${OWN}/dyolink-frontend:${TAG}" `
-  -t "${REG}/${OWN}/dyolink-frontend:latest" `
-  ./frontend
-
-docker push "${REG}/${OWN}/dyolink-backend:${TAG}"
-docker push "${REG}/${OWN}/dyolink-backend:latest"
-docker push "${REG}/${OWN}/dyolink-frontend:${TAG}"
-docker push "${REG}/${OWN}/dyolink-frontend:latest"
-```
-
-On the **server**, from `infrastructure/`:
-
-1. Create **`deploy.registry.env`** (see `infrastructure/deploy.registry.env.example`):
-
-   - `REGISTRY_PREFIX=<host>:<port>/<owner>` (no `http://`, no trailing slash)
-   - `IMAGE_TAG=latest` or the tag you pushed
-   - `STAGING_HTTP_PORT=<host port>` (e.g. `8088` — browser uses `http://<ip>:8088`)
-
-2. Set **`DEPLOY_SECRETS_DIR`** to the absolute path of the folder containing `database.staging.env` and `backend.staging.env` (you can export it in the shell or add it to `deploy.registry.env` if your Compose setup expects it).
-
-3. Pull and start:
-
-   ```bash
-   docker compose -f docker-compose.registry.yml --env-file deploy.registry.env pull backend frontend
-   docker compose -f docker-compose.registry.yml --env-file deploy.registry.env up -d
-   ```
-
-The backend container runs **`prisma migrate deploy`** on startup (via entrypoint) when `NODE_ENV=production`, so schema updates apply after you deploy a new image that includes new migrations.
-
-### 3. Automatic deploy (Gitea Actions)
-
-Workflow file: **`.gitea/workflows/registry-build-deploy.yml`**.
-
-**Requirements:**
-
-- **Gitea Actions** enabled for the repository.
-- A **self-hosted runner** (with Docker) registered to Gitea — the workflow uses `runs-on: self-hosted`.
-- **Windows runners:** the workflow uses **PowerShell** (not Bash). Gitea’s runner was failing with `execvpe(/bin/bash) failed` when Bash was routed through WSL without a real `/bin/bash`. If your runner is **Linux**, switch `.gitea/workflows/registry-build-deploy.yml` to `defaults.run.shell: bash` and use Bash syntax instead.
-- **Repository → Actions → Variables** (examples):
-
-  - `REGISTRY_HOST` — e.g. `178.131.50.201:3000`
-  - `REGISTRY_OWNER` — image namespace (same as Docker image path after the host), e.g. `admin`
-  - `PUBLIC_BASE_URL` — URL users open in the browser, e.g. `http://178.131.50.201:8088` (no trailing slash)
-  - `DEPLOY_SECRETS_DIR` — **absolute path on the runner machine** to the folder containing `database.staging.env` and `backend.staging.env`
-  - Optional: `STAGING_HTTP_PORT` (defaults to `8088`)
-
-- **Repository → Actions → Secrets:**
-
-  - `REGISTRY_USERNAME`
-  - `REGISTRY_PASSWORD` — access token with package read/write (or equivalent)
-
-**Trigger:** push to **`main`** or **`master`**, or run the workflow manually (**workflow_dispatch**).
-
-The pipeline clones from your Gitea instance, builds and pushes backend/frontend images, then on the runner runs **`docker compose pull`** and **`up -d`** using `infrastructure/docker-compose.registry.yml`.
 
 ---
 
@@ -148,5 +34,6 @@ The pipeline clones from your Gitea instance, builds and pushes backend/frontend
 |------|------|
 | `backend/Dockerfile` | API image |
 | `frontend/Dockerfile` | Web image |
+| `infrastructure/STAGING-DEPLOY.md` | Staging setup, CI variables, testing |
 | `infrastructure/docker-compose.registry.yml` | Pull-only staging stack (registry images + nginx + postgres) |
 | `infrastructure/deploy.registry.env.example` | Template for `deploy.registry.env` |

backend/.env.example

@@ -72,3 +72,7 @@ OPENROUTER_API_KEY=
 # plus processing takes ten seconds at minimum — so it is purely an abuse guard.
 # VOICE_THROTTLE_TTL=60
 # VOICE_THROTTLE_LIMIT=6
+
+# GlitchTip (optional). Leave empty for local unless you want to send events.
+# SENTRY_DSN=https://PUBLIC_KEY@errors.wixur.ir/1
+# SENTRY_ENVIRONMENT=development

backend/Dockerfile

@@ -47,7 +47,8 @@ COPY --from=builder /app/dist ./dist
 COPY --from=builder /app/node_modules ./node_modules
 
 COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
-RUN chmod +x /usr/local/bin/docker-entrypoint.sh
+# Windows git/build context may use CRLF; strip before chmod (fixes dumb-init "No such file or directory").
+RUN sed -i 's/\r$//' /usr/local/bin/docker-entrypoint.sh && chmod +x /usr/local/bin/docker-entrypoint.sh
 
 RUN mkdir -p /app/logs && \
     chown -R dyolink:nodejs /app

backend/package-lock.json

@@ -25,6 +25,7 @@
         "@nestjs/throttler": "^6.5.0",
         "@nestjs/websockets": "^11.1.28",
         "@prisma/client": "^6.19.2",
+        "@sentry/nestjs": "^10.72.0",
         "adminjs": "^7.8.17",
         "axios": "^1.13.5",
         "bcrypt": "^6.0.0",
@@ -4649,6 +4650,119 @@
         "npm": ">=5.10.0"
       }
     },
+    "node_modules/@opentelemetry/api": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.1.tgz",
+      "integrity": "sha512-gLyJlPHPZYdAk1JENA9LeHejZe1Ti77/pTeFm/nMXmQH/HFZlcS/O2XJB+L8fkbrNSqhdtlvjBVjxwUYanNH5Q==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
+    "node_modules/@opentelemetry/api-logs": {
+      "version": "0.220.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/api-logs/-/api-logs-0.220.0.tgz",
+      "integrity": "sha512-CmVa4ImJ+ynfrPMNaAXHET6Bhb44SwzmfyVJFq9ni2jgXJR/l7C6gfVFddNmHP+ZOkP9cf4f9DBe68qVLTHc9w==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/api": "^1.3.0"
+      },
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
+    "node_modules/@opentelemetry/core": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.10.0.tgz",
+      "integrity": "sha512-/wNZ8twnEQQA4HoHu22+vcsdru6pWPWxW+7w+FlxT6Id7PE/WIbZmVKkte+PF72e0F2dnImFeHD2syyE1Mw6MQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/semantic-conventions": "^1.29.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/instrumentation": {
+      "version": "0.220.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation/-/instrumentation-0.220.0.tgz",
+      "integrity": "sha512-xQx3E2WxP1mDvKzxLxX+CTCtNLa560YJZ3087qYHerl2YmiKpv7AH+dAy7vmx+eVrZ5BwhfWUAVoKOoxCNHcpw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/api-logs": "0.220.0",
+        "import-in-the-middle": "^3.0.0",
+        "require-in-the-middle": "^8.0.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": "^1.3.0"
+      }
+    },
+    "node_modules/@opentelemetry/resources": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.10.0.tgz",
+      "integrity": "sha512-q6MMm2zhggzsHVNbabYwut+a6nbuQQe3URUoxaojM/8K1IBfwwPzvxIjNi2/lI1TFe+fMHMW9MWhrtDLEXEnkA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/core": "2.10.0",
+        "@opentelemetry/semantic-conventions": "^1.29.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/sdk-trace": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace/-/sdk-trace-2.10.0.tgz",
+      "integrity": "sha512-MfQGq3GRmTh5fM/y+OjaO0vj6+luCB1XO2gfXCalKCfgKw0eHL++sm75DNweC6ohlp+aFvACqeE0fYayqdRaoQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/core": "2.10.0",
+        "@opentelemetry/resources": "2.10.0",
+        "@opentelemetry/semantic-conventions": "^1.29.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/sdk-trace-base": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-2.10.0.tgz",
+      "integrity": "sha512-GuYQQT7QD2EeO8lcZLRQzcbOyhqAzL+6WWTKTU9mSUBYBazkEDl+VrQcXQhbB08OWM9anD1aHleVadzulpOaUQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/core": "2.10.0",
+        "@opentelemetry/resources": "2.10.0",
+        "@opentelemetry/sdk-trace": "2.10.0",
+        "@opentelemetry/semantic-conventions": "^1.29.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/semantic-conventions": {
+      "version": "1.43.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/semantic-conventions/-/semantic-conventions-1.43.0.tgz",
+      "integrity": "sha512-eSYWTm620tTk45EKSedaUL8MFYI8hW164hIXsgIHyxu3VobUB3fFCu5t0hQby6OoWRPsG1KkKUG2M5UadiLiVg==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=14"
+      }
+    },
     "node_modules/@paralleldrive/cuid2": {
       "version": "2.3.1",
       "resolved": "https://registry.npmjs.org/@paralleldrive/cuid2/-/cuid2-2.3.1.tgz",
@@ -5333,6 +5447,138 @@
       "hasInstallScript": true,
       "license": "Apache-2.0"
     },
+    "node_modules/@sentry/conventions": {
+      "version": "0.16.0",
+      "resolved": "https://registry.npmjs.org/@sentry/conventions/-/conventions-0.16.0.tgz",
+      "integrity": "sha512-fO9PLmHdVURcSPUpWCItWAtgKiMwGdJHbovoSEyLplX5sxs2ugvI4CBPTrkkgqhObnZOD0CnWBKDzSVQYBKEyQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@sentry/core": {
+      "version": "10.72.0",
+      "resolved": "https://registry.npmjs.org/@sentry/core/-/core-10.72.0.tgz",
+      "integrity": "sha512-UJMHZfbjP4qk+g4AQhZmzosMdICC2D9p0/hLrm1LofPsp+WBfcSnv9jsY1a9TfmpS4WCAmTx8nANYTIXifcBjA==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/conventions": "^0.16.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@sentry/nestjs": {
+      "version": "10.72.0",
+      "resolved": "https://registry.npmjs.org/@sentry/nestjs/-/nestjs-10.72.0.tgz",
+      "integrity": "sha512-+1wdX+fkv8zIZ+lI66Se1DKwPXoa6edxoHuAgWDwcqv3bKF8R75NqzXj+4U7FcgBI05i6HFiZJuyvx9BCECy8g==",
+      "license": "MIT",
+      "dependencies": {
+        "@opentelemetry/api": "^1.9.1",
+        "@opentelemetry/instrumentation": "^0.220.0",
+        "@sentry/conventions": "^0.16.0",
+        "@sentry/core": "10.72.0",
+        "@sentry/node": "10.72.0",
+        "@sentry/server-utils": "10.72.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@nestjs/common": "^8.0.0 || ^9.0.0 || ^10.0.0 || ^11.0.0",
+        "@nestjs/core": "^8.0.0 || ^9.0.0 || ^10.0.0 || ^11.0.0"
+      }
+    },
+    "node_modules/@sentry/node": {
+      "version": "10.72.0",
+      "resolved": "https://registry.npmjs.org/@sentry/node/-/node-10.72.0.tgz",
+      "integrity": "sha512-eQHQFxSX26MhG/nB+tAY4QRslnPvJse7pww/hd3zXAqNULRa5lFtjSLALcHx/KUVDCZdTPdUVZEj4nGidcHrow==",
+      "license": "MIT",
+      "dependencies": {
+        "@opentelemetry/api": "^1.9.1",
+        "@opentelemetry/instrumentation": "^0.220.0",
+        "@opentelemetry/sdk-trace-base": "^2.9.0",
+        "@sentry/conventions": "^0.16.0",
+        "@sentry/core": "10.72.0",
+        "@sentry/node-core": "10.72.0",
+        "@sentry/opentelemetry": "10.72.0",
+        "@sentry/server-utils": "10.72.0",
+        "import-in-the-middle": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@sentry/node-core": {
+      "version": "10.72.0",
+      "resolved": "https://registry.npmjs.org/@sentry/node-core/-/node-core-10.72.0.tgz",
+      "integrity": "sha512-xYuYWmWEWnN8h3YHa7mds212ANFgrxfrbmLvVg0p0wf9m6MFjLowOTmjaiK0XW20sM/veSelicre650bx8UFtQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/conventions": "^0.16.0",
+        "@sentry/core": "10.72.0",
+        "@sentry/opentelemetry": "10.72.0",
+        "import-in-the-middle": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": "^1.9.0",
+        "@opentelemetry/core": "^1.30.1 || ^2.1.0",
+        "@opentelemetry/exporter-trace-otlp-http": ">=0.57.0 <1",
+        "@opentelemetry/instrumentation": ">=0.57.1 <1",
+        "@opentelemetry/sdk-trace-base": "^1.30.1 || ^2.1.0"
+      },
+      "peerDependenciesMeta": {
+        "@opentelemetry/api": {
+          "optional": true
+        },
+        "@opentelemetry/core": {
+          "optional": true
+        },
+        "@opentelemetry/exporter-trace-otlp-http": {
+          "optional": true
+        },
+        "@opentelemetry/instrumentation": {
+          "optional": true
+        },
+        "@opentelemetry/sdk-trace-base": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@sentry/opentelemetry": {
+      "version": "10.72.0",
+      "resolved": "https://registry.npmjs.org/@sentry/opentelemetry/-/opentelemetry-10.72.0.tgz",
+      "integrity": "sha512-ZVbAM1rGU/awN7cH/jvC87WpQw0NOJx5id6dKnnefStXpP/kUnZXYhtX9gfBnofYvJWa5I5VUSeuKCLUcKL75w==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/conventions": "^0.16.0",
+        "@sentry/core": "10.72.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": "^1.9.0",
+        "@opentelemetry/core": "^1.30.1 || ^2.1.0",
+        "@opentelemetry/sdk-trace-base": "^1.30.1 || ^2.1.0"
+      }
+    },
+    "node_modules/@sentry/server-utils": {
+      "version": "10.72.0",
+      "resolved": "https://registry.npmjs.org/@sentry/server-utils/-/server-utils-10.72.0.tgz",
+      "integrity": "sha512-CWpHMYW81RDBSVBdnxulGUvvBhkBb/OpSr72ubSe1UkKTcgT0NDMCWxE3dLFXqSxzT4DaF5UlUVv9ii5Sse53w==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/conventions": "^0.16.0",
+        "@sentry/core": "10.72.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@sinclair/typebox": {
       "version": "0.34.49",
       "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.49.tgz",
@@ -8352,7 +8598,6 @@
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/cjs-module-lexer/-/cjs-module-lexer-2.2.0.tgz",
       "integrity": "sha512-4bHTS2YuzUvtoLjdy+98ykbNB5jS0+07EvFNXerqZQJ89F7DI6ET7OQo/HJuW6K0aVsKA9hj9/RVb2kQVOrPDQ==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/class-transformer": {
@@ -9222,10 +9467,9 @@
       }
     },
     "node_modules/es-module-lexer": {
-      "version": "2.1.0",
+      "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.1.0.tgz",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.2.tgz",
-      "integrity": "sha512-n27zTYMjYu1aj4MjCWzSP7G9r75utsaoc8m61weK+W8JMBGGQybd43GstCXZ3WNmSFtGT9wi59qQTW6mhTR5LQ==",
+      "integrity": "sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/es-object-atoms": {
@@ -10649,6 +10893,20 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/import-in-the-middle": {
+      "version": "3.3.3",
+      "resolved": "https://registry.npmjs.org/import-in-the-middle/-/import-in-the-middle-3.3.3.tgz",
+      "integrity": "sha512-AiohS3H80sXO6owEltjGX+glb7qXaDhBoJb9XcQVH4UI207xu/bDLUcadVKp7Qe576reg9yr/PXZjV5qx8gfbA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "cjs-module-lexer": "^2.2.0",
+        "es-module-lexer": "^2.2.0",
+        "module-details-from-path": "^1.0.4"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/import-local": {
       "version": "3.2.0",
       "resolved": "https://registry.npmjs.org/import-local/-/import-local-3.2.0.tgz",
@@ -12517,6 +12775,12 @@
         "node": ">=16 || 14 >=14.17"
       }
     },
+    "node_modules/module-details-from-path": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/module-details-from-path/-/module-details-from-path-1.0.4.tgz",
+      "integrity": "sha512-EGWKgxALGMgzvxYF1UyGTy0HXX/2vHLkw6+NvDKW2jypWbHpjQuj4UMcqQWXHERJhVGKikolT06G3bcKe4fi7w==",
+      "license": "MIT"
+    },
     "node_modules/ms": {
       "version": "2.1.3",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
@@ -14205,6 +14469,19 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/require-in-the-middle": {
+      "version": "8.0.1",
+      "resolved": "https://registry.npmjs.org/require-in-the-middle/-/require-in-the-middle-8.0.1.tgz",
+      "integrity": "sha512-QT7FVMXfWOYFbeRBF6nu+I6tr2Tf3u0q8RIEjNob/heKY/nh7drD/k7eeMFmSQgnTtCzLDcCu/XEnpW2wk4xCQ==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.3.5",
+        "module-details-from-path": "^1.0.3"
+      },
+      "engines": {
+        "node": ">=9.3.0 || >=8.10.0 <9.0.0"
+      }
+    },
     "node_modules/resolve": {
       "version": "1.22.12",
       "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.12.tgz",

backend/package.json

@@ -46,6 +46,7 @@
     "@nestjs/throttler": "^6.5.0",
     "@nestjs/websockets": "^11.1.28",
     "@prisma/client": "^6.19.2",
+    "@sentry/nestjs": "^10.72.0",
     "adminjs": "^7.8.17",
     "axios": "^1.13.5",
     "bcrypt": "^6.0.0",

backend/prisma/migrations/20260714194721/migration.sql

@@ -0,0 +1,2 @@
+-- DropIndex
+DROP INDEX "lab_cases_dueDate_idx";

backend/src/app.module.ts

@@ -1,6 +1,7 @@
 import { Module } from '@nestjs/common';
 import { ConfigModule, ConfigService } from '@nestjs/config';
 import { ThrottlerModule } from '@nestjs/throttler';
+import { SentryModule } from '@sentry/nestjs/setup';
 import configurations from './configs/configurations';
 import { AuthModule } from './modules/auth/auth.module';
 import { AppController } from './app.controller';
@@ -25,6 +26,7 @@ import { VoiceModule } from './modules/voice/voice.module';
 
 @Module({
   imports: [
+    SentryModule.forRoot(),
     ConfigModule.forRoot({
       isGlobal: true,
       load: [configurations],

backend/src/common/errors/http-exception.filter.ts

@@ -6,6 +6,7 @@ import {
   HttpStatus,
   Logger,
 } from '@nestjs/common';
+import * as Sentry from '@sentry/nestjs';
 import type { Response } from 'express';
 import { AppException, type AppErrorResponse } from './app.exception';
 import { ErrorCode, type ErrorCodeValue } from './error-codes';
@@ -42,6 +43,9 @@ export class HttpExceptionFilter implements ExceptionFilter {
       this.logger.error(
         exception instanceof Error ? exception.stack : String(exception),
       );
+      if (Sentry.getClient()) {
+        Sentry.captureException(exception);
+      }
     }
 
     response.status(statusCode).json(body);

backend/src/instrument.ts

@@ -0,0 +1,36 @@
+import { config } from 'dotenv';
+import * as Sentry from '@sentry/nestjs';
+
+config();
+
+const dsn = process.env.SENTRY_DSN?.trim();
+
+if (dsn) {
+  Sentry.init({
+    dsn,
+    environment:
+      process.env.SENTRY_ENVIRONMENT?.trim() ||
+      process.env.NODE_ENV ||
+      'development',
+    release: process.env.SENTRY_RELEASE?.trim() || undefined,
+    sendDefaultPii: false,
+    tracesSampleRate: 0,
+    beforeSend(event) {
+      if (event.request) {
+        delete event.request.cookies;
+        delete event.request.data;
+        if (event.request.headers) {
+          delete event.request.headers.cookie;
+          delete event.request.headers.authorization;
+          delete event.request.headers.Authorization;
+        }
+      }
+      if (event.user) {
+        delete event.user.email;
+        delete event.user.ip_address;
+        delete event.user.username;
+      }
+      return event;
+    },
+  });
+}

backend/src/main.ts

@@ -1,4 +1,5 @@
 // backend/src/main.ts
+import './instrument';
 import { NestFactory } from '@nestjs/core';
 import { urlencoded } from 'express';
 import { AppModule } from './app.module';

frontend/.env.example

@@ -5,3 +5,7 @@ NEXT_PUBLIC_API_URL=http://localhost:3000/api
 NEXT_PUBLIC_APP_NAME=DyoLink
 # URL where users open the frontend (used for metadata, images, etc.)
 NEXT_PUBLIC_APP_URL=http://localhost:3001
+
+# GlitchTip frontend project DSN (optional locally). Baked into the Docker image in CI.
+# NEXT_PUBLIC_SENTRY_DSN=https://PUBLIC_KEY@errors.wixur.ir/2
+# NEXT_PUBLIC_SENTRY_ENVIRONMENT=development

frontend/Dockerfile

@@ -18,12 +18,16 @@ COPY . .
 ARG NEXT_PUBLIC_API_URL
 ARG NEXT_PUBLIC_APP_URL
 ARG NEXT_PUBLIC_APP_NAME
+ARG NEXT_PUBLIC_SENTRY_DSN
+ARG NEXT_PUBLIC_SENTRY_ENVIRONMENT
 
 ENV NEXT_TELEMETRY_DISABLED=1
 ENV NODE_ENV=production
 ENV NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL}
 ENV NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL}
 ENV NEXT_PUBLIC_APP_NAME=${NEXT_PUBLIC_APP_NAME}
+ENV NEXT_PUBLIC_SENTRY_DSN=${NEXT_PUBLIC_SENTRY_DSN}
+ENV NEXT_PUBLIC_SENTRY_ENVIRONMENT=${NEXT_PUBLIC_SENTRY_ENVIRONMENT}
 
 RUN npm run build
 
@@ -41,19 +45,19 @@ ENV NODE_ENV=production
 ENV PORT=3000
 ENV HOSTNAME=0.0.0.0
 
-COPY --from=builder /app/public ./public
 COPY --from=builder --chown=dyolink:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=dyolink:nodejs /app/.next/static ./.next/static
 
 COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
-RUN chmod +x /usr/local/bin/docker-entrypoint.sh
+# Windows git/build context may use CRLF; strip before chmod (fixes dumb-init "No such file or directory").
+RUN sed -i 's/\r$//' /usr/local/bin/docker-entrypoint.sh && chmod +x /usr/local/bin/docker-entrypoint.sh
 
 USER dyolink
 
 EXPOSE 3000
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=40s --retries=3 \
-  CMD node -e "require('http').get('http://127.0.0.1:3000/', (r) => {if(r.statusCode!==200)process.exit(1)})"
+  CMD node -e "require('http').get('http://127.0.0.1:3000/', (r) => { process.exit(r.statusCode >= 200 && r.statusCode < 400 ? 0 : 1); }).on('error', () => process.exit(1))"
 
 ENTRYPOINT ["dumb-init", "--", "docker-entrypoint.sh"]
 

frontend/messages/en.json

@@ -18,6 +18,9 @@
     "redirecting": "Redirecting…",
     "readOnlyAccess": "Read-only access for this organization.",
     "errorGeneric": "Something went wrong",
+    "pageErrorTitle": "Something went wrong",
+    "pageErrorBody": "This page failed to load. You can try again.",
+    "tryAgain": "Try again",
     "loadingEllipsis": "Loading...",
     "search": "Search",
     "action": "Action",

frontend/messages/fa.json

@@ -18,6 +18,9 @@
     "redirecting": "در حال انتقال...",
     "readOnlyAccess": "دسترسی فقط خواندنی برای این سازمان.",
     "errorGeneric": "خطایی رخ داده است",
+    "pageErrorTitle": "خطایی رخ داده است",
+    "pageErrorBody": "این صفحه بارگذاری نشد. می‌توانید دوباره تلاش کنید.",
+    "tryAgain": "تلاش دوباره",
     "loadingEllipsis": "در حال بارگذاری...",
     "search": "جستجو",
     "action": "عملیات",

frontend/messages/nl.json

@@ -18,6 +18,9 @@
     "redirecting": "Bezig met doorsturen...",
     "readOnlyAccess": "Alleen-lezen toegang voor deze organisatie.",
     "errorGeneric": "Er is iets misgegaan",
+    "pageErrorTitle": "Er is iets misgegaan",
+    "pageErrorBody": "Deze pagina kon niet worden geladen. U kunt het opnieuw proberen.",
+    "tryAgain": "Opnieuw proberen",
     "loadingEllipsis": "Laden...",
     "search": "Zoeken",
     "action": "Actie",

frontend/next.config.ts

@@ -1,4 +1,5 @@
 import type { NextConfig } from 'next';
+import { withSentryConfig } from '@sentry/nextjs';
 import createNextIntlPlugin from 'next-intl/plugin';
 
 const withNextIntl = createNextIntlPlugin('./src/i18n/request.ts');
@@ -35,9 +36,15 @@ const nextConfig: NextConfig = {
     NEXT_PUBLIC_APP_NAME: process.env.NEXT_PUBLIC_APP_NAME,
     NEXT_PUBLIC_APP_URL: process.env.NEXT_PUBLIC_APP_URL,
     NEXT_PUBLIC_API_URL: process.env.NEXT_PUBLIC_API_URL,
+    NEXT_PUBLIC_SENTRY_DSN: process.env.NEXT_PUBLIC_SENTRY_DSN,
+    NEXT_PUBLIC_SENTRY_ENVIRONMENT: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
   },
   output: 'standalone',
   compress: true,
 };
 
-export default withNextIntl(nextConfig);
+export default withSentryConfig(withNextIntl(nextConfig), {
+  silent: true,
+  sourcemaps: { disable: true },
+  disableLogger: true,
+});

frontend/package.json

@@ -10,6 +10,7 @@
   },
   "dependencies": {
     "@hookform/resolvers": "^5.2.2",
+    "@sentry/nextjs": "^10.72.0",
     "@tanstack/react-query": "^5.90.21",
     "axios": "^1.13.6",
     "js-cookie": "^3.0.5",

frontend/src/app/[locale]/error.tsx

@@ -0,0 +1,30 @@
+'use client';
+
+import { useEffect } from 'react';
+import { useTranslations } from 'next-intl';
+import * as Sentry from '@sentry/nextjs';
+import { Button } from '@/components/ui/shared/Button';
+
+export default function LocaleError({
+  error,
+  reset,
+}: {
+  error: Error & { digest?: string };
+  reset: () => void;
+}) {
+  const t = useTranslations('common');
+
+  useEffect(() => {
+    Sentry.captureException(error);
+  }, [error]);
+
+  return (
+    <div className="flex min-h-[50vh] flex-col items-center justify-center gap-4 px-4 text-center">
+      <h1 className="text-lg font-semibold">{t('pageErrorTitle')}</h1>
+      <p className="max-w-md text-sm text-text-secondary">{t('pageErrorBody')}</p>
+      <Button type="button" onClick={() => reset()}>
+        {t('tryAgain')}
+      </Button>
+    </div>
+  );
+}

frontend/src/app/global-error.tsx

@@ -0,0 +1,44 @@
+'use client';
+
+import { useEffect } from 'react';
+import * as Sentry from '@sentry/nextjs';
+
+export default function GlobalError({
+  error,
+  reset,
+}: {
+  error: Error & { digest?: string };
+  reset: () => void;
+}) {
+  useEffect(() => {
+    Sentry.captureException(error);
+  }, [error]);
+
+  return (
+    <html lang="en">
+      <body>
+        <div
+          style={{
+            display: 'flex',
+            minHeight: '100vh',
+            flexDirection: 'column',
+            alignItems: 'center',
+            justifyContent: 'center',
+            gap: '1rem',
+            padding: '1rem',
+            textAlign: 'center',
+            fontFamily: 'system-ui, sans-serif',
+          }}
+        >
+          <h1 style={{ fontSize: '1.125rem', fontWeight: 600 }}>Something went wrong</h1>
+          <p style={{ maxWidth: '28rem', fontSize: '0.875rem' }}>
+            The page failed to load. You can try again.
+          </p>
+          <button type="button" onClick={() => reset()}>
+            Try again
+          </button>
+        </div>
+      </body>
+    </html>
+  );
+}

frontend/src/components/ui/today/TodayWidgetErrorBoundary.tsx

@@ -1,5 +1,6 @@
 'use client';
 
+import * as Sentry from '@sentry/nextjs';
 import { Component, type ErrorInfo, type ReactNode } from 'react';
 
 interface TodayWidgetErrorBoundaryProps {
@@ -23,6 +24,7 @@ export class TodayWidgetErrorBoundary extends Component<
 
   componentDidCatch(error: Error, info: ErrorInfo) {
     console.error('Today widget render error:', error, info);
+    Sentry.captureException(error, { extra: { componentStack: info.componentStack } });
   }
 
   render() {

frontend/src/instrumentation-client.ts

@@ -0,0 +1,15 @@
+import * as Sentry from '@sentry/nextjs';
+import { sentrySharedOptions } from '@/lib/error-tracking/sentrySharedOptions';
+
+const dsn = process.env.NEXT_PUBLIC_SENTRY_DSN?.trim();
+
+if (dsn) {
+  Sentry.init({
+    dsn,
+    environment:
+      process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT?.trim() ||
+      process.env.NODE_ENV ||
+      'development',
+    ...sentrySharedOptions(),
+  });
+}

frontend/src/instrumentation.ts

@@ -0,0 +1,9 @@
+import * as Sentry from '@sentry/nextjs';
+
+export async function register(): Promise<void> {
+  if (process.env.NEXT_RUNTIME === 'nodejs') {
+    await import('./lib/error-tracking/sentry.server.config');
+  }
+}
+
+export const onRequestError = Sentry.captureRequestError;

frontend/src/lib/api/client.ts

@@ -2,6 +2,7 @@
 import axios, { AxiosError, InternalAxiosRequestConfig } from 'axios';
 import type { ApiError } from '@/types/api';
 import { notifyAccessTokenRefreshed } from '@/lib/auth/accessTokenEvents';
+import { reportUnexpectedApiFailure } from '@/lib/error-tracking/reportUnexpectedApiFailure';
 
 interface CustomAxiosRequestConfig extends InternalAxiosRequestConfig {
   _retry?: boolean;
@@ -46,6 +47,7 @@ function shouldSkipRefreshRetry(url: string | undefined): boolean {
 apiClient.interceptors.response.use(
   (response) => response,
   async (error: AxiosError) => {
+    reportUnexpectedApiFailure(error);
     const originalRequest = error.config as CustomAxiosRequestConfig;
 
     if (

frontend/src/lib/api/voice.ts

@@ -22,8 +22,11 @@ export const voiceApi = {
     payload: ExtractVoicePayload,
     signal?: AbortSignal,
   ): Promise<{ success: boolean; data: VoiceExtractionResult }> => {
-    // Forwarded so cancelling closes the connection; the controller turns that into an abort.
+    // ASR + LLM routinely exceeds the default 10s axios timeout; match slow upload endpoints.
-    const response = await apiClient.post('/voice/extract', payload, { signal });
+    const response = await apiClient.post('/voice/extract', payload, {
+      signal,
+      timeout: 120_000,
+    });
     return response.data;
   },
 };

frontend/src/lib/error-tracking/reportUnexpectedApiFailure.ts

@@ -0,0 +1,20 @@
+import * as Sentry from '@sentry/nextjs';
+import type { AxiosError } from 'axios';
+
+/** Report network failures and HTTP 5xx only — not coded 4xx AppExceptions. */
+export function reportUnexpectedApiFailure(error: AxiosError): void {
+  const status = error.response?.status;
+  if (status !== undefined && status < 500) {
+    return;
+  }
+
+  Sentry.captureException(error, {
+    tags: {
+      api_status: status ? String(status) : 'network',
+    },
+    extra: {
+      url: error.config?.url,
+      method: error.config?.method,
+    },
+  });
+}

frontend/src/lib/error-tracking/sentry.server.config.ts

@@ -0,0 +1,15 @@
+import * as Sentry from '@sentry/nextjs';
+import { sentrySharedOptions } from '@/lib/error-tracking/sentrySharedOptions';
+
+const dsn = process.env.NEXT_PUBLIC_SENTRY_DSN?.trim();
+
+if (dsn) {
+  Sentry.init({
+    dsn,
+    environment:
+      process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT?.trim() ||
+      process.env.NODE_ENV ||
+      'development',
+    ...sentrySharedOptions(),
+  });
+}

frontend/src/lib/error-tracking/sentrySharedOptions.ts

@@ -0,0 +1,28 @@
+import type { ErrorEvent } from '@sentry/core';
+
+/** Shared Sentry/GlitchTip options — no session replay, no PII in payloads. */
+export function sentrySharedOptions() {
+  return {
+    sendDefaultPii: false as const,
+    tracesSampleRate: 0,
+    replaysSessionSampleRate: 0,
+    replaysOnErrorSampleRate: 0,
+    beforeSend(event: ErrorEvent): ErrorEvent {
+      if (event.request) {
+        delete event.request.cookies;
+        delete event.request.data;
+        if (event.request.headers) {
+          delete event.request.headers.cookie;
+          delete event.request.headers.authorization;
+          delete event.request.headers.Authorization;
+        }
+      }
+      if (event.user) {
+        delete event.user.email;
+        delete event.user.ip_address;
+        delete event.user.username;
+      }
+      return event;
+    },
+  };
+}

infrastructure/DEPLOY.md

@@ -1,13 +1,84 @@
 # Dyolink — Production Server Deploy Guide
 
-Deploy the full stack (Postgres, NestJS API, Next.js, Nginx, Let's Encrypt) on a fresh Linux server using **Docker Hub** images.
+Linux VPS serves **`https://nudentic.ir` only**. Images come from the **Gitea registry** (`wixur.ir:3000`) on git tags. Staging is Windows (`https://wixur.ir`) — see [`STAGING-DEPLOY.md`](STAGING-DEPLOY.md).
 
-**Example used in production:** `https://wixur.ir` on server `185.243.48.140`.
+**Automated path:** tag `v1.0.1` → [`.gitea/workflows/prod-tag-deploy.yml`](../.gitea/workflows/prod-tag-deploy.yml) (Windows runner builds, SSH to this server).
+
+**Manual / first SSL:** Docker Hub + [`scripts/build-and-push-prod.sh`](scripts/build-and-push-prod.sh) is still documented below as a fallback.
+
+**Example host:** `https://nudentic.ir` (do not point `wixur.ir` at this VPS).
+
+---
+
+## Automated deploy (Gitea tags)
+
+```
+git tag v1.0.1 && git push origin v1.0.1
+        ↓
+Windows act_runner builds frontend with https://nudentic.ir
+        ↓
+Push wixur.ir:3000/<owner>/dyolink-*:v1.0.1   (never :latest)
+        ↓
+SSH → Linux  docker login wixur.ir:3000  →  compose pull + up
+        ↓
+https://nudentic.ir
+```
+
+`:latest` is **staging only** (wixur.ir baked in). Production compose must pin `TAG=v1.0.1`.
+
+### One-time on the Linux server
+
+1. **HTTP registry** — Gitea is `http://wixur.ir:3000`. In `/etc/docker/daemon.json`:
+
+```json
+{
+  "insecure-registries": ["wixur.ir:3000"]
+}
+```
+
+Then `sudo systemctl restart docker` (containers restart).
+
+2. **`.env`** in `/opt/dyolink/infrastructure/` — from [`deploy.prod.env.example`](deploy.prod.env.example):
+
+- `DOMAIN=nudentic.ir`
+- `REGISTRY_PREFIX=wixur.ir:3000/<gitea-owner>` (same owner as Gitea `REGISTRY_OWNER`)
+- `TAG=v1.0.1` (CI overrides per release)
+
+3. **`secrets/backend.env`:** `FRONTEND_URL=https://nudentic.ir`, `COOKIE_SECURE=true`
+
+4. **SSH** — user that can run `docker` (e.g. `dyolink` in the `docker` group). Put the matching **public** key in `~/.ssh/authorized_keys`.
+
+5. **Test pull** (after a staging or prod image exists):
+
+```bash
+docker login wixur.ir:3000 -u <gitea-user>
+docker pull wixur.ir:3000/<owner>/dyolink-backend:<sha-or-tag>
+```
+
+### Gitea (same repo as staging)
+
+**Variables:** `PROD_PUBLIC_BASE_URL=https://nudentic.ir`, `PROD_REGISTRY_HOST=wixur.ir:3000`, `PROD_INFRA_DIR=/opt/dyolink/infrastructure`, plus existing `REGISTRY_HOST` / `REGISTRY_OWNER` / `CLONE_HOST`.
+
+**Secrets:** `PROD_SSH_HOST`, `PROD_SSH_USER`, `PROD_SSH_KEY` (private key). Reuse `REGISTRY_USERNAME` / `REGISTRY_PASSWORD`. Optional `PROD_SSH_PORT` (default 22).
+
+OpenSSH must be on the Windows runner (`ssh.exe` / `scp.exe`).
+
+### Release
+
+```bash
+git tag v1.0.1
+git push origin v1.0.1
+```
+
+Or Gitea → Actions → **Production — tag build, push, deploy** → Run → tag `v1.0.1`.
+
+Check `https://nudentic.ir/api/health`.
 
 ---
 
 ## Architecture
 
+
 ```
 Internet → Nginx (:80 / :443)
               ├── /      → frontend:3000  (Next.js)
@@ -18,8 +89,8 @@ Internet → Nginx (:80 / :443)
 | Service   | Image                              | Notes                          |
 |-----------|------------------------------------|--------------------------------|
 | postgres  | `postgres:15-alpine`               | Data in Docker volume          |
-| backend   | `dyolink/dyolink-backend:latest`   | Runs migrations + seed on start |
+| backend   | `REGISTRY_PREFIX/dyolink-backend:TAG` | Gitea `v*` or Hub `dyolink/…` |
-| frontend  | `dyolink/dyolink-frontend:latest`  | URLs baked in at **build time** |
+| frontend  | `REGISTRY_PREFIX/dyolink-frontend:TAG` | URLs baked in at **build time** |
 | nginx     | `nginx:alpine`                     | SSL termination + reverse proxy |
 | certbot   | `certbot/certbot`                  | Auto-renews certificates       |
 
@@ -289,16 +360,19 @@ Open `https://YOUR_DOMAIN` in a browser.
 
 ## Updating the app (new release)
 
-**On Mac** — build & push:
+**Preferred:** `git tag vX.Y.Z && git push origin vX.Y.Z` (Gitea production workflow).
+
+**Fallback (Docker Hub from a Mac):**
 
 ```bash
-./infrastructure/scripts/build-and-push-prod.sh wixur.ir latest
+./infrastructure/scripts/build-and-push-prod.sh nudentic.ir v1.0.1
 ```
 
-**On server:**
+**On server** (if not using CI):
 
 ```bash
 cd /opt/dyolink/infrastructure
+# TAG in .env or: TAG=v1.0.1 docker compose -f docker-compose.prod.yml --env-file .env pull backend frontend
 docker compose -f docker-compose.prod.yml --env-file .env pull backend frontend
 docker compose -f docker-compose.prod.yml --env-file .env up -d
 ```
@@ -361,6 +435,23 @@ docker volume rm dyolink_postgres_data_prod
 ./scripts/deploy-prod.sh
 ```
 
+### Docker login to `wixur.ir:3000`: `http response to HTTPS client`
+
+Add `"insecure-registries": ["wixur.ir:3000"]` to `/etc/docker/daemon.json` and restart Docker.
+
+### `connection reset by peer` while pulling `:v*` from Gitea
+
+`docker login` succeeded, then `compose pull` failed on a frontend/backend manifest or layer from `wixur.ir:3000`. Auth is fine — the Windows Gitea registry dropped the TCP connection (common right after a large push, or when both images pull in parallel).
+
+Images are already in the registry. Re-run only the **deploy** job, or on the VPS:
+
+```bash
+cd /opt/dyolink/infrastructure
+./scripts/prod-remote-deploy.sh v1.0.2
+```
+
+`prod-remote-deploy.sh` pulls backend then frontend with retries. If every attempt RSTs, check Gitea is up and `insecure-registries` includes `wixur.ir:3000`.
+
 ### View logs
 
 ```bash
@@ -385,12 +476,13 @@ docker compose -f docker-compose.prod.yml --env-file .env exec frontend \
 
 | Path on server | Purpose |
 |----------------|---------|
-| `/opt/dyolink/infrastructure/.env` | Domain, Docker Hub user, Let's Encrypt email |
+| `/opt/dyolink/infrastructure/.env` | `DOMAIN`, `REGISTRY_PREFIX`, `TAG`, Let's Encrypt email |
 | `/opt/dyolink/secrets/database.env` | Postgres credentials |
-| `/opt/dyolink/secrets/backend.env` | API secrets, DATABASE_URL, JWT, SMS |
+| `/opt/dyolink/secrets/backend.env` | API secrets, DATABASE_URL, JWT, SMS, `FRONTEND_URL` |
 | `/opt/dyolink/infrastructure/nginx/generated/default.conf` | Auto-generated nginx SSL config |
-| `/opt/dyolink/infrastructure/scripts/deploy-prod.sh` | Main deploy entry point |
+| `/opt/dyolink/infrastructure/scripts/prod-remote-deploy.sh` | Tag deploy (CI SSH) |
-| `/opt/dyolink/infrastructure/scripts/build-and-push-prod.sh` | Build & push (run on Mac) |
+| `/opt/dyolink/infrastructure/scripts/deploy-prod.sh` | First-time SSL + stack up |
+| `.gitea/workflows/prod-tag-deploy.yml` | CI: build, push `:v*`, SSH deploy |
 
 ---
 

infrastructure/STAGING-DEPLOY.md

@@ -0,0 +1,348 @@
+# Dyolink — Staging deploy (Gitea + Windows)
+
+Automatic staging on a **self-hosted Gitea** machine: merge (or push) to **`master`** → build Docker images → push to Gitea Container Registry → deploy on the same host.
+
+| Public URL | What |
+|------------|------|
+| `https://wixur.ir` | Staging app (port **443** → Windows nginx → Docker). Mobinnet: public **80** is the modem. |
+| `http://wixur.ir:8088` | HTTP fallback |
+| `http://wixur.ir:3000` | Gitea + container registry |
+
+DNS `wixur.ir` must point at the **Windows** host. Production (`https://nudentic.ir` on Linux) is separate — see [`DEPLOY.md`](DEPLOY.md). Do **not** point `wixur.ir` at the Linux VPS.
+
+---
+
+## Architecture
+
+```
+Push / merge to master
+        ↓
+Gitea Actions (self-hosted act_runner on Windows)
+        ↓
+Build backend + frontend → push to Gitea registry
+        ↓
+docker compose pull + up -d (docker-compose.registry.yml)
+        ↓
+https://wixur.ir       →  Windows nginx :443 →  127.0.0.1:18088  →  Docker nginx → app
+http://wixur.ir:8088   →  portproxy :8088    →  127.0.0.1:18088  (fallback)
+http://wixur.ir:3000   →  Gitea (native, no Docker)
+```
+
+| Service  | Image source                                      |
+|----------|---------------------------------------------------|
+| postgres | `postgres:15-alpine` (pulled from Docker Hub)     |
+| backend  | `<REGISTRY_HOST>/<owner>/dyolink-backend:<sha>`   |
+| frontend | `<REGISTRY_HOST>/<owner>/dyolink-frontend:<sha>`  |
+| nginx    | `nginx:alpine`                                    |
+
+Frontend public URLs are **baked in at build time** via `PUBLIC_BASE_URL`. After changing the public URL, re-run the Gitea workflow (or push to `master`) and set `FRONTEND_URL` in `C:\dyolink\secrets\backend.staging.env` to the same origin.
+
+---
+
+## Cut over from `:8088` to `http://wixur.ir`
+
+DNS A record for `wixur.ir` → Windows IP (already done if `http://wixur.ir:3000` and `:8088` work).
+
+On Windows: host nginx on **80** proxies to Docker **18088** ([`nginx/windows-edge-http.conf`](nginx/windows-edge-http.conf)). Remove portproxy on **80** (keep **8088** as fallback). Router must forward **80**. See §7.
+
+In Gitea → repo → **Settings → Actions → Variables**:
+
+- `PUBLIC_BASE_URL` = `https://wixur.ir`
+- `STAGING_HTTP_PORT` = `80` (optional; workflow default is 80)
+
+On disk: `FRONTEND_URL=https://wixur.ir` and `COOKIE_SECURE=true` in `C:\dyolink\secrets\backend.staging.env`.
+
+Then run the **Registry — build, push, deploy** workflow so the frontend image is rebuilt without `:8088`.
+
+---
+
+---
+
+## Triggers
+
+| Event | Staging deploy? |
+|-------|-----------------|
+| Push to `master` | Yes |
+| PR merged into `master` | Yes (merge = push to `master`) |
+| Push to other branches only | No |
+| Git tag (e.g. `v1.0.0`) | No — reserved for production later |
+| Manual | Gitea → Actions → **Registry — build, push, deploy** → Run workflow |
+
+Workflow file: [`.gitea/workflows/registry-build-deploy.yml`](../.gitea/workflows/registry-build-deploy.yml)
+
+---
+
+## One-time setup (Windows host)
+
+### 1. Docker Desktop
+
+- Install and keep **Docker Desktop running** during builds/deploys.
+- **Settings → Docker Engine** — allow HTTP registry:
+
+```json
+{
+  "insecure-registries": [
+    "host.docker.internal:3000",
+    "127.0.0.1:3000",
+    "wixur.ir:3000"
+  ]
+}
+```
+
+Apply & restart Docker Desktop.
+
+**Why `host.docker.internal`?** Docker Desktop runs in a Linux VM. `docker login` runs from that VM — `127.0.0.1:3000` is the VM, not Gitea on Windows.
+
+### 2b. Gitea `app.ini` — match registry URL
+
+Edit `C:\gitea\custom\conf\app.ini`:
+
+```ini
+[server]
+ROOT_URL = http://host.docker.internal:3000/
+```
+
+Restart Gitea. Gitea uses `ROOT_URL` for Docker registry auth redirects.
+
+### 2c. Gitea Actions runner
+
+Download [act_runner](https://gitea.com/gitea/act_runner/releases) → e.g. `C:\gitea-runner\act_runner.exe`.
+
+**Important — runner level:** the registration token decides which repos can use the runner.
+
+| Token from | Runner level | Works for `admin/dyolink`? |
+|------------|--------------|----------------------------|
+| **Site Administration → Actions → Runners** | Instance (global) | Yes (recommended) |
+| **Repo → Settings → Actions → Runners** | Repository | Yes |
+| **User profile → Settings → Actions → Runners** | Individual | Often **no** — jobs stay queued with “no matching online runner” |
+
+If your runner shows **Type: Individual** in Gitea but jobs never start, delete it and re-register with an **instance** or **repository** token (table above).
+
+Register (use **localhost** when Gitea runs on the same PC — public IP often fails locally):
+
+```powershell
+cd C:\gitea-runner
+# Stop daemon first (Ctrl+C) if running
+.\act_runner.exe register `
+  --instance "http://127.0.0.1:3000" `
+  --token "<token-from-Site-Admin-OR-repo-Runners-page>" `
+  --name "windows-staging" `
+  --labels "windows:host"
+```
+
+Start (leave running, or install as a Windows service later):
+
+```powershell
+.\act_runner.exe daemon
+```
+
+**Verify:** open **your repo** → **Settings → Actions → Runners** — `windows-staging` must appear here as **Idle/Online** (not only under user settings).
+
+**Requires:** `git` on PATH (for workflow checkout step).
+
+### 3. Secret env files (not in git)
+
+```powershell
+New-Item -ItemType Directory -Force -Path "C:\dyolink\secrets"
+```
+
+Copy examples and edit:
+
+- `infrastructure/database.staging.env.example` → `C:\dyolink\secrets\database.staging.env`
+- `infrastructure/backend.staging.env.example` → `C:\dyolink\secrets\backend.staging.env`
+
+Rules:
+
+- `DATABASE_URL` password must match `POSTGRES_PASSWORD`.
+- `FRONTEND_URL` must match `PUBLIC_BASE_URL` (`http://wixur.ir`).
+- Replace JWT secrets with long random values (not `CHANGE_ME`).
+
+### 4. Gitea repository Variables
+
+**Settings → Actions → Variables**
+
+| Name | Example | Notes |
+|------|---------|--------|
+| `REGISTRY_HOST` | `host.docker.internal:3000` | **Windows + Docker Desktop:** Docker runs in a Linux VM — `127.0.0.1` is the VM, not Gitea. Use `host.docker.internal:3000`. Gitea `ROOT_URL` should match this so registry login from CI works. Browsers and the Linux VPS use `http://wixur.ir:3000`. |
+| `REGISTRY_OWNER` | `admin` | Gitea user/org owning packages |
+| `PUBLIC_BASE_URL` | `https://wixur.ir` | How **users** open staging (HTTPS on 443). No trailing slash. |
+| `DEPLOY_SECRETS_DIR` | `C:/dyolink/secrets` | Forward slashes OK on Windows |
+| `CLONE_HOST` | `127.0.0.1:3000` | Git clone (runs on Windows host, not inside Docker VM) |
+| `STAGING_HTTP_PORT` | `80` | Public HTTP port (portproxy). Optional; workflow default is 80. |
+| `STAGING_LOCAL_PORT` | `18088` | Docker bind on `127.0.0.1`. Must not be `80` if portproxy already uses 80. |
+
+**Naming note:** Gitea rejects variable names starting with `GITEA_` or `GITHUB_`. Use `CLONE_HOST`, not `GITEA_CLONE_URL`.
+
+### 5. Gitea repository Secrets
+
+**Settings → Actions → Secrets**
+
+| Name | Value |
+|------|--------|
+| `REGISTRY_USERNAME` | Gitea username |
+| `REGISTRY_PASSWORD` | Gitea access token with **package read/write** |
+
+Create token: profile → **Settings → Applications → Generate New Token**.
+
+### 6. Firewall (once)
+
+```powershell
+New-NetFirewallRule -DisplayName "Dyolink Staging HTTP 80" -Direction Inbound -Protocol TCP -LocalPort 80 -Action Allow
+# Optional fallback while cutting over from :8088
+New-NetFirewallRule -DisplayName "Dyolink Staging 8088" -Direction Inbound -Protocol TCP -LocalPort 8088 -Action Allow
+```
+
+### 7. Port 80 = host nginx (not portproxy)
+
+Gitea stays on **:3000**. Docker staging nginx binds **127.0.0.1:18088**. A **Windows nginx** (the 1.29.x you already have) listens on **80** and proxies to 18088. Config: [`nginx/windows-edge-http.conf`](nginx/windows-edge-http.conf).
+
+**Do not** run portproxy on port 80 at the same time — it will lose to nginx (404 / hang). Keep portproxy **8088 → 18088** as fallback.
+
+```powershell
+# 1) Free port 80 from portproxy (nginx will bind 80)
+netsh interface portproxy delete v4tov4 listenaddress=0.0.0.0 listenport=80
+
+# 2) Confirm Docker staging is up
+curl.exe http://127.0.0.1:18088/health
+
+# 3) Install windows-edge-http.conf into host nginx, then:
+#    nginx -t
+#    nginx -s reload
+#    (paths depend on where nginx is installed)
+
+# 4) Must print "healthy" (not 404)
+curl.exe http://127.0.0.1/health
+```
+
+Replace any **default_server** / leftover `server { listen 80; }` in the host nginx that returns 404, or this file will never win.
+
+From another machine (after **router forward TCP 80** → this PC):
+
+```bash
+curl http://wixur.ir/health
+```
+
+**Mobinnet:** public **80** is the modem. Use **443** instead: router forward **TCP 443 → 192.168.1.100**, then `https://wixur.ir`. Let's Encrypt after mobile-data `/health` works (self-signed is enough for that test).
+
+---
+
+## Test the pipeline
+
+### Before first run
+
+- [ ] Docker Desktop running
+- [ ] `act_runner.exe daemon` running
+- [ ] All Variables + Secrets set (including `CLONE_HOST`)
+- [ ] Secret env files exist under `DEPLOY_SECRETS_DIR`
+- [ ] Workflow enabled on `master` (see repo)
+
+### Option A — Manual workflow (safest first test)
+
+1. Gitea → repo → **Actions**
+2. **Registry — build, push, deploy** → **Run workflow** → branch `master`
+3. Watch jobs: **build-and-push** → **deploy** (first run ~15–30 min)
+
+### Option B — Push to master
+
+```bash
+git push origin master
+```
+
+Or merge a PR into `master` — same result.
+
+### Verify success
+
+**On Windows (PowerShell):**
+
+```powershell
+docker ps
+```
+
+Expect: `dyolink_nginx_staging`, `dyolink_backend_staging`, `dyolink_frontend_staging`, `dyolink_postgres_staging`.
+
+**From browser or another machine:**
+
+```text
+http://wixur.ir
+```
+
+**Health check:**
+
+```powershell
+curl http://wixur.ir/api/health
+```
+
+Expected: `{"status":"ok",...}`
+
+**Gitea packages:** profile/org → **Packages** — should list `dyolink-backend` and `dyolink-frontend` after first build.
+
+---
+
+## Manual deploy (without CI)
+
+Useful when debugging registry/compose without re-running the full workflow.
+
+On the Windows host, from repo `infrastructure/`:
+
+1. Create `deploy.registry.env` from [`deploy.registry.env.example`](deploy.registry.env.example)
+2. Set `REGISTRY_PREFIX`, `IMAGE_TAG`, `STAGING_HTTP_PORT`, `DEPLOY_SECRETS_DIR`
+3. `docker login host.docker.internal:3000 -u <user>`  (on Windows Docker Desktop; Linux prod will use `wixur.ir:3000`)
+4. `docker compose -f docker-compose.registry.yml --env-file deploy.registry.env pull backend frontend`
+5. `docker compose -f docker-compose.registry.yml --env-file deploy.registry.env up -d`
+
+---
+
+## Troubleshooting
+
+| Symptom | Fix |
+|---------|-----|
+| `no matching online runner with label` | Runner **offline** → start `act_runner.exe daemon`. Or wrong **runner level** → re-register with token from **Site Administration → Actions → Runners** or **repo → Settings → Actions → Runners** (not user profile). Confirm runner appears on **repo** Runners page as Online. |
+| Runner can't register on public IP | Use `http://127.0.0.1:3000` for `--instance` |
+| Variable name rejected in Gitea | No `GITEA_*` / `GITHUB_*` prefixes; use `CLONE_HOST` |
+| `docker login` connection refused on `127.0.0.1:3000` | **Docker Desktop on Windows:** set `REGISTRY_HOST=host.docker.internal:3000`, add it to insecure-registries, set Gitea `ROOT_URL=http://host.docker.internal:3000/`. Keep `CLONE_HOST=127.0.0.1:3000` for git. |
+| `docker login` / push denied, redirect to public IP | Set Gitea `ROOT_URL` to a host Docker can reach (`host.docker.internal:3000` on Windows Docker Desktop). |
+| `server gave HTTP response to HTTPS client` | Add registry host to Docker **insecure-registries**, restart Docker |
+| `Missing database.staging.env` | Check `DEPLOY_SECRETS_DIR` path and file names |
+| `docker login` denied | Token needs package permissions; check username/secret |
+| Git clone fails in workflow | Set `CLONE_HOST=127.0.0.1:3000` |
+| Port 80 bind forbidden / access permissions | Portproxy already owns 80. Bind Docker to `18088` and point portproxy **80 → 127.0.0.1:18088**. Free IIS if it holds 80. |
+| `http://wixur.ir` unreachable / empty reply | Docker Desktop: run **portproxy** (§7). `127.0.0.1:18088/health` must work on Windows first. Router must forward **80**. |
+| Port 8088 bind forbidden / access permissions | Portproxy already owns 8088. Bind Docker to `18088` and point portproxy **8088 → 127.0.0.1:18088**. |
+| Port 8088 unreachable from Mac / empty reply | Legacy URL. Prefer `http://wixur.ir`. Same 18088 backend; add portproxy 8088 only as fallback. |
+| Backend restart loop | JWT secrets still placeholder; fix `backend.staging.env` |
+| Backend DB auth error | `DATABASE_URL` password ≠ `POSTGRES_PASSWORD` |
+| `dumb-init docker-entrypoint.sh: No such file or directory` | Windows CRLF in shell scripts — fixed in Dockerfiles (rebuild images). |
+| `frontend is unhealthy` / deploy waits on frontend | Next.js `/` redirects to `/en` (3xx). Rebuild after healthcheck fix (accepts 2xx/3xx). |
+
+**Logs:**
+
+```powershell
+docker logs dyolink_backend_staging --tail 50
+docker logs dyolink_nginx_staging --tail 50
+docker logs dyolink_frontend_staging --tail 50
+```
+
+---
+
+## File reference
+
+| Path | Role |
+|------|------|
+| `.gitea/workflows/registry-build-deploy.yml` | CI: build, push, deploy |
+| `infrastructure/docker-compose.registry.yml` | Staging stack (pull-only images) |
+| `infrastructure/deploy.registry.env.example` | Manual deploy env template |
+| `infrastructure/database.staging.env.example` | Postgres secrets template |
+| `infrastructure/backend.staging.env.example` | API secrets template |
+| `infrastructure/nginx/http-only.conf` | HTTP reverse proxy **inside Docker** staging |
+| `infrastructure/nginx/windows-edge-http.conf` | Windows **host** nginx on port 80 → 18088 |
+
+---
+
+## Production (Linux + tags)
+
+| Environment | Trigger | Host |
+|-------------|---------|------|
+| Staging | Push/merge to `master` | Windows + `https://wixur.ir` |
+| Production | Git tag `v*.*.*` | Linux + `https://nudentic.ir` |
+
+Workflow: [`.gitea/workflows/prod-tag-deploy.yml`](../.gitea/workflows/prod-tag-deploy.yml). Do **not** push production images as `:latest`. Setup: [`DEPLOY.md`](DEPLOY.md).

infrastructure/backend.prod.env.example

@@ -12,7 +12,7 @@ JWT_REFRESH_SECRET=replace_with_a_different_openssl_rand_hex_32_output
 JWT_REFRESH_EXPIRES_IN=30d
 
 # Must match DOMAIN in .env — used for CORS, invite links, cookies
-FRONTEND_URL=https://wixur.ir
+FRONTEND_URL=https://nudentic.ir
 
 # Required for HTTPS — browsers reject Secure cookies over plain HTTP
 COOKIE_SECURE=true
@@ -20,3 +20,7 @@ COOKIE_SECURE=true
 # SMS (sms.ir)
 SMS_IR_API_KEY=CHANGE_ME_SMS_IR_API_KEY
 SMS_IR_TEMPLATE_ID=123456
+
+# GlitchTip (Sentry SDK). Empty = disabled. Use the dyolink-backend project DSN.
+# SENTRY_DSN=https://PUBLIC_KEY@errors.wixur.ir/1
+# SENTRY_ENVIRONMENT=production

infrastructure/backend.staging.env.example

@@ -9,12 +9,16 @@ JWT_EXPIRES_IN=15m
 JWT_REFRESH_SECRET=another_long_random_secret_different_from_JWT_SECRET
 JWT_REFRESH_EXPIRES_IN=30d
 
-# CORS, cookies, and invite links — must match how users open the app (nginx host port)
+# CORS, cookies, and invite links — must match how users open the app
-FRONTEND_URL=http://178.131.50.201:8088
+FRONTEND_URL=https://wixur.ir
 
-# HTTP staging — keep false unless you terminate TLS in front of the app
+# TLS is terminated on Windows nginx :443 — cookies must be Secure
-COOKIE_SECURE=false
+COOKIE_SECURE=true
 
 # SMS (sms.ir)
 SMS_IR_API_KEY=CHANGE_ME_SMS_IR_API_KEY
 SMS_IR_TEMPLATE_ID=123456
+
+# GlitchTip (Sentry SDK). Empty = disabled. Use the dyolink-backend project DSN.
+# SENTRY_DSN=https://PUBLIC_KEY@errors.wixur.ir/1
+# SENTRY_ENVIRONMENT=staging

infrastructure/deploy.prod.env.example

@@ -1,15 +1,27 @@
-# Copy to infrastructure/.env on the server (not committed).
+# Copy to infrastructure/.env on the Linux server (not committed).
 # docker compose -f docker-compose.prod.yml --env-file .env ...
 
-DOMAIN=wixur.ir
+DOMAIN=nudentic.ir
+
+# Gitea Container Registry (tag auto-deploy). Same packages Windows CI pushes
+# via host.docker.internal:3000 — Linux pulls via this hostname.
+# Format: <host>:<port>/<owner>  — no http://
+REGISTRY_PREFIX=wixur.ir:3000/admin
+
+# Image tag — CI sets this per release (v1.0.1). Do not use latest for Gitea prod
+# (staging already owns :latest with the wixur.ir frontend bake).
+TAG=v1.0.1
+
+# Hub-only fallback: comment out REGISTRY_PREFIX and use:
+# REGISTRY_PREFIX=dyolink
+# TAG=latest
 DOCKER_USERNAME=dyolink
-TAG=latest
 
 # Let's Encrypt — certificate issuance and renewal notices
 LETSENCRYPT_EMAIL=rameen.naghdi@gmail.com
 
-# Optional: extra hostnames on the same cert (space-separated), e.g. www.wixur.ir
+# Optional: extra hostnames on the same cert (space-separated)
-# CERTBOT_EXTRA_DOMAINS=www.wixur.ir
+# CERTBOT_EXTRA_DOMAINS=www.nudentic.ir
 
 # Optional: use Let's Encrypt staging while testing (avoids rate limits)
 # LETSENCRYPT_STAGING=1

infrastructure/deploy.registry.env.example

@@ -6,14 +6,20 @@
 # --- Registry boundary (swap when moving Gitea → Docker Hub) ---
 # Gitea:  REGISTRY_PREFIX = <host>:<port>/<owner>
 # Hub:    REGISTRY_PREFIX = docker.io/<user>   (or your username for implicit hub)
-REGISTRY_PREFIX=178.131.50.201:3000/yourgiteauser
+# Windows CI pushes via host.docker.internal:3000; browsers/Linux use wixur.ir:3000 (same Gitea).
+REGISTRY_PREFIX=wixur.ir:3000/yourgiteauser
 
 # Short git SHA from CI, or "latest" after a manual pull of :latest
 IMAGE_TAG=latest
 
-# Host port published for nginx (URL = http://<your-ip>:<this-port>)
+# Public HTTP port (router + Windows portproxy listen here) — 80 so users open http://wixur.ir
-STAGING_HTTP_PORT=8088
+STAGING_HTTP_PORT=80
+# Docker nginx bind on localhost only (must differ from 80 if portproxy owns 80)
+STAGING_LOCAL_PORT=18088
 
 # Absolute path on the server where database.staging.env and backend.staging.env live.
-# Use forward slashes on Windows. Same variable as Gitea Actions → DEPLOY_SECRETS_DIR.
+# Use forward slashes on Windows. Same path as Gitea Actions variable DEPLOY_SECRETS_DIR.
-# DEPLOY_SECRETS_DIR=D:/dyolink/secrets
+# DEPLOY_SECRETS_DIR=C:/dyolink/secrets
+#
+# Gitea Actions also needs CLONE_HOST=127.0.0.1:3000 when runner and Gitea share one Windows host.
+# See STAGING-DEPLOY.md (do not use GITEA_* variable names — Gitea rejects them).

infrastructure/docker-compose.prod.yml

@@ -1,13 +1,11 @@
-# Production stack — pull images from Docker Hub, HTTPS via Let's Encrypt (certbot).
+# Production stack — pull backend/frontend from Gitea (or Docker Hub fallback).
+# HTTPS via Let's Encrypt (certbot) on this host only (nudentic.ir).
 #
-# Server setup (minimal):
+# Gitea tag deploy: set REGISTRY_PREFIX=wixur.ir:3000/<owner> and TAG=v1.0.1 in .env
-#   1. Copy deploy.prod.env.example → .env  (DOMAIN, DOCKER_USERNAME, LETSENCRYPT_EMAIL)
+# Hub fallback: omit REGISTRY_PREFIX, set DOCKER_USERNAME=dyolink (image dyolink/dyolink-*).
-#   2. Copy secrets/*.example → ../secrets/ (database.env, backend.env) — outside git
-#   3. docker login   (private Docker Hub images)
-#   4. ./scripts/init-letsencrypt.sh   (first time only)
-#   5. docker compose -f docker-compose.prod.yml --env-file .env up -d
 #
-# Updates: docker compose pull && docker compose up -d
+# First SSL: ./scripts/init-letsencrypt.sh then up -d
+# Tag updates: CI runs scripts/prod-remote-deploy.sh (or pull + up locally)
 
 name: dyolink-prod
 
@@ -39,7 +37,7 @@ services:
       start_period: 40s
 
   backend:
-    image: ${DOCKER_USERNAME}/dyolink-backend:${TAG:-latest}
+    image: ${REGISTRY_PREFIX:-dyolink}/dyolink-backend:${TAG:-latest}
     container_name: dyolink_backend_prod
     depends_on:
       postgres:
@@ -50,6 +48,8 @@ services:
       NODE_ENV: production
       TZ: UTC
       PORT: "3000"
+      SENTRY_ENVIRONMENT: production
+      SENTRY_RELEASE: ${TAG:-latest}
     expose:
       - "3000"
     networks:
@@ -68,7 +68,7 @@ services:
       start_period: 60s
 
   frontend:
-    image: ${DOCKER_USERNAME}/dyolink-frontend:${TAG:-latest}
+    image: ${REGISTRY_PREFIX:-dyolink}/dyolink-frontend:${TAG:-latest}
     container_name: dyolink_frontend_prod
     depends_on:
       - backend
@@ -88,7 +88,8 @@ services:
         max-size: "10m"
         max-file: "3"
     healthcheck:
-      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:3000/', (r) => {if(r.statusCode!==200)process.exit(1)})"]
+      # Next.js `/` redirects to `/en` — accept 2xx/3xx.
+      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:3000/', (r) => { process.exit(r.statusCode >= 200 && r.statusCode < 400 ? 0 : 1); }).on('error', () => process.exit(1))"]
       interval: 30s
       timeout: 10s
       retries: 3

infrastructure/docker-compose.registry.yml

@@ -2,7 +2,7 @@
 # No backend/frontend source on the deployment host except this compose file + config + secrets.
 #
 # Required env (see deploy.registry.env.example):
-#   REGISTRY_PREFIX   e.g. 178.131.50.201:3000/yourgiteauser  (no protocol, no trailing slash)
+#   REGISTRY_PREFIX   e.g. host.docker.internal:3000/admin (Windows CI) or wixur.ir:3000/admin (no protocol)
 #   IMAGE_TAG         short sha or "latest" (CI sets this per deploy)
 # Optional:
 #   DEPLOY_SECRETS_DIR   absolute path on the server to database/backend *.env files (see below)
@@ -47,6 +47,8 @@ services:
       NODE_ENV: production
       TZ: UTC
       PORT: "3000"
+      SENTRY_ENVIRONMENT: staging
+      SENTRY_RELEASE: ${IMAGE_TAG:-latest}
     expose:
       - "3000"
     networks:
@@ -75,7 +77,8 @@ services:
       - dyolink_staging
     restart: unless-stopped
     healthcheck:
-      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:3000/', (r) => {if(r.statusCode!==200)process.exit(1)})"]
+      # Root redirects to /en (next-intl) — accept 2xx/3xx as healthy.
+      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:3000/', (r) => { process.exit(r.statusCode >= 200 && r.statusCode < 400 ? 0 : 1); }).on('error', () => process.exit(1))"]
       interval: 30s
       timeout: 10s
       retries: 3
@@ -85,10 +88,14 @@ services:
     image: nginx:alpine
     container_name: dyolink_nginx_staging
     depends_on:
-      - backend
+      backend:
-      - frontend
+        condition: service_healthy
+      frontend:
+        condition: service_healthy
     ports:
-      - "${STAGING_HTTP_PORT:-8088}:80"
+      # Bind a private localhost port — Windows portproxy owns public 80 (http://wixur.ir).
+      # See STAGING-DEPLOY.md §7: portproxy 0.0.0.0:80 → 127.0.0.1:18088
+      - "127.0.0.1:${STAGING_LOCAL_PORT:-18088}:80"
     volumes:
       - ./nginx/http-only.conf:/etc/nginx/conf.d/default.conf:ro
       - ./logs/nginx-staging:/var/log/nginx

infrastructure/docker-compose.staging.yml

@@ -43,6 +43,7 @@ services:
       NODE_ENV: production
       TZ: UTC
       PORT: "3000"
+      SENTRY_ENVIRONMENT: staging
     expose:
       - "3000"
     networks:
@@ -60,9 +61,11 @@ services:
       context: ../frontend
       dockerfile: Dockerfile
       args:
-        NEXT_PUBLIC_API_URL: ${STAGING_NEXT_PUBLIC_API_URL:-http://178.131.50.201:8088/api}
+        NEXT_PUBLIC_API_URL: ${STAGING_NEXT_PUBLIC_API_URL:-http://wixur.ir/api}
-        NEXT_PUBLIC_APP_URL: ${STAGING_NEXT_PUBLIC_APP_URL:-http://178.131.50.201:8088}
+        NEXT_PUBLIC_APP_URL: ${STAGING_NEXT_PUBLIC_APP_URL:-http://wixur.ir}
         NEXT_PUBLIC_APP_NAME: ${STAGING_NEXT_PUBLIC_APP_NAME:-Dyolink}
+        NEXT_PUBLIC_SENTRY_DSN: ${NEXT_PUBLIC_SENTRY_DSN:-}
+        NEXT_PUBLIC_SENTRY_ENVIRONMENT: staging
     container_name: dyolink_frontend_staging
     depends_on:
       - backend
@@ -77,7 +80,8 @@ services:
       - dyolink_staging
     restart: unless-stopped
     healthcheck:
-      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:3000/', (r) => {if(r.statusCode!==200)process.exit(1)})"]
+      # Root redirects to /en (next-intl) — accept 2xx/3xx as healthy.
+      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:3000/', (r) => { process.exit(r.statusCode >= 200 && r.statusCode < 400 ? 0 : 1); }).on('error', () => process.exit(1))"]
       interval: 30s
       timeout: 10s
       retries: 3
@@ -87,10 +91,12 @@ services:
     image: nginx:alpine
     container_name: dyolink_nginx_staging
     depends_on:
-      - backend
+      backend:
-      - frontend
+        condition: service_healthy
+      frontend:
+        condition: service_healthy
     ports:
-      - "${STAGING_HTTP_PORT:-8088}:80"
+      - "127.0.0.1:${STAGING_LOCAL_PORT:-18088}:80"
     volumes:
       - ./nginx/http-only.conf:/etc/nginx/conf.d/default.conf:ro
       - ./logs/nginx-staging:/var/log/nginx

infrastructure/env.staging.example

@@ -1,13 +1,13 @@
 # Copy to .env.staging next to docker-compose.staging.yml (optional).
 # Used only for compose variable substitution (build args, host port).
 
-STAGING_HTTP_PORT=8088
+STAGING_HTTP_PORT=80
 
 # Public URLs baked into the frontend image at build time — must match how users open the app.
-STAGING_NEXT_PUBLIC_API_URL=http://178.131.50.201:8088/api
+STAGING_NEXT_PUBLIC_API_URL=http://wixur.ir/api
-STAGING_NEXT_PUBLIC_APP_URL=http://178.131.50.201:8088
+STAGING_NEXT_PUBLIC_APP_URL=http://wixur.ir
 STAGING_NEXT_PUBLIC_APP_NAME=Dyolink
 
-# Change the IP/port if your server address differs.
+# Must match how users open staging (http://wixur.ir).
 
 # Registry / pull-only deploy (see deploy.registry.env.example + docker-compose.registry.yml).

infrastructure/nginx/http-only.conf

@@ -1,15 +1,10 @@
 # HTTP only — local dev and IP-based staging (no TLS).
 # Use with: docker compose and map host port e.g. 8080:80 or 8088:80
+#
+# Dynamic proxy_pass via Docker DNS (127.0.0.11) so nginx starts even if
+# backend/frontend containers are not up yet (static upstream blocks fail at boot).
 
-upstream dyolink_backend {
+resolver 127.0.0.11 valid=10s ipv6=off;
-    server backend:3000;
-    keepalive 32;
-}
-
-upstream dyolink_frontend {
-    server frontend:3000;
-    keepalive 32;
-}
 
 server {
     listen 80;
@@ -19,7 +14,8 @@ server {
     client_max_body_size 50M;
 
     location / {
-        proxy_pass http://dyolink_frontend;
+        set $frontend_upstream http://frontend:3000;
+        proxy_pass $frontend_upstream;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection 'upgrade';
@@ -33,7 +29,8 @@ server {
     }
 
     location /api {
-        proxy_pass http://dyolink_backend;
+        set $backend_upstream http://backend:3000;
+        proxy_pass $backend_upstream;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection 'upgrade';

infrastructure/nginx/windows-edge-http.conf

@@ -0,0 +1,78 @@
+# Windows host nginx.conf — paste over
+#   C:\tools\nginx-1.29.5\conf\nginx.conf
+#
+# :80  — LAN / 127.0.0.1 only (Mobinnet keeps public :80 for the modem)
+# :443 — public https://wixur.ir  (router must forward 443 → this PC)
+#
+# Put Let's Encrypt PEMs in conf\ssl\ (win-acme --pemfilesname wixur):
+#   ssl\wixur-chain.pem
+#   ssl\wixur-key.pem
+#
+# After save: nginx -t   then restart nginx
+#   curl.exe https://wixur.ir/health   →  healthy
+# (curl to 127.0.0.1:443 fails name-check; cert is for wixur.ir)
+
+#user  nobody;
+worker_processes  1;
+
+events {
+    worker_connections  1024;
+}
+
+
+http {
+    include       mime.types;
+    default_type  application/octet-stream;
+
+    sendfile        on;
+    keepalive_timeout  65;
+    client_max_body_size 50M;
+
+    # Shared proxy to Docker staging
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        ''      close;
+    }
+
+    server {
+        listen       80 default_server;
+        listen       [::]:80 default_server;
+        server_name  wixur.ir www.wixur.ir localhost 127.0.0.1;
+
+        location / {
+            proxy_pass http://127.0.0.1:18088;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_read_timeout 300;
+            proxy_connect_timeout 300;
+        }
+    }
+
+    server {
+        listen       443 ssl;
+        listen       [::]:443 ssl;
+        server_name  wixur.ir www.wixur.ir localhost 127.0.0.1;
+
+        ssl_certificate      ssl/wixur-chain.pem;
+        ssl_certificate_key  ssl/wixur-key.pem;
+        ssl_protocols        TLSv1.2 TLSv1.3;
+
+        location / {
+            proxy_pass http://127.0.0.1:18088;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_read_timeout 300;
+            proxy_connect_timeout 300;
+        }
+    }
+}

infrastructure/nginx/windows-ssl-letsencrypt.snippet.conf

@@ -0,0 +1,4 @@
+# After win-acme writes Let's Encrypt PEMs into conf/ssl/:
+#   ssl_certificate      ssl/wixur-chain.pem;
+#   ssl_certificate_key  ssl/wixur-key.pem;
+# (exact filenames: dir C:\tools\nginx-1.29.5\conf\ssl )

infrastructure/scripts/prod-remote-deploy.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# Run on the Linux production host (CI SSHs here after pushing :v* images).
+# Usage: ./prod-remote-deploy.sh v1.0.1
+set -euo pipefail
+
+TAG="${1:?usage: prod-remote-deploy.sh v1.0.1}"
+INFRA="${PROD_INFRA_DIR:-/opt/dyolink/infrastructure}"
+cd "$INFRA"
+
+if [ ! -f .env ]; then
+  echo "Missing $INFRA/.env — copy deploy.prod.env.example and set DOMAIN=nudentic.ir REGISTRY_PREFIX=wixur.ir:3000/<owner>"
+  exit 1
+fi
+
+if ! grep -q '^REGISTRY_PREFIX=.\+' .env; then
+  echo "Set REGISTRY_PREFIX in .env (Gitea registry, e.g. wixur.ir:3000/admin). Do not use Docker Hub :latest for tag deploys."
+  exit 1
+fi
+
+export TAG
+
+# Windows Gitea often RSTs concurrent or long pulls (connection reset by peer).
+# Pull one image at a time with backoff so a flake does not fail the whole tag.
+pull_one() {
+  local service="$1"
+  local attempt=1
+  local max=5
+  local delay=8
+  while [ "$attempt" -le "$max" ]; do
+    echo "Pulling $service :$TAG (attempt $attempt/$max)"
+    if docker compose -f docker-compose.prod.yml --env-file .env pull "$service"; then
+      return 0
+    fi
+    if [ "$attempt" -eq "$max" ]; then
+      echo "Failed to pull $service after $max attempts"
+      return 1
+    fi
+    echo "Pull of $service failed; retrying in ${delay}s..."
+    sleep "$delay"
+    delay=$((delay * 2))
+    attempt=$((attempt + 1))
+  done
+}
+
+echo "Pulling backend/frontend :$TAG from Gitea (REGISTRY_PREFIX in .env)"
+pull_one backend
+pull_one frontend
+docker compose -f docker-compose.prod.yml --env-file .env up -d
+echo "=== Status ==="
+docker compose -f docker-compose.prod.yml --env-file .env ps
+echo "Health: https://nudentic.ir/api/health"

infrastructure/scripts/windows-renew-wixur-cert.cmd

@@ -0,0 +1,11 @@
+@echo off
+REM Run as Administrator. Stops nginx so win-acme can bind 443 (TLS-ALPN),
+REM renews, then starts nginx again. Point the win-acme scheduled task here
+REM instead of calling wacs.exe directly.
+cd /d C:\tools\nginx-1.29.5
+taskkill /F /IM nginx.exe >nul 2>&1
+timeout /t 2 /nobreak >nul
+cd /d C:\tools\win-acme
+wacs.exe --renew --closeonfinish
+cd /d C:\tools\nginx-1.29.5
+start "" nginx.exe