auto deploy on production server now finalized ready for smoke test.

Mobinnet holds public port 80, so staging is served on 443. Examples and the host nginx template now match FRONTEND_URL=https://wixur.ir.

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitattributes

@@ -0,0 +1,2 @@
+# Shell scripts must use LF — CRLF breaks Alpine entrypoints ("No such file or directory").
+*.sh text eol=lf

.gitea/workflows/prod-tag-deploy.yml

@@ -0,0 +1,217 @@
+# Production: build images for https://nudentic.ir, push :v* to Gitea (not :latest),
+# SCP compose to Linux, docker login wixur.ir:3000, compose pull + up.
+#
+# Triggers: git tag v1.0.1 (and v*.*.*), or Actions → this workflow → Run (input tag).
+# Staging stays on master: .gitea/workflows/registry-build-deploy.yml
+#
+# Do NOT push :latest — staging already uses :latest with the wixur.ir frontend bake.
+#
+# Variables:
+#   REGISTRY_HOST          Windows Docker push host, e.g. host.docker.internal:3000
+#   REGISTRY_OWNER         Gitea user/org for packages
+#   CLONE_HOST             git clone, e.g. 127.0.0.1:3000
+#   PROD_PUBLIC_BASE_URL   https://nudentic.ir  (no trailing slash)
+#   PROD_REGISTRY_HOST     Linux pull host, e.g. wixur.ir:3000  (HTTP; insecure-registries on the VPS)
+#   PROD_INFRA_DIR         /opt/dyolink/infrastructure
+#
+# Secrets (in addition to REGISTRY_USERNAME / REGISTRY_PASSWORD):
+#   PROD_SSH_HOST          Linux public IP or hostname
+#   PROD_SSH_USER          e.g. dyolink
+#   PROD_SSH_KEY           OpenSSH private key (full PEM)
+#   PROD_SSH_PORT          optional, default 22
+#
+# One-time on Linux: insecure-registries ["wixur.ir:3000"], .env REGISTRY_PREFIX + DOMAIN=nudentic.ir
+# See infrastructure/DEPLOY.md
+
+name: Production — tag build, push, deploy
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag to build and deploy (e.g. v1.0.1)'
+        required: true
+
+defaults:
+  run:
+    shell: powershell
+
+jobs:
+  build-and-push:
+    runs-on: windows
+    outputs:
+      image_tag: ${{ steps.meta.outputs.image_tag }}
+    steps:
+      - name: Checkout (this Gitea)
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $cloneHost = '${{ vars.CLONE_HOST }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($cloneHost)) {
+            $Server = "${{ github.server_url }}".TrimEnd('/')
+          } elseif ($cloneHost -match '^https?://') {
+            $Server = $cloneHost.TrimEnd('/')
+          } else {
+            $Server = 'http://' + $cloneHost
+          }
+          $Repo = "${{ github.repository }}"
+          $dispatchTag = '${{ github.event.inputs.tag }}'.Trim()
+          if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) {
+            $Branch = $dispatchTag
+          } else {
+            $Branch = "${{ github.ref_name }}"
+          }
+          $Token = "${{ github.token }}"
+          $Actor = "${{ github.actor }}"
+          $hp = $Server -replace '^https?://', ''
+          if ($Server.StartsWith('https')) {
+            $cloneUrl = 'https://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
+          } else {
+            $cloneUrl = 'http://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
+          }
+          $env:GIT_TERMINAL_PROMPT = '0'
+          git clone --depth 1 --branch $Branch $cloneUrl .
+
+      - name: Resolve image tag (v*.*.* only)
+        id: meta
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $dispatchTag = '${{ github.event.inputs.tag }}'.Trim()
+          if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) {
+            $tag = $dispatchTag
+          } else {
+            $tag = "${{ github.ref_name }}"
+          }
+          if ($tag -notmatch '^v\d+\.\d+\.\d+') {
+            Write-Host "Production images must be tagged vMAJOR.MINOR.PATCH (got: $tag)"
+            exit 1
+          }
+          $utf8 = New-Object System.Text.UTF8Encoding $false
+          [System.IO.File]::AppendAllText($env:GITHUB_OUTPUT, "image_tag=$tag`n", $utf8)
+          $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}"
+          [System.IO.File]::AppendAllText($env:GITHUB_ENV, "REGISTRY_PREFIX=$prefix`n", $utf8)
+          Write-Host "image_tag=$tag REGISTRY_PREFIX=$prefix"
+
+      - name: Log in to container registry
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $pass = @'
+          ${{ secrets.REGISTRY_PASSWORD }}
+          '@
+          $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+
+      - name: Build and push backend (tag only, not :latest)
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $tag = "${{ steps.meta.outputs.image_tag }}"
+          docker build -t "$env:REGISTRY_PREFIX/dyolink-backend:$tag" ./backend
+          docker push "$env:REGISTRY_PREFIX/dyolink-backend:$tag"
+
+      - name: Build and push frontend (nudentic.ir baked in)
+        env:
+          PROD_PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $tag = "${{ steps.meta.outputs.image_tag }}"
+          $base = $env:PROD_PUBLIC_BASE_URL.Trim()
+          if ([string]::IsNullOrWhiteSpace($base)) { $base = 'https://nudentic.ir' }
+          $base = $base.TrimEnd('/')
+          docker build `
+            --build-arg "NEXT_PUBLIC_API_URL=$base/api" `
+            --build-arg "NEXT_PUBLIC_APP_URL=$base" `
+            --build-arg "NEXT_PUBLIC_APP_NAME=Dyolink" `
+            -t "$env:REGISTRY_PREFIX/dyolink-frontend:$tag" `
+            ./frontend
+          docker push "$env:REGISTRY_PREFIX/dyolink-frontend:$tag"
+
+  deploy:
+    needs: build-and-push
+    runs-on: windows
+    steps:
+      - name: Checkout (tagged tree for compose file)
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $cloneHost = '${{ vars.CLONE_HOST }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($cloneHost)) {
+            $Server = "${{ github.server_url }}".TrimEnd('/')
+          } elseif ($cloneHost -match '^https?://') {
+            $Server = $cloneHost.TrimEnd('/')
+          } else {
+            $Server = 'http://' + $cloneHost
+          }
+          $Repo = "${{ github.repository }}"
+          $dispatchTag = '${{ github.event.inputs.tag }}'.Trim()
+          if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) {
+            $Branch = $dispatchTag
+          } else {
+            $Branch = "${{ github.ref_name }}"
+          }
+          $Token = "${{ github.token }}"
+          $Actor = "${{ github.actor }}"
+          $hp = $Server -replace '^https?://', ''
+          if ($Server.StartsWith('https')) {
+            $cloneUrl = 'https://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
+          } else {
+            $cloneUrl = 'http://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
+          }
+          $env:GIT_TERMINAL_PROMPT = '0'
+          git clone --depth 1 --branch $Branch $cloneUrl .
+
+      - name: Write SSH key
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $raw = @'
+          ${{ secrets.PROD_SSH_KEY }}
+          '@
+          $key = $raw.Trim()
+          if ($key -notmatch 'BEGIN') {
+            Write-Host "Set secret PROD_SSH_KEY to an OpenSSH private key"
+            exit 1
+          }
+          $keyPath = Join-Path $env:RUNNER_TEMP 'prod_ssh'
+          $normalized = $key.Replace("`r`n", "`n").TrimEnd() + "`n"
+          [System.IO.File]::WriteAllText($keyPath, $normalized)
+          icacls $keyPath /inheritance:r | Out-Null
+          icacls $keyPath /grant:r "$($env:USERNAME):(R)" | Out-Null
+          [System.IO.File]::AppendAllText($env:GITHUB_ENV, "PROD_SSH_KEY_PATH=$keyPath`n")
+
+      - name: Copy compose + deploy script to Linux
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $hostName = '${{ secrets.PROD_SSH_HOST }}'.Trim()
+          $user = '${{ secrets.PROD_SSH_USER }}'.Trim()
+          $port = '${{ secrets.PROD_SSH_PORT }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($port)) { $port = '22' }
+          $infra = '${{ vars.PROD_INFRA_DIR }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($infra)) { $infra = '/opt/dyolink/infrastructure' }
+          $ssh = @('-i', $env:PROD_SSH_KEY_PATH, '-o', 'StrictHostKeyChecking=accept-new')
+          ssh.exe @ssh -p $port "${user}@${hostName}" "mkdir -p $infra/scripts"
+          scp.exe @ssh -P $port `
+            infrastructure/docker-compose.prod.yml `
+            "${user}@${hostName}:${infra}/docker-compose.prod.yml"
+          scp.exe @ssh -P $port `
+            infrastructure/scripts/prod-remote-deploy.sh `
+            "${user}@${hostName}:${infra}/scripts/prod-remote-deploy.sh"
+          ssh.exe @ssh -p $port "${user}@${hostName}" "chmod +x $infra/scripts/prod-remote-deploy.sh"
+
+      - name: Login on Linux and deploy tag
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $hostName = '${{ secrets.PROD_SSH_HOST }}'.Trim()
+          $user = '${{ secrets.PROD_SSH_USER }}'.Trim()
+          $port = '${{ secrets.PROD_SSH_PORT }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($port)) { $port = '22' }
+          $infra = '${{ vars.PROD_INFRA_DIR }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($infra)) { $infra = '/opt/dyolink/infrastructure' }
+          $regHost = '${{ vars.PROD_REGISTRY_HOST }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($regHost)) { $regHost = 'wixur.ir:3000' }
+          $tag = "${{ needs.build-and-push.outputs.image_tag }}"
+          $pass = @'
+          ${{ secrets.REGISTRY_PASSWORD }}
+          '@
+          $regUser = '${{ secrets.REGISTRY_USERNAME }}'
+          $ssh = @('-i', $env:PROD_SSH_KEY_PATH, '-o', 'StrictHostKeyChecking=accept-new')
+          $remote = "docker login $regHost -u $regUser --password-stdin && PROD_INFRA_DIR=$infra $infra/scripts/prod-remote-deploy.sh $tag"
+          $pass.Trim() | ssh.exe @ssh -p $port "${user}@${hostName}" $remote

.gitea/workflows/registry-build-deploy.yml

@@ -1,30 +1,34 @@
-# Build backend/frontend images, push to Gitea Container Registry, deploy with pull-only compose.
+# Staging: build backend/frontend images, push to Gitea Container Registry, deploy on self-hosted runner.
 #
-# Repository Variables (Settings → Actions → Variables) — non-secret:
+# Triggers: push to master/main, or manual workflow_dispatch.
-#   REGISTRY_HOST        e.g. 178.131.50.201:3000   (no http/https)
+# Production (nudentic.ir / git tags): .gitea/workflows/prod-tag-deploy.yml — this file is Windows staging only.
-#   REGISTRY_OWNER       Gitea user or org that owns the packages (same as image namespace)
+#
-#   PUBLIC_BASE_URL      URL users open in browser, e.g. http://178.131.50.201:8088  (no trailing slash)
+# Repository Variables (Settings → Actions → Variables):
+#   REGISTRY_HOST        Docker registry host:port (no http/https). Windows Docker Desktop → host.docker.internal:3000
+#   REGISTRY_OWNER       Gitea user or org that owns the packages
+#   PUBLIC_BASE_URL      URL users open in the browser, e.g. http://wixur.ir  (no trailing slash, no :8088)
+#   DEPLOY_SECRETS_DIR   absolute path on runner, e.g. C:/dyolink/secrets
+#
+# Optional:
+#   STAGING_HTTP_PORT    public HTTP port (default 80) — Windows portproxy listens here → 18088
+#   STAGING_LOCAL_PORT   Docker bind on 127.0.0.1 (default 18088) — must not equal the public port if portproxy owns it
+#   CLONE_HOST           git clone host when runner = Gitea host → 127.0.0.1:3000
+#
+# Same Windows PC runs Gitea + runner + deploy:
+#   CLONE_HOST           → 127.0.0.1:3000  (git runs on Windows host)
+#   REGISTRY_HOST        → host.docker.internal:3000  (docker commands run inside Docker Desktop VM)
+#   Gitea app.ini ROOT_URL → http://host.docker.internal:3000/  (Docker registry auth; browsers use http://wixur.ir:3000)
+#   PUBLIC_BASE_URL      → http://wixur.ir  (staging app; Gitea stays on :3000)
+#
+# Add host.docker.internal:3000 (and wixur.ir:3000 if you pull by public hostname) to Docker Desktop insecure-registries.
 #
 # Repository Secrets (Settings → Actions → Secrets):
 #   REGISTRY_USERNAME    Gitea username for docker login
 #   REGISTRY_PASSWORD    Gitea access token (packages:read/write) or account password
 #
-# HTTP registry (typical self-hosted Gitea): Docker defaults to HTTPS. If login/push fails with
+# Docker on runner: insecure-registries e.g. ["host.docker.internal:3000","wixur.ir:3000"]
-#   "server gave HTTP response to HTTPS client", add REGISTRY_HOST (e.g. 192.168.1.100:3000) to the
-#   Docker daemon "insecure-registries" on the RUNNER machine, then restart Docker (Docker Desktop
-#   → Settings → Docker Engine → JSON → "insecure-registries": ["host:port"]).
 #
-# Optional:
+# Runner: self-hosted with Docker + git. Default shell is powershell (Windows act_runner).
-#   STAGING_HTTP_PORT       host port for nginx (default 8088)
-#
-# Required for deploy job (absolute path on the runner host):
-#   DEPLOY_SECRETS_DIR      folder containing database.staging.env + backend.staging.env
-#
-# Runner: self-hosted with Docker. Default shell is powershell (Windows act_runner often has no WSL bash).
-# For a Linux runner, change defaults.run.shell to bash and restore bash syntax if needed.
-#
-# We do NOT use gitea.com/actions/checkout — many restricted networks cannot reach gitea.com.
-# Checkout is a plain git clone from the same Gitea host.
 
 name: Registry — build, push, deploy
 
@@ -38,189 +42,152 @@ defaults:
     shell: powershell
 
 jobs:
-  temp-success:
+  build-and-push:
-    runs-on: self-hosted
+    runs-on: windows
+    outputs:
+      image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
-      - name: Temporary placeholder (always success)
+      - name: Checkout (clone from this Gitea — no gitea.com)
         run: |
           $ErrorActionPreference = 'Stop'
-          Write-Host "Temporary workflow is active."
+          $cloneHost = '${{ vars.CLONE_HOST }}'.Trim()
-          Write-Host "Trigger: ${{ github.event_name }}"
+          if ([string]::IsNullOrWhiteSpace($cloneHost)) {
-          Write-Host "Branch:  ${{ github.ref_name }}"
+            $Server = "${{ github.server_url }}".TrimEnd('/')
-          Write-Host "Commit:  ${{ github.sha }}"
+          } elseif ($cloneHost -match '^https?://') {
-          Write-Host "Production build/push/deploy steps are intentionally commented."
+            $Server = $cloneHost.TrimEnd('/')
-          exit 0
+          } else {
+            $Server = 'http://' + $cloneHost
+          }
+          $Repo = "${{ github.repository }}"
+          $Branch = "${{ github.ref_name }}"
+          $Token = "${{ github.token }}"
+          $Actor = "${{ github.actor }}"
+          $hp = $Server -replace '^https?://', ''
+          if ($Server.StartsWith('https')) {
+            $cloneUrl = 'https://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
+          } else {
+            $cloneUrl = 'http://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
+          }
+          $env:GIT_TERMINAL_PROMPT = '0'
+          git clone --depth 1 --branch $Branch $cloneUrl .
 
-  # ---------------------------------------------------------------------------
+      - name: Image tag and registry prefix
-  # Production pipeline is temporarily disabled.
+        id: meta
-  # Uncomment these jobs after split-DNS / registry reachability is fixed.
+        run: |
-  # ---------------------------------------------------------------------------
+          $ErrorActionPreference = 'Stop'
-  #
+          $short = (git rev-parse --short HEAD).Trim()
-  # build-and-push:
+          $utf8 = New-Object System.Text.UTF8Encoding $false
-  #   runs-on: self-hosted
+          [System.IO.File]::AppendAllText($env:GITHUB_OUTPUT, "image_tag=$short`n", $utf8)
-  #   outputs:
+          $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}"
-  #     image_tag: ${{ steps.meta.outputs.image_tag }}
+          [System.IO.File]::AppendAllText($env:GITHUB_ENV, "REGISTRY_PREFIX=$prefix`n", $utf8)
-  #   steps:
-  #     - name: Checkout (clone from this Gitea — no gitea.com)
-  #     - name: Image tag and registry prefix
-  #     - name: Log in to container registry
-  #     - name: Build and push backend
-  #     - name: Build and push frontend
-  #
-  # deploy:
-  #   needs: build-and-push
-  #   runs-on: self-hosted
-  #   steps:
-  #     - name: Checkout (shallow clone from this Gitea — no gitea.com)
-  #     - name: Write deploy.registry.env and validate secrets path
-  #     - name: Log in to container registry (for pull)
-  #     - name: Pull and start stack
 
+      - name: Log in to container registry
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $pass = @'
+          ${{ secrets.REGISTRY_PASSWORD }}
+          '@
+          $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
 
+      - name: Build and push backend
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $tag = "${{ steps.meta.outputs.image_tag }}"
+          docker build `
+            -t "$env:REGISTRY_PREFIX/dyolink-backend:$tag" `
+            -t "$env:REGISTRY_PREFIX/dyolink-backend:latest" `
+            ./backend
+          docker push "$env:REGISTRY_PREFIX/dyolink-backend:$tag"
+          docker push "$env:REGISTRY_PREFIX/dyolink-backend:latest"
 
-  ####SAMPLE
+      - name: Build and push frontend
-  # name: Registry — build, push, deploy
+        env:
+          PUBLIC_BASE_URL: ${{ vars.PUBLIC_BASE_URL }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $tag = "${{ steps.meta.outputs.image_tag }}"
+          $base = $env:PUBLIC_BASE_URL
+          docker build `
+            --build-arg "NEXT_PUBLIC_API_URL=$base/api" `
+            --build-arg "NEXT_PUBLIC_APP_URL=$base" `
+            --build-arg "NEXT_PUBLIC_APP_NAME=Dyolink" `
+            -t "$env:REGISTRY_PREFIX/dyolink-frontend:$tag" `
+            -t "$env:REGISTRY_PREFIX/dyolink-frontend:latest" `
+            ./frontend
+          docker push "$env:REGISTRY_PREFIX/dyolink-frontend:$tag"
+          docker push "$env:REGISTRY_PREFIX/dyolink-frontend:latest"
 
-  # on:
+  deploy:
-  #   push:
+    needs: build-and-push
-  #     branches: [main, master]
+    runs-on: windows
-  #   workflow_dispatch:
+    steps:
+      - name: Checkout (shallow clone from this Gitea — no gitea.com)
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $cloneHost = '${{ vars.CLONE_HOST }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($cloneHost)) {
+            $Server = "${{ github.server_url }}".TrimEnd('/')
+          } elseif ($cloneHost -match '^https?://') {
+            $Server = $cloneHost.TrimEnd('/')
+          } else {
+            $Server = 'http://' + $cloneHost
+          }
+          $Repo = "${{ github.repository }}"
+          $Branch = "${{ github.ref_name }}"
+          $Token = "${{ github.token }}"
+          $Actor = "${{ github.actor }}"
+          $hp = $Server -replace '^https?://', ''
+          if ($Server.StartsWith('https')) {
+            $cloneUrl = 'https://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
+          } else {
+            $cloneUrl = 'http://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
+          }
+          $env:GIT_TERMINAL_PROMPT = '0'
+          git clone --depth 1 --branch $Branch $cloneUrl .
 
-  # defaults:
+      - name: Write deploy.registry.env and validate secrets path
-  #   run:
+        run: |
-  #     shell: powershell
+          $ErrorActionPreference = 'Stop'
+          $SD = '${{ vars.DEPLOY_SECRETS_DIR }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($SD)) {
+            Write-Host "Set repository variable DEPLOY_SECRETS_DIR to the absolute path on this runner"
+            Write-Host "where database.staging.env and backend.staging.env live (not in git)."
+            exit 1
+          }
+          if (-not (Test-Path (Join-Path $SD "database.staging.env"))) {
+            Write-Host "Missing $(Join-Path $SD 'database.staging.env')"
+            exit 1
+          }
+          if (-not (Test-Path (Join-Path $SD "backend.staging.env"))) {
+            Write-Host "Missing $(Join-Path $SD 'backend.staging.env')"
+            exit 1
+          }
+          $stagingPort = '${{ vars.STAGING_HTTP_PORT }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($stagingPort)) { $stagingPort = '80' }
+          $localPort = '${{ vars.STAGING_LOCAL_PORT }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($localPort)) { $localPort = '18088' }
+          $imageTag = "${{ needs.build-and-push.outputs.image_tag }}"
+          $lines = @(
+            "REGISTRY_PREFIX=${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}",
+            "IMAGE_TAG=$imageTag",
+            "STAGING_HTTP_PORT=$stagingPort",
+            "STAGING_LOCAL_PORT=$localPort",
+            "DEPLOY_SECRETS_DIR=$SD"
+          )
+          Set-Location infrastructure
+          $lines | Set-Content -Path deploy.registry.env -Encoding utf8
 
-  # jobs:
+      - name: Log in to container registry (for pull)
-  #   build-and-push:
+        run: |
-  #     runs-on: self-hosted
+          $ErrorActionPreference = 'Stop'
-  #     outputs:
+          $pass = @'
-  #       image_tag: ${{ steps.meta.outputs.image_tag }}
+          ${{ secrets.REGISTRY_PASSWORD }}
-  #     steps:
+          '@
-  #       - name: Checkout (clone from this Gitea — no gitea.com)
+          $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-  #         run: |
-  #           $ErrorActionPreference = 'Stop'
-  #           $Server = "${{ github.server_url }}".TrimEnd('/')
-  #           $Repo = "${{ github.repository }}"
-  #           $Branch = "${{ github.ref_name }}"
-  #           $Token = "${{ github.token }}"
-  #           $Actor = "${{ github.actor }}"
-  #           $hp = $Server -replace '^https?://', ''
-  #           if ($Server.StartsWith('https')) {
-  #             $cloneUrl = 'https://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
-  #           } else {
-  #             $cloneUrl = 'http://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
-  #           }
-  #           $env:GIT_TERMINAL_PROMPT = '0'
-  #           git clone --depth 1 --branch $Branch $cloneUrl .
-
-  #       - name: Image tag and registry prefix
-  #         id: meta
-  #         run: |
-  #           $ErrorActionPreference = 'Stop'
-  #           $short = (git rev-parse --short HEAD).Trim()
-  #           $utf8 = New-Object System.Text.UTF8Encoding $false
-  #           [System.IO.File]::AppendAllText($env:GITHUB_OUTPUT, "image_tag=$short`n", $utf8)
-  #           $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}"
-  #           [System.IO.File]::AppendAllText($env:GITHUB_ENV, "REGISTRY_PREFIX=$prefix`n", $utf8)
-
-  #       - name: Log in to container registry
-  #         run: |
-  #           $ErrorActionPreference = 'Stop'
-  #           $pass = @'
-  #           ${{ secrets.REGISTRY_PASSWORD }}
-  #           '@
-  #           $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-
-  #       - name: Build and push backend
-  #         run: |
-  #           $ErrorActionPreference = 'Stop'
-  #           $tag = "${{ steps.meta.outputs.image_tag }}"
-  #           docker build `
-  #             -t "$env:REGISTRY_PREFIX/dyolink-backend:$tag" `
-  #             -t "$env:REGISTRY_PREFIX/dyolink-backend:latest" `
-  #             ./backend
-  #           docker push "$env:REGISTRY_PREFIX/dyolink-backend:$tag"
-  #           docker push "$env:REGISTRY_PREFIX/dyolink-backend:latest"
-
-  #       - name: Build and push frontend
-  #         env:
-  #           PUBLIC_BASE_URL: ${{ vars.PUBLIC_BASE_URL }}
-  #         run: |
-  #           $ErrorActionPreference = 'Stop'
-  #           $tag = "${{ steps.meta.outputs.image_tag }}"
-  #           $base = $env:PUBLIC_BASE_URL
-  #           docker build `
-  #             --build-arg "NEXT_PUBLIC_API_URL=$base/api" `
-  #             --build-arg "NEXT_PUBLIC_APP_URL=$base" `
-  #             --build-arg "NEXT_PUBLIC_APP_NAME=Dyolink" `
-  #             -t "$env:REGISTRY_PREFIX/dyolink-frontend:$tag" `
-  #             -t "$env:REGISTRY_PREFIX/dyolink-frontend:latest" `
-  #             ./frontend
-  #           docker push "$env:REGISTRY_PREFIX/dyolink-frontend:$tag"
-  #           docker push "$env:REGISTRY_PREFIX/dyolink-frontend:latest"
-
-  #   deploy:
-  #     needs: build-and-push
-  #     runs-on: self-hosted
-  #     steps:
-  #       - name: Checkout (shallow clone from this Gitea — no gitea.com)
-  #         run: |
-  #           $ErrorActionPreference = 'Stop'
-  #           $Server = "${{ github.server_url }}".TrimEnd('/')
-  #           $Repo = "${{ github.repository }}"
-  #           $Branch = "${{ github.ref_name }}"
-  #           $Token = "${{ github.token }}"
-  #           $Actor = "${{ github.actor }}"
-  #           $hp = $Server -replace '^https?://', ''
-  #           if ($Server.StartsWith('https')) {
-  #             $cloneUrl = 'https://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
-  #           } else {
-  #             $cloneUrl = 'http://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
-  #           }
-  #           $env:GIT_TERMINAL_PROMPT = '0'
-  #           git clone --depth 1 --branch $Branch $cloneUrl .
-
-  #       - name: Write deploy.registry.env and validate secrets path
-  #         run: |
-  #           $ErrorActionPreference = 'Stop'
-  #           $SD = '${{ vars.DEPLOY_SECRETS_DIR }}'.Trim()
-  #           if ([string]::IsNullOrWhiteSpace($SD)) {
-  #             Write-Host "Set repository variable DEPLOY_SECRETS_DIR to the absolute path on this runner"
-  #             Write-Host "where database.staging.env and backend.staging.env live (not in git)."
-  #             exit 1
-  #           }
-  #           if (-not (Test-Path (Join-Path $SD "database.staging.env"))) {
-  #             Write-Host "Missing $(Join-Path $SD 'database.staging.env')"
-  #             exit 1
-  #           }
-  #           if (-not (Test-Path (Join-Path $SD "backend.staging.env"))) {
-  #             Write-Host "Missing $(Join-Path $SD 'backend.staging.env')"
-  #             exit 1
-  #           }
-  #           $stagingPort = '${{ vars.STAGING_HTTP_PORT }}'.Trim()
-  #           if ([string]::IsNullOrWhiteSpace($stagingPort)) { $stagingPort = '8088' }
-  #           $imageTag = "${{ needs.build-and-push.outputs.image_tag }}"
-  #           $lines = @(
-  #             "REGISTRY_PREFIX=${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}",
-  #             "IMAGE_TAG=$imageTag",
-  #             "STAGING_HTTP_PORT=$stagingPort",
-  #             "DEPLOY_SECRETS_DIR=$SD"
-  #           )
-  #           Set-Location infrastructure
-  #           $lines | Set-Content -Path deploy.registry.env -Encoding utf8
-
-  #       - name: Log in to container registry (for pull)
-  #         run: |
-  #           $ErrorActionPreference = 'Stop'
-  #           $pass = @'
-  #           ${{ secrets.REGISTRY_PASSWORD }}
-  #           '@
-  #           $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-
-  #       - name: Pull and start stack
-  #         run: |
-  #           $ErrorActionPreference = 'Stop'
-  #           Set-Location infrastructure
-  #           docker compose -f docker-compose.registry.yml --env-file deploy.registry.env pull backend frontend
-  #           docker compose -f docker-compose.registry.yml --env-file deploy.registry.env up -d
 
+      - name: Pull and start stack
+        run: |
+          $ErrorActionPreference = 'Stop'
+          Set-Location infrastructure
+          docker compose -f docker-compose.registry.yml --env-file deploy.registry.env pull backend frontend
+          docker compose -f docker-compose.registry.yml --env-file deploy.registry.env up -d

AGENTS.md

@@ -10,7 +10,7 @@ Dental clinic ↔ lab platform (monorepo):
 |------|--------|
 | `backend/` | NestJS, Prisma, PostgreSQL |
 | `frontend/` | Next.js 16, React 19, next-intl, Tailwind |
-| `infrastructure/` | Docker, nginx, deploy scripts |
+| `infrastructure/` | Docker — staging `https://wixur.ir` (Windows, `STAGING-DEPLOY.md`); prod `https://nudentic.ir` (Linux, `DEPLOY.md`) |
 
 **Organization types:** `CLINIC` (patients, appointments, treatment) and `LAB` (cases, tasks). Many features are org-type-specific. Permissions use `TAB_*_READ` / `TAB_*_EDIT` codes — see `backend/src/common/permissions.ts`.
 

README.md

@@ -8,137 +8,23 @@ Local development: see **`backend/README.md`** and **`frontend/README.md`**.
 
 ---
 
-## Production deploy (Docker Hub + HTTPS + Let's Encrypt)
+## Production deploy (`https://nudentic.ir`)
 
-**Full step-by-step guide:** [`infrastructure/DEPLOY.md`](infrastructure/DEPLOY.md)
+**Full guide:** [`infrastructure/DEPLOY.md`](infrastructure/DEPLOY.md)
 
-Minimal server setup: install Docker, create `.env` + `secrets/`, `docker login`, run one script.
+Git tag **`v1.0.1`** → Gitea workflow [`.gitea/workflows/prod-tag-deploy.yml`](.gitea/workflows/prod-tag-deploy.yml) builds images (URLs baked for nudentic.ir), pushes to Gitea registry, SSH-deploys the Linux stack.
 
-| On server (once) | In repo / Docker |
+First-time SSL / Hub fallback: same `DEPLOY.md`.
-|------------------|------------------|
-| DNS A record → server IP | `docker-compose.prod.yml`, nginx, certbot |
-| `docker login` (private Hub) | Build & push images from dev machine |
-| `secrets/database.env`, `secrets/backend.env` | Examples: `database.prod.env.example`, `backend.prod.env.example` |
-| `infrastructure/.env` (`DOMAIN`, `LETSENCRYPT_EMAIL`) | `deploy.prod.env.example` |
-
-**Dev machine** — build frontend with the public domain baked in, push to Docker Hub:
-
-```bash
-./infrastructure/scripts/build-and-push-prod.sh wixur.ir latest
-```
-
-**Server** — from `infrastructure/`:
-
-```bash
-cp deploy.prod.env.example .env          # edit DOMAIN, paths
-mkdir -p ../secrets && cp database.prod.env.example ../secrets/database.env
-cp backend.prod.env.example ../secrets/backend.env   # set passwords + FRONTEND_URL
-docker login
-chmod +x scripts/*.sh
-./scripts/deploy-prod.sh
-```
-
-SSL is issued automatically via **Certbot** (`scripts/init-letsencrypt.sh`). Nginx config is generated from `DOMAIN` in `.env`. When you move to another domain (e.g. `dyolink.com`), update `.env` + `backend.env`, re-run `init-letsencrypt.sh`, and **rebuild the frontend image** with the new URL.
 
 ---
 
-## Deploy on your own server (Docker + Gitea)
+## Staging deploy (`https://wixur.ir`)
 
-High level: **build container images → push to a registry → server pulls images and runs Compose**. Optionally **Gitea Actions** automates that on every merge to `main` / `master`.
+**Full guide:** [`infrastructure/STAGING-DEPLOY.md`](infrastructure/STAGING-DEPLOY.md)
 
-### 1. One-time server preparation
+Merge or push to **`master`** → Gitea Actions builds images → deploys to `https://wixur.ir` (Gitea: `http://wixur.ir:3000`).
 
-1. Install **Docker** and **Docker Compose** on the server.
+Workflow: [`.gitea/workflows/registry-build-deploy.yml`](.gitea/workflows/registry-build-deploy.yml)
-2. Run **Gitea** with the **container registry** enabled (same host/port you use for `docker login`, e.g. `178.131.50.201:3000`).
-3. Copy the repo (or deploy only `infrastructure/` + secrets). You need at least:
-
-   - `infrastructure/docker-compose.registry.yml`
-   - `infrastructure/nginx/` configs referenced by that compose file
-   - `infrastructure/database/init.sql` if used by your Postgres service
-
-4. **Secrets on the server** (never commit real values):
-
-   - Copy `infrastructure/database.staging.env.example` → **`database.staging.env`** (Postgres user/password/db).
-   - Copy `infrastructure/backend.staging.env.example` → **`backend.staging.env`** (e.g. `DATABASE_URL`, JWT, pointing at the compose Postgres service name).
-   - Put both files in one directory on the server, e.g. `/opt/dyolink/secrets/`.
-
-5. **Registry login from the server** (same credentials you use for `docker push`):
-
-   ```bash
-   docker login <registry-host>:<port> -u <user>
-   ```
-
-   For HTTP registries, Docker may require **`insecure-registries`** on the daemon.
-
-### 2. Manual deploy (build images elsewhere, run on server)
-
-On your **dev machine** (after successful local builds):
-
-```powershell
-$REG = "<registry-host>:<port>"
-$OWN = "<registry-owner>"
-$TAG = "manual"
-
-docker build -t "${REG}/${OWN}/dyolink-backend:${TAG}" -t "${REG}/${OWN}/dyolink-backend:latest" ./backend
-
-docker build `
-  --build-arg NEXT_PUBLIC_API_URL="http://<your-public-ip>:<nginx-port>/api" `
-  --build-arg NEXT_PUBLIC_APP_URL="http://<your-public-ip>:<nginx-port>" `
-  --build-arg NEXT_PUBLIC_APP_NAME="Dyolink" `
-  -t "${REG}/${OWN}/dyolink-frontend:${TAG}" `
-  -t "${REG}/${OWN}/dyolink-frontend:latest" `
-  ./frontend
-
-docker push "${REG}/${OWN}/dyolink-backend:${TAG}"
-docker push "${REG}/${OWN}/dyolink-backend:latest"
-docker push "${REG}/${OWN}/dyolink-frontend:${TAG}"
-docker push "${REG}/${OWN}/dyolink-frontend:latest"
-```
-
-On the **server**, from `infrastructure/`:
-
-1. Create **`deploy.registry.env`** (see `infrastructure/deploy.registry.env.example`):
-
-   - `REGISTRY_PREFIX=<host>:<port>/<owner>` (no `http://`, no trailing slash)
-   - `IMAGE_TAG=latest` or the tag you pushed
-   - `STAGING_HTTP_PORT=<host port>` (e.g. `8088` — browser uses `http://<ip>:8088`)
-
-2. Set **`DEPLOY_SECRETS_DIR`** to the absolute path of the folder containing `database.staging.env` and `backend.staging.env` (you can export it in the shell or add it to `deploy.registry.env` if your Compose setup expects it).
-
-3. Pull and start:
-
-   ```bash
-   docker compose -f docker-compose.registry.yml --env-file deploy.registry.env pull backend frontend
-   docker compose -f docker-compose.registry.yml --env-file deploy.registry.env up -d
-   ```
-
-The backend container runs **`prisma migrate deploy`** on startup (via entrypoint) when `NODE_ENV=production`, so schema updates apply after you deploy a new image that includes new migrations.
-
-### 3. Automatic deploy (Gitea Actions)
-
-Workflow file: **`.gitea/workflows/registry-build-deploy.yml`**.
-
-**Requirements:**
-
-- **Gitea Actions** enabled for the repository.
-- A **self-hosted runner** (with Docker) registered to Gitea — the workflow uses `runs-on: self-hosted`.
-- **Windows runners:** the workflow uses **PowerShell** (not Bash). Gitea’s runner was failing with `execvpe(/bin/bash) failed` when Bash was routed through WSL without a real `/bin/bash`. If your runner is **Linux**, switch `.gitea/workflows/registry-build-deploy.yml` to `defaults.run.shell: bash` and use Bash syntax instead.
-- **Repository → Actions → Variables** (examples):
-
-  - `REGISTRY_HOST` — e.g. `178.131.50.201:3000`
-  - `REGISTRY_OWNER` — image namespace (same as Docker image path after the host), e.g. `admin`
-  - `PUBLIC_BASE_URL` — URL users open in the browser, e.g. `http://178.131.50.201:8088` (no trailing slash)
-  - `DEPLOY_SECRETS_DIR` — **absolute path on the runner machine** to the folder containing `database.staging.env` and `backend.staging.env`
-  - Optional: `STAGING_HTTP_PORT` (defaults to `8088`)
-
-- **Repository → Actions → Secrets:**
-
-  - `REGISTRY_USERNAME`
-  - `REGISTRY_PASSWORD` — access token with package read/write (or equivalent)
-
-**Trigger:** push to **`main`** or **`master`**, or run the workflow manually (**workflow_dispatch**).
-
-The pipeline clones from your Gitea instance, builds and pushes backend/frontend images, then on the runner runs **`docker compose pull`** and **`up -d`** using `infrastructure/docker-compose.registry.yml`.
 
 ---
 
@@ -148,5 +34,6 @@ The pipeline clones from your Gitea instance, builds and pushes backend/frontend
 |------|------|
 | `backend/Dockerfile` | API image |
 | `frontend/Dockerfile` | Web image |
+| `infrastructure/STAGING-DEPLOY.md` | Staging setup, CI variables, testing |
 | `infrastructure/docker-compose.registry.yml` | Pull-only staging stack (registry images + nginx + postgres) |
 | `infrastructure/deploy.registry.env.example` | Template for `deploy.registry.env` |

backend/Dockerfile

@@ -47,7 +47,8 @@ COPY --from=builder /app/dist ./dist
 COPY --from=builder /app/node_modules ./node_modules
 
 COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
-RUN chmod +x /usr/local/bin/docker-entrypoint.sh
+# Windows git/build context may use CRLF; strip before chmod (fixes dumb-init "No such file or directory").
+RUN sed -i 's/\r$//' /usr/local/bin/docker-entrypoint.sh && chmod +x /usr/local/bin/docker-entrypoint.sh
 
 RUN mkdir -p /app/logs && \
     chown -R dyolink:nodejs /app

backend/prisma/migrations/20260714194721/migration.sql

@@ -0,0 +1,2 @@
+-- DropIndex
+DROP INDEX "lab_cases_dueDate_idx";

frontend/Dockerfile

@@ -41,19 +41,19 @@ ENV NODE_ENV=production
 ENV PORT=3000
 ENV HOSTNAME=0.0.0.0
 
-COPY --from=builder /app/public ./public
 COPY --from=builder --chown=dyolink:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=dyolink:nodejs /app/.next/static ./.next/static
 
 COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
-RUN chmod +x /usr/local/bin/docker-entrypoint.sh
+# Windows git/build context may use CRLF; strip before chmod (fixes dumb-init "No such file or directory").
+RUN sed -i 's/\r$//' /usr/local/bin/docker-entrypoint.sh && chmod +x /usr/local/bin/docker-entrypoint.sh
 
 USER dyolink
 
 EXPOSE 3000
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=40s --retries=3 \
-  CMD node -e "require('http').get('http://127.0.0.1:3000/', (r) => {if(r.statusCode!==200)process.exit(1)})"
+  CMD node -e "require('http').get('http://127.0.0.1:3000/', (r) => { process.exit(r.statusCode >= 200 && r.statusCode < 400 ? 0 : 1); }).on('error', () => process.exit(1))"
 
 ENTRYPOINT ["dumb-init", "--", "docker-entrypoint.sh"]
 

frontend/package-lock.json

@@ -81,7 +81,6 @@
       "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.29.0",
         "@babel/generator": "^7.29.0",
@@ -2300,7 +2299,6 @@
       "integrity": "sha512-ilcTH/UniCkMdtexkoCN0bI7pMcJDvmQFPvuPvmEaYA/NSfFTAgdUSLAoVjaRJm7+6PvcM+q1zYOwS4wTYMF9w==",
       "devOptional": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "csstype": "^3.2.2"
       }
@@ -2373,7 +2371,6 @@
       "integrity": "sha512-XZzOmihLIr8AD1b9hL9ccNMzEMWt/dE2u7NyTY9jJG6YNiNthaD5XtUHVF2uCXZ15ng+z2hT3MVuxnUYhq6k1g==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@typescript-eslint/scope-manager": "8.57.0",
         "@typescript-eslint/types": "8.57.0",
@@ -2899,7 +2896,6 @@
       "integrity": "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -3203,7 +3199,6 @@
       "integrity": "sha512-Ixm8tFfoKKIPYdCCKYTsqv+Fd4IJ0DQqMyEimo+pxUOMUR9cVPlwTrFt9Avu+3cb6Zp3mAzl+t1MrG2fxxKsxw==",
       "devOptional": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@babel/types": "^7.26.0"
       }
@@ -3281,7 +3276,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "baseline-browser-mapping": "^2.9.0",
         "caniuse-lite": "^1.0.30001759",
@@ -4083,7 +4077,6 @@
       "integrity": "sha512-XoMjdBOwe/esVgEvLmNsD3IRHkm7fbKIUGvrleloJXUZgDHig2IPWNniv+GwjyJXzuNqVjlr5+4yVUZjycJwfQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.8.0",
         "@eslint-community/regexpp": "^4.12.1",
@@ -4269,7 +4262,6 @@
       "integrity": "sha512-whOE1HFo/qJDyX4SnXzP4N6zOWn79WhnCUY/iDR0mPfQZO8wcYE4JClzI2oZrhBnnMUCBCHZhO6VQyoBU95mZA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@rtsao/scc": "^1.1.0",
         "array-includes": "^3.1.9",
@@ -6318,6 +6310,17 @@
         }
       }
     },
+    "node_modules/next-intl/node_modules/@swc/helpers": {
+      "version": "0.5.23",
+      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.23.tgz",
+      "integrity": "sha512-5lSsMOTXURePglDfvuAQUqkGek9Hg2kksOYay2m0+XR++b2NWYL/4sWyuvVBIs8oKnJaxkdi9whaL/sqN13afw==",
+      "license": "Apache-2.0",
+      "optional": true,
+      "peer": true,
+      "dependencies": {
+        "tslib": "^2.8.0"
+      }
+    },
     "node_modules/next/node_modules/postcss": {
       "version": "8.4.31",
       "resolved": "https://registry.npmmirror.com/postcss/-/postcss-8.4.31.tgz",
@@ -6774,7 +6777,6 @@
       "resolved": "https://registry.npmmirror.com/react/-/react-19.2.3.tgz",
       "integrity": "sha512-Ku/hhYbVjOQnXDZFv2+RibmLFGwFdeeKHFcOTlrt7xplBnya5OGn/hIRDsqDiSUcfORsDC7MPxwork8jBwsIWA==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=0.10.0"
       }
@@ -6784,7 +6786,6 @@
       "resolved": "https://registry.npmmirror.com/react-dom/-/react-dom-19.2.3.tgz",
       "integrity": "sha512-yELu4WmLPw5Mr/lmeEpox5rw3RETacE++JgHqQzd2dg+YbJuat3jH4ingc+WPZhxaoFzdv9y33G+F7Nl5O0GBg==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "scheduler": "^0.27.0"
       },
@@ -6797,7 +6798,6 @@
       "resolved": "https://registry.npmmirror.com/react-hook-form/-/react-hook-form-7.71.2.tgz",
       "integrity": "sha512-1CHvcDYzuRUNOflt4MOq3ZM46AronNJtQ1S7tnX6YN4y72qhgiUItpacZUAQ0TyWYci3yz1X+rXaSxiuEm86PA==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=18.0.0"
       },
@@ -6813,8 +6813,7 @@
       "version": "16.13.1",
       "resolved": "https://registry.npmmirror.com/react-is/-/react-is-16.13.1.tgz",
       "integrity": "sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ==",
-      "license": "MIT",
+      "license": "MIT"
-      "peer": true
     },
     "node_modules/react-qr-code": {
       "version": "2.2.0",
@@ -6834,7 +6833,6 @@
       "resolved": "https://registry.npmmirror.com/react-redux/-/react-redux-9.3.0.tgz",
       "integrity": "sha512-KQopgqFo/p/fgmAs5qz6p5RWaNAzq40WAu7fJIXnQpYxFPbJYtsJPWvGeF2rOBaY/kEuV77AVsX8TsQzKm+A/g==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@types/use-sync-external-store": "^0.0.6",
         "use-sync-external-store": "^1.4.0"
@@ -6887,8 +6885,7 @@
       "version": "5.0.1",
       "resolved": "https://registry.npmmirror.com/redux/-/redux-5.0.1.tgz",
       "integrity": "sha512-M9/ELqF6fy8FwmkpnF0S3YKOqMyoWJ4+CS5Efg2ct3oY9daQvd/Pc71FpGZsVsbl3Cpb+IIcjBDUnnyBdQbq4w==",
-      "license": "MIT",
+      "license": "MIT"
-      "peer": true
     },
     "node_modules/redux-thunk": {
       "version": "3.1.0",
@@ -7660,7 +7657,6 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -7823,7 +7819,6 @@
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "dev": true,
       "license": "Apache-2.0",
-      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -8189,7 +8184,6 @@
       "resolved": "https://registry.npmmirror.com/zod/-/zod-4.3.6.tgz",
       "integrity": "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg==",
       "license": "MIT",
-      "peer": true,
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
       }

frontend/src/lib/api/voice.ts

@@ -22,8 +22,11 @@ export const voiceApi = {
     payload: ExtractVoicePayload,
     signal?: AbortSignal,
   ): Promise<{ success: boolean; data: VoiceExtractionResult }> => {
-    // Forwarded so cancelling closes the connection; the controller turns that into an abort.
+    // ASR + LLM routinely exceeds the default 10s axios timeout; match slow upload endpoints.
-    const response = await apiClient.post('/voice/extract', payload, { signal });
+    const response = await apiClient.post('/voice/extract', payload, {
+      signal,
+      timeout: 120_000,
+    });
     return response.data;
   },
 };

infrastructure/DEPLOY.md

@@ -1,13 +1,84 @@
 # Dyolink — Production Server Deploy Guide
 
-Deploy the full stack (Postgres, NestJS API, Next.js, Nginx, Let's Encrypt) on a fresh Linux server using **Docker Hub** images.
+Linux VPS serves **`https://nudentic.ir` only**. Images come from the **Gitea registry** (`wixur.ir:3000`) on git tags. Staging is Windows (`https://wixur.ir`) — see [`STAGING-DEPLOY.md`](STAGING-DEPLOY.md).
 
-**Example used in production:** `https://wixur.ir` on server `185.243.48.140`.
+**Automated path:** tag `v1.0.1` → [`.gitea/workflows/prod-tag-deploy.yml`](../.gitea/workflows/prod-tag-deploy.yml) (Windows runner builds, SSH to this server).
+
+**Manual / first SSL:** Docker Hub + [`scripts/build-and-push-prod.sh`](scripts/build-and-push-prod.sh) is still documented below as a fallback.
+
+**Example host:** `https://nudentic.ir` (do not point `wixur.ir` at this VPS).
+
+---
+
+## Automated deploy (Gitea tags)
+
+```
+git tag v1.0.1 && git push origin v1.0.1
+        ↓
+Windows act_runner builds frontend with https://nudentic.ir
+        ↓
+Push wixur.ir:3000/<owner>/dyolink-*:v1.0.1   (never :latest)
+        ↓
+SSH → Linux  docker login wixur.ir:3000  →  compose pull + up
+        ↓
+https://nudentic.ir
+```
+
+`:latest` is **staging only** (wixur.ir baked in). Production compose must pin `TAG=v1.0.1`.
+
+### One-time on the Linux server
+
+1. **HTTP registry** — Gitea is `http://wixur.ir:3000`. In `/etc/docker/daemon.json`:
+
+```json
+{
+  "insecure-registries": ["wixur.ir:3000"]
+}
+```
+
+Then `sudo systemctl restart docker` (containers restart).
+
+2. **`.env`** in `/opt/dyolink/infrastructure/` — from [`deploy.prod.env.example`](deploy.prod.env.example):
+
+- `DOMAIN=nudentic.ir`
+- `REGISTRY_PREFIX=wixur.ir:3000/<gitea-owner>` (same owner as Gitea `REGISTRY_OWNER`)
+- `TAG=v1.0.1` (CI overrides per release)
+
+3. **`secrets/backend.env`:** `FRONTEND_URL=https://nudentic.ir`, `COOKIE_SECURE=true`
+
+4. **SSH** — user that can run `docker` (e.g. `dyolink` in the `docker` group). Put the matching **public** key in `~/.ssh/authorized_keys`.
+
+5. **Test pull** (after a staging or prod image exists):
+
+```bash
+docker login wixur.ir:3000 -u <gitea-user>
+docker pull wixur.ir:3000/<owner>/dyolink-backend:<sha-or-tag>
+```
+
+### Gitea (same repo as staging)
+
+**Variables:** `PROD_PUBLIC_BASE_URL=https://nudentic.ir`, `PROD_REGISTRY_HOST=wixur.ir:3000`, `PROD_INFRA_DIR=/opt/dyolink/infrastructure`, plus existing `REGISTRY_HOST` / `REGISTRY_OWNER` / `CLONE_HOST`.
+
+**Secrets:** `PROD_SSH_HOST`, `PROD_SSH_USER`, `PROD_SSH_KEY` (private key). Reuse `REGISTRY_USERNAME` / `REGISTRY_PASSWORD`. Optional `PROD_SSH_PORT` (default 22).
+
+OpenSSH must be on the Windows runner (`ssh.exe` / `scp.exe`).
+
+### Release
+
+```bash
+git tag v1.0.1
+git push origin v1.0.1
+```
+
+Or Gitea → Actions → **Production — tag build, push, deploy** → Run → tag `v1.0.1`.
+
+Check `https://nudentic.ir/api/health`.
 
 ---
 
 ## Architecture
 
+
 ```
 Internet → Nginx (:80 / :443)
               ├── /      → frontend:3000  (Next.js)
@@ -18,8 +89,8 @@ Internet → Nginx (:80 / :443)
 | Service   | Image                              | Notes                          |
 |-----------|------------------------------------|--------------------------------|
 | postgres  | `postgres:15-alpine`               | Data in Docker volume          |
-| backend   | `dyolink/dyolink-backend:latest`   | Runs migrations + seed on start |
+| backend   | `REGISTRY_PREFIX/dyolink-backend:TAG` | Gitea `v*` or Hub `dyolink/…` |
-| frontend  | `dyolink/dyolink-frontend:latest`  | URLs baked in at **build time** |
+| frontend  | `REGISTRY_PREFIX/dyolink-frontend:TAG` | URLs baked in at **build time** |
 | nginx     | `nginx:alpine`                     | SSL termination + reverse proxy |
 | certbot   | `certbot/certbot`                  | Auto-renews certificates       |
 
@@ -289,16 +360,19 @@ Open `https://YOUR_DOMAIN` in a browser.
 
 ## Updating the app (new release)
 
-**On Mac** — build & push:
+**Preferred:** `git tag vX.Y.Z && git push origin vX.Y.Z` (Gitea production workflow).
+
+**Fallback (Docker Hub from a Mac):**
 
 ```bash
-./infrastructure/scripts/build-and-push-prod.sh wixur.ir latest
+./infrastructure/scripts/build-and-push-prod.sh nudentic.ir v1.0.1
 ```
 
-**On server:**
+**On server** (if not using CI):
 
 ```bash
 cd /opt/dyolink/infrastructure
+# TAG in .env or: TAG=v1.0.1 docker compose -f docker-compose.prod.yml --env-file .env pull backend frontend
 docker compose -f docker-compose.prod.yml --env-file .env pull backend frontend
 docker compose -f docker-compose.prod.yml --env-file .env up -d
 ```
@@ -361,6 +435,10 @@ docker volume rm dyolink_postgres_data_prod
 ./scripts/deploy-prod.sh
 ```
 
+### Docker login to `wixur.ir:3000`: `http response to HTTPS client`
+
+Add `"insecure-registries": ["wixur.ir:3000"]` to `/etc/docker/daemon.json` and restart Docker.
+
 ### View logs
 
 ```bash
@@ -385,12 +463,13 @@ docker compose -f docker-compose.prod.yml --env-file .env exec frontend \
 
 | Path on server | Purpose |
 |----------------|---------|
-| `/opt/dyolink/infrastructure/.env` | Domain, Docker Hub user, Let's Encrypt email |
+| `/opt/dyolink/infrastructure/.env` | `DOMAIN`, `REGISTRY_PREFIX`, `TAG`, Let's Encrypt email |
 | `/opt/dyolink/secrets/database.env` | Postgres credentials |
-| `/opt/dyolink/secrets/backend.env` | API secrets, DATABASE_URL, JWT, SMS |
+| `/opt/dyolink/secrets/backend.env` | API secrets, DATABASE_URL, JWT, SMS, `FRONTEND_URL` |
 | `/opt/dyolink/infrastructure/nginx/generated/default.conf` | Auto-generated nginx SSL config |
-| `/opt/dyolink/infrastructure/scripts/deploy-prod.sh` | Main deploy entry point |
+| `/opt/dyolink/infrastructure/scripts/prod-remote-deploy.sh` | Tag deploy (CI SSH) |
-| `/opt/dyolink/infrastructure/scripts/build-and-push-prod.sh` | Build & push (run on Mac) |
+| `/opt/dyolink/infrastructure/scripts/deploy-prod.sh` | First-time SSL + stack up |
+| `.gitea/workflows/prod-tag-deploy.yml` | CI: build, push `:v*`, SSH deploy |
 
 ---
 

infrastructure/STAGING-DEPLOY.md

@@ -0,0 +1,348 @@
+# Dyolink — Staging deploy (Gitea + Windows)
+
+Automatic staging on a **self-hosted Gitea** machine: merge (or push) to **`master`** → build Docker images → push to Gitea Container Registry → deploy on the same host.
+
+| Public URL | What |
+|------------|------|
+| `https://wixur.ir` | Staging app (port **443** → Windows nginx → Docker). Mobinnet: public **80** is the modem. |
+| `http://wixur.ir:8088` | HTTP fallback |
+| `http://wixur.ir:3000` | Gitea + container registry |
+
+DNS `wixur.ir` must point at the **Windows** host. Production (`https://nudentic.ir` on Linux) is separate — see [`DEPLOY.md`](DEPLOY.md). Do **not** point `wixur.ir` at the Linux VPS.
+
+---
+
+## Architecture
+
+```
+Push / merge to master
+        ↓
+Gitea Actions (self-hosted act_runner on Windows)
+        ↓
+Build backend + frontend → push to Gitea registry
+        ↓
+docker compose pull + up -d (docker-compose.registry.yml)
+        ↓
+https://wixur.ir       →  Windows nginx :443 →  127.0.0.1:18088  →  Docker nginx → app
+http://wixur.ir:8088   →  portproxy :8088    →  127.0.0.1:18088  (fallback)
+http://wixur.ir:3000   →  Gitea (native, no Docker)
+```
+
+| Service  | Image source                                      |
+|----------|---------------------------------------------------|
+| postgres | `postgres:15-alpine` (pulled from Docker Hub)     |
+| backend  | `<REGISTRY_HOST>/<owner>/dyolink-backend:<sha>`   |
+| frontend | `<REGISTRY_HOST>/<owner>/dyolink-frontend:<sha>`  |
+| nginx    | `nginx:alpine`                                    |
+
+Frontend public URLs are **baked in at build time** via `PUBLIC_BASE_URL`. After changing the public URL, re-run the Gitea workflow (or push to `master`) and set `FRONTEND_URL` in `C:\dyolink\secrets\backend.staging.env` to the same origin.
+
+---
+
+## Cut over from `:8088` to `http://wixur.ir`
+
+DNS A record for `wixur.ir` → Windows IP (already done if `http://wixur.ir:3000` and `:8088` work).
+
+On Windows: host nginx on **80** proxies to Docker **18088** ([`nginx/windows-edge-http.conf`](nginx/windows-edge-http.conf)). Remove portproxy on **80** (keep **8088** as fallback). Router must forward **80**. See §7.
+
+In Gitea → repo → **Settings → Actions → Variables**:
+
+- `PUBLIC_BASE_URL` = `https://wixur.ir`
+- `STAGING_HTTP_PORT` = `80` (optional; workflow default is 80)
+
+On disk: `FRONTEND_URL=https://wixur.ir` and `COOKIE_SECURE=true` in `C:\dyolink\secrets\backend.staging.env`.
+
+Then run the **Registry — build, push, deploy** workflow so the frontend image is rebuilt without `:8088`.
+
+---
+
+---
+
+## Triggers
+
+| Event | Staging deploy? |
+|-------|-----------------|
+| Push to `master` | Yes |
+| PR merged into `master` | Yes (merge = push to `master`) |
+| Push to other branches only | No |
+| Git tag (e.g. `v1.0.0`) | No — reserved for production later |
+| Manual | Gitea → Actions → **Registry — build, push, deploy** → Run workflow |
+
+Workflow file: [`.gitea/workflows/registry-build-deploy.yml`](../.gitea/workflows/registry-build-deploy.yml)
+
+---
+
+## One-time setup (Windows host)
+
+### 1. Docker Desktop
+
+- Install and keep **Docker Desktop running** during builds/deploys.
+- **Settings → Docker Engine** — allow HTTP registry:
+
+```json
+{
+  "insecure-registries": [
+    "host.docker.internal:3000",
+    "127.0.0.1:3000",
+    "wixur.ir:3000"
+  ]
+}
+```
+
+Apply & restart Docker Desktop.
+
+**Why `host.docker.internal`?** Docker Desktop runs in a Linux VM. `docker login` runs from that VM — `127.0.0.1:3000` is the VM, not Gitea on Windows.
+
+### 2b. Gitea `app.ini` — match registry URL
+
+Edit `C:\gitea\custom\conf\app.ini`:
+
+```ini
+[server]
+ROOT_URL = http://host.docker.internal:3000/
+```
+
+Restart Gitea. Gitea uses `ROOT_URL` for Docker registry auth redirects.
+
+### 2c. Gitea Actions runner
+
+Download [act_runner](https://gitea.com/gitea/act_runner/releases) → e.g. `C:\gitea-runner\act_runner.exe`.
+
+**Important — runner level:** the registration token decides which repos can use the runner.
+
+| Token from | Runner level | Works for `admin/dyolink`? |
+|------------|--------------|----------------------------|
+| **Site Administration → Actions → Runners** | Instance (global) | Yes (recommended) |
+| **Repo → Settings → Actions → Runners** | Repository | Yes |
+| **User profile → Settings → Actions → Runners** | Individual | Often **no** — jobs stay queued with “no matching online runner” |
+
+If your runner shows **Type: Individual** in Gitea but jobs never start, delete it and re-register with an **instance** or **repository** token (table above).
+
+Register (use **localhost** when Gitea runs on the same PC — public IP often fails locally):
+
+```powershell
+cd C:\gitea-runner
+# Stop daemon first (Ctrl+C) if running
+.\act_runner.exe register `
+  --instance "http://127.0.0.1:3000" `
+  --token "<token-from-Site-Admin-OR-repo-Runners-page>" `
+  --name "windows-staging" `
+  --labels "windows:host"
+```
+
+Start (leave running, or install as a Windows service later):
+
+```powershell
+.\act_runner.exe daemon
+```
+
+**Verify:** open **your repo** → **Settings → Actions → Runners** — `windows-staging` must appear here as **Idle/Online** (not only under user settings).
+
+**Requires:** `git` on PATH (for workflow checkout step).
+
+### 3. Secret env files (not in git)
+
+```powershell
+New-Item -ItemType Directory -Force -Path "C:\dyolink\secrets"
+```
+
+Copy examples and edit:
+
+- `infrastructure/database.staging.env.example` → `C:\dyolink\secrets\database.staging.env`
+- `infrastructure/backend.staging.env.example` → `C:\dyolink\secrets\backend.staging.env`
+
+Rules:
+
+- `DATABASE_URL` password must match `POSTGRES_PASSWORD`.
+- `FRONTEND_URL` must match `PUBLIC_BASE_URL` (`http://wixur.ir`).
+- Replace JWT secrets with long random values (not `CHANGE_ME`).
+
+### 4. Gitea repository Variables
+
+**Settings → Actions → Variables**
+
+| Name | Example | Notes |
+|------|---------|--------|
+| `REGISTRY_HOST` | `host.docker.internal:3000` | **Windows + Docker Desktop:** Docker runs in a Linux VM — `127.0.0.1` is the VM, not Gitea. Use `host.docker.internal:3000`. Gitea `ROOT_URL` should match this so registry login from CI works. Browsers and the Linux VPS use `http://wixur.ir:3000`. |
+| `REGISTRY_OWNER` | `admin` | Gitea user/org owning packages |
+| `PUBLIC_BASE_URL` | `https://wixur.ir` | How **users** open staging (HTTPS on 443). No trailing slash. |
+| `DEPLOY_SECRETS_DIR` | `C:/dyolink/secrets` | Forward slashes OK on Windows |
+| `CLONE_HOST` | `127.0.0.1:3000` | Git clone (runs on Windows host, not inside Docker VM) |
+| `STAGING_HTTP_PORT` | `80` | Public HTTP port (portproxy). Optional; workflow default is 80. |
+| `STAGING_LOCAL_PORT` | `18088` | Docker bind on `127.0.0.1`. Must not be `80` if portproxy already uses 80. |
+
+**Naming note:** Gitea rejects variable names starting with `GITEA_` or `GITHUB_`. Use `CLONE_HOST`, not `GITEA_CLONE_URL`.
+
+### 5. Gitea repository Secrets
+
+**Settings → Actions → Secrets**
+
+| Name | Value |
+|------|--------|
+| `REGISTRY_USERNAME` | Gitea username |
+| `REGISTRY_PASSWORD` | Gitea access token with **package read/write** |
+
+Create token: profile → **Settings → Applications → Generate New Token**.
+
+### 6. Firewall (once)
+
+```powershell
+New-NetFirewallRule -DisplayName "Dyolink Staging HTTP 80" -Direction Inbound -Protocol TCP -LocalPort 80 -Action Allow
+# Optional fallback while cutting over from :8088
+New-NetFirewallRule -DisplayName "Dyolink Staging 8088" -Direction Inbound -Protocol TCP -LocalPort 8088 -Action Allow
+```
+
+### 7. Port 80 = host nginx (not portproxy)
+
+Gitea stays on **:3000**. Docker staging nginx binds **127.0.0.1:18088**. A **Windows nginx** (the 1.29.x you already have) listens on **80** and proxies to 18088. Config: [`nginx/windows-edge-http.conf`](nginx/windows-edge-http.conf).
+
+**Do not** run portproxy on port 80 at the same time — it will lose to nginx (404 / hang). Keep portproxy **8088 → 18088** as fallback.
+
+```powershell
+# 1) Free port 80 from portproxy (nginx will bind 80)
+netsh interface portproxy delete v4tov4 listenaddress=0.0.0.0 listenport=80
+
+# 2) Confirm Docker staging is up
+curl.exe http://127.0.0.1:18088/health
+
+# 3) Install windows-edge-http.conf into host nginx, then:
+#    nginx -t
+#    nginx -s reload
+#    (paths depend on where nginx is installed)
+
+# 4) Must print "healthy" (not 404)
+curl.exe http://127.0.0.1/health
+```
+
+Replace any **default_server** / leftover `server { listen 80; }` in the host nginx that returns 404, or this file will never win.
+
+From another machine (after **router forward TCP 80** → this PC):
+
+```bash
+curl http://wixur.ir/health
+```
+
+**Mobinnet:** public **80** is the modem. Use **443** instead: router forward **TCP 443 → 192.168.1.100**, then `https://wixur.ir`. Let's Encrypt after mobile-data `/health` works (self-signed is enough for that test).
+
+---
+
+## Test the pipeline
+
+### Before first run
+
+- [ ] Docker Desktop running
+- [ ] `act_runner.exe daemon` running
+- [ ] All Variables + Secrets set (including `CLONE_HOST`)
+- [ ] Secret env files exist under `DEPLOY_SECRETS_DIR`
+- [ ] Workflow enabled on `master` (see repo)
+
+### Option A — Manual workflow (safest first test)
+
+1. Gitea → repo → **Actions**
+2. **Registry — build, push, deploy** → **Run workflow** → branch `master`
+3. Watch jobs: **build-and-push** → **deploy** (first run ~15–30 min)
+
+### Option B — Push to master
+
+```bash
+git push origin master
+```
+
+Or merge a PR into `master` — same result.
+
+### Verify success
+
+**On Windows (PowerShell):**
+
+```powershell
+docker ps
+```
+
+Expect: `dyolink_nginx_staging`, `dyolink_backend_staging`, `dyolink_frontend_staging`, `dyolink_postgres_staging`.
+
+**From browser or another machine:**
+
+```text
+http://wixur.ir
+```
+
+**Health check:**
+
+```powershell
+curl http://wixur.ir/api/health
+```
+
+Expected: `{"status":"ok",...}`
+
+**Gitea packages:** profile/org → **Packages** — should list `dyolink-backend` and `dyolink-frontend` after first build.
+
+---
+
+## Manual deploy (without CI)
+
+Useful when debugging registry/compose without re-running the full workflow.
+
+On the Windows host, from repo `infrastructure/`:
+
+1. Create `deploy.registry.env` from [`deploy.registry.env.example`](deploy.registry.env.example)
+2. Set `REGISTRY_PREFIX`, `IMAGE_TAG`, `STAGING_HTTP_PORT`, `DEPLOY_SECRETS_DIR`
+3. `docker login host.docker.internal:3000 -u <user>`  (on Windows Docker Desktop; Linux prod will use `wixur.ir:3000`)
+4. `docker compose -f docker-compose.registry.yml --env-file deploy.registry.env pull backend frontend`
+5. `docker compose -f docker-compose.registry.yml --env-file deploy.registry.env up -d`
+
+---
+
+## Troubleshooting
+
+| Symptom | Fix |
+|---------|-----|
+| `no matching online runner with label` | Runner **offline** → start `act_runner.exe daemon`. Or wrong **runner level** → re-register with token from **Site Administration → Actions → Runners** or **repo → Settings → Actions → Runners** (not user profile). Confirm runner appears on **repo** Runners page as Online. |
+| Runner can't register on public IP | Use `http://127.0.0.1:3000` for `--instance` |
+| Variable name rejected in Gitea | No `GITEA_*` / `GITHUB_*` prefixes; use `CLONE_HOST` |
+| `docker login` connection refused on `127.0.0.1:3000` | **Docker Desktop on Windows:** set `REGISTRY_HOST=host.docker.internal:3000`, add it to insecure-registries, set Gitea `ROOT_URL=http://host.docker.internal:3000/`. Keep `CLONE_HOST=127.0.0.1:3000` for git. |
+| `docker login` / push denied, redirect to public IP | Set Gitea `ROOT_URL` to a host Docker can reach (`host.docker.internal:3000` on Windows Docker Desktop). |
+| `server gave HTTP response to HTTPS client` | Add registry host to Docker **insecure-registries**, restart Docker |
+| `Missing database.staging.env` | Check `DEPLOY_SECRETS_DIR` path and file names |
+| `docker login` denied | Token needs package permissions; check username/secret |
+| Git clone fails in workflow | Set `CLONE_HOST=127.0.0.1:3000` |
+| Port 80 bind forbidden / access permissions | Portproxy already owns 80. Bind Docker to `18088` and point portproxy **80 → 127.0.0.1:18088**. Free IIS if it holds 80. |
+| `http://wixur.ir` unreachable / empty reply | Docker Desktop: run **portproxy** (§7). `127.0.0.1:18088/health` must work on Windows first. Router must forward **80**. |
+| Port 8088 bind forbidden / access permissions | Portproxy already owns 8088. Bind Docker to `18088` and point portproxy **8088 → 127.0.0.1:18088**. |
+| Port 8088 unreachable from Mac / empty reply | Legacy URL. Prefer `http://wixur.ir`. Same 18088 backend; add portproxy 8088 only as fallback. |
+| Backend restart loop | JWT secrets still placeholder; fix `backend.staging.env` |
+| Backend DB auth error | `DATABASE_URL` password ≠ `POSTGRES_PASSWORD` |
+| `dumb-init docker-entrypoint.sh: No such file or directory` | Windows CRLF in shell scripts — fixed in Dockerfiles (rebuild images). |
+| `frontend is unhealthy` / deploy waits on frontend | Next.js `/` redirects to `/en` (3xx). Rebuild after healthcheck fix (accepts 2xx/3xx). |
+
+**Logs:**
+
+```powershell
+docker logs dyolink_backend_staging --tail 50
+docker logs dyolink_nginx_staging --tail 50
+docker logs dyolink_frontend_staging --tail 50
+```
+
+---
+
+## File reference
+
+| Path | Role |
+|------|------|
+| `.gitea/workflows/registry-build-deploy.yml` | CI: build, push, deploy |
+| `infrastructure/docker-compose.registry.yml` | Staging stack (pull-only images) |
+| `infrastructure/deploy.registry.env.example` | Manual deploy env template |
+| `infrastructure/database.staging.env.example` | Postgres secrets template |
+| `infrastructure/backend.staging.env.example` | API secrets template |
+| `infrastructure/nginx/http-only.conf` | HTTP reverse proxy **inside Docker** staging |
+| `infrastructure/nginx/windows-edge-http.conf` | Windows **host** nginx on port 80 → 18088 |
+
+---
+
+## Production (Linux + tags)
+
+| Environment | Trigger | Host |
+|-------------|---------|------|
+| Staging | Push/merge to `master` | Windows + `https://wixur.ir` |
+| Production | Git tag `v*.*.*` | Linux + `https://nudentic.ir` |
+
+Workflow: [`.gitea/workflows/prod-tag-deploy.yml`](../.gitea/workflows/prod-tag-deploy.yml). Do **not** push production images as `:latest`. Setup: [`DEPLOY.md`](DEPLOY.md).

infrastructure/backend.prod.env.example

@@ -12,7 +12,7 @@ JWT_REFRESH_SECRET=replace_with_a_different_openssl_rand_hex_32_output
 JWT_REFRESH_EXPIRES_IN=30d
 
 # Must match DOMAIN in .env — used for CORS, invite links, cookies
-FRONTEND_URL=https://wixur.ir
+FRONTEND_URL=https://nudentic.ir
 
 # Required for HTTPS — browsers reject Secure cookies over plain HTTP
 COOKIE_SECURE=true

infrastructure/backend.staging.env.example

@@ -9,11 +9,11 @@ JWT_EXPIRES_IN=15m
 JWT_REFRESH_SECRET=another_long_random_secret_different_from_JWT_SECRET
 JWT_REFRESH_EXPIRES_IN=30d
 
-# CORS, cookies, and invite links — must match how users open the app (nginx host port)
+# CORS, cookies, and invite links — must match how users open the app
-FRONTEND_URL=http://178.131.50.201:8088
+FRONTEND_URL=https://wixur.ir
 
-# HTTP staging — keep false unless you terminate TLS in front of the app
+# TLS is terminated on Windows nginx :443 — cookies must be Secure
-COOKIE_SECURE=false
+COOKIE_SECURE=true
 
 # SMS (sms.ir)
 SMS_IR_API_KEY=CHANGE_ME_SMS_IR_API_KEY

infrastructure/deploy.prod.env.example

@@ -1,15 +1,27 @@
-# Copy to infrastructure/.env on the server (not committed).
+# Copy to infrastructure/.env on the Linux server (not committed).
 # docker compose -f docker-compose.prod.yml --env-file .env ...
 
-DOMAIN=wixur.ir
+DOMAIN=nudentic.ir
+
+# Gitea Container Registry (tag auto-deploy). Same packages Windows CI pushes
+# via host.docker.internal:3000 — Linux pulls via this hostname.
+# Format: <host>:<port>/<owner>  — no http://
+REGISTRY_PREFIX=wixur.ir:3000/admin
+
+# Image tag — CI sets this per release (v1.0.1). Do not use latest for Gitea prod
+# (staging already owns :latest with the wixur.ir frontend bake).
+TAG=v1.0.1
+
+# Hub-only fallback: comment out REGISTRY_PREFIX and use:
+# REGISTRY_PREFIX=dyolink
+# TAG=latest
 DOCKER_USERNAME=dyolink
-TAG=latest
 
 # Let's Encrypt — certificate issuance and renewal notices
 LETSENCRYPT_EMAIL=rameen.naghdi@gmail.com
 
-# Optional: extra hostnames on the same cert (space-separated), e.g. www.wixur.ir
+# Optional: extra hostnames on the same cert (space-separated)
-# CERTBOT_EXTRA_DOMAINS=www.wixur.ir
+# CERTBOT_EXTRA_DOMAINS=www.nudentic.ir
 
 # Optional: use Let's Encrypt staging while testing (avoids rate limits)
 # LETSENCRYPT_STAGING=1

infrastructure/deploy.registry.env.example

@@ -6,14 +6,20 @@
 # --- Registry boundary (swap when moving Gitea → Docker Hub) ---
 # Gitea:  REGISTRY_PREFIX = <host>:<port>/<owner>
 # Hub:    REGISTRY_PREFIX = docker.io/<user>   (or your username for implicit hub)
-REGISTRY_PREFIX=178.131.50.201:3000/yourgiteauser
+# Windows CI pushes via host.docker.internal:3000; browsers/Linux use wixur.ir:3000 (same Gitea).
+REGISTRY_PREFIX=wixur.ir:3000/yourgiteauser
 
 # Short git SHA from CI, or "latest" after a manual pull of :latest
 IMAGE_TAG=latest
 
-# Host port published for nginx (URL = http://<your-ip>:<this-port>)
+# Public HTTP port (router + Windows portproxy listen here) — 80 so users open http://wixur.ir
-STAGING_HTTP_PORT=8088
+STAGING_HTTP_PORT=80
+# Docker nginx bind on localhost only (must differ from 80 if portproxy owns 80)
+STAGING_LOCAL_PORT=18088
 
 # Absolute path on the server where database.staging.env and backend.staging.env live.
-# Use forward slashes on Windows. Same variable as Gitea Actions → DEPLOY_SECRETS_DIR.
+# Use forward slashes on Windows. Same path as Gitea Actions variable DEPLOY_SECRETS_DIR.
-# DEPLOY_SECRETS_DIR=D:/dyolink/secrets
+# DEPLOY_SECRETS_DIR=C:/dyolink/secrets
+#
+# Gitea Actions also needs CLONE_HOST=127.0.0.1:3000 when runner and Gitea share one Windows host.
+# See STAGING-DEPLOY.md (do not use GITEA_* variable names — Gitea rejects them).

infrastructure/docker-compose.prod.yml

@@ -1,13 +1,11 @@
-# Production stack — pull images from Docker Hub, HTTPS via Let's Encrypt (certbot).
+# Production stack — pull backend/frontend from Gitea (or Docker Hub fallback).
+# HTTPS via Let's Encrypt (certbot) on this host only (nudentic.ir).
 #
-# Server setup (minimal):
+# Gitea tag deploy: set REGISTRY_PREFIX=wixur.ir:3000/<owner> and TAG=v1.0.1 in .env
-#   1. Copy deploy.prod.env.example → .env  (DOMAIN, DOCKER_USERNAME, LETSENCRYPT_EMAIL)
+# Hub fallback: omit REGISTRY_PREFIX, set DOCKER_USERNAME=dyolink (image dyolink/dyolink-*).
-#   2. Copy secrets/*.example → ../secrets/ (database.env, backend.env) — outside git
-#   3. docker login   (private Docker Hub images)
-#   4. ./scripts/init-letsencrypt.sh   (first time only)
-#   5. docker compose -f docker-compose.prod.yml --env-file .env up -d
 #
-# Updates: docker compose pull && docker compose up -d
+# First SSL: ./scripts/init-letsencrypt.sh then up -d
+# Tag updates: CI runs scripts/prod-remote-deploy.sh (or pull + up locally)
 
 name: dyolink-prod
 
@@ -39,7 +37,7 @@ services:
       start_period: 40s
 
   backend:
-    image: ${DOCKER_USERNAME}/dyolink-backend:${TAG:-latest}
+    image: ${REGISTRY_PREFIX:-dyolink}/dyolink-backend:${TAG:-latest}
     container_name: dyolink_backend_prod
     depends_on:
       postgres:
@@ -68,7 +66,7 @@ services:
       start_period: 60s
 
   frontend:
-    image: ${DOCKER_USERNAME}/dyolink-frontend:${TAG:-latest}
+    image: ${REGISTRY_PREFIX:-dyolink}/dyolink-frontend:${TAG:-latest}
     container_name: dyolink_frontend_prod
     depends_on:
       - backend
@@ -88,7 +86,8 @@ services:
         max-size: "10m"
         max-file: "3"
     healthcheck:
-      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:3000/', (r) => {if(r.statusCode!==200)process.exit(1)})"]
+      # Next.js `/` redirects to `/en` — accept 2xx/3xx.
+      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:3000/', (r) => { process.exit(r.statusCode >= 200 && r.statusCode < 400 ? 0 : 1); }).on('error', () => process.exit(1))"]
       interval: 30s
       timeout: 10s
       retries: 3

infrastructure/docker-compose.registry.yml

@@ -2,7 +2,7 @@
 # No backend/frontend source on the deployment host except this compose file + config + secrets.
 #
 # Required env (see deploy.registry.env.example):
-#   REGISTRY_PREFIX   e.g. 178.131.50.201:3000/yourgiteauser  (no protocol, no trailing slash)
+#   REGISTRY_PREFIX   e.g. host.docker.internal:3000/admin (Windows CI) or wixur.ir:3000/admin (no protocol)
 #   IMAGE_TAG         short sha or "latest" (CI sets this per deploy)
 # Optional:
 #   DEPLOY_SECRETS_DIR   absolute path on the server to database/backend *.env files (see below)
@@ -75,7 +75,8 @@ services:
       - dyolink_staging
     restart: unless-stopped
     healthcheck:
-      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:3000/', (r) => {if(r.statusCode!==200)process.exit(1)})"]
+      # Root redirects to /en (next-intl) — accept 2xx/3xx as healthy.
+      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:3000/', (r) => { process.exit(r.statusCode >= 200 && r.statusCode < 400 ? 0 : 1); }).on('error', () => process.exit(1))"]
       interval: 30s
       timeout: 10s
       retries: 3
@@ -85,10 +86,14 @@ services:
     image: nginx:alpine
     container_name: dyolink_nginx_staging
     depends_on:
-      - backend
+      backend:
-      - frontend
+        condition: service_healthy
+      frontend:
+        condition: service_healthy
     ports:
-      - "${STAGING_HTTP_PORT:-8088}:80"
+      # Bind a private localhost port — Windows portproxy owns public 80 (http://wixur.ir).
+      # See STAGING-DEPLOY.md §7: portproxy 0.0.0.0:80 → 127.0.0.1:18088
+      - "127.0.0.1:${STAGING_LOCAL_PORT:-18088}:80"
     volumes:
       - ./nginx/http-only.conf:/etc/nginx/conf.d/default.conf:ro
       - ./logs/nginx-staging:/var/log/nginx

infrastructure/docker-compose.staging.yml

@@ -60,8 +60,8 @@ services:
       context: ../frontend
       dockerfile: Dockerfile
       args:
-        NEXT_PUBLIC_API_URL: ${STAGING_NEXT_PUBLIC_API_URL:-http://178.131.50.201:8088/api}
+        NEXT_PUBLIC_API_URL: ${STAGING_NEXT_PUBLIC_API_URL:-http://wixur.ir/api}
-        NEXT_PUBLIC_APP_URL: ${STAGING_NEXT_PUBLIC_APP_URL:-http://178.131.50.201:8088}
+        NEXT_PUBLIC_APP_URL: ${STAGING_NEXT_PUBLIC_APP_URL:-http://wixur.ir}
         NEXT_PUBLIC_APP_NAME: ${STAGING_NEXT_PUBLIC_APP_NAME:-Dyolink}
     container_name: dyolink_frontend_staging
     depends_on:
@@ -77,7 +77,8 @@ services:
       - dyolink_staging
     restart: unless-stopped
     healthcheck:
-      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:3000/', (r) => {if(r.statusCode!==200)process.exit(1)})"]
+      # Root redirects to /en (next-intl) — accept 2xx/3xx as healthy.
+      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:3000/', (r) => { process.exit(r.statusCode >= 200 && r.statusCode < 400 ? 0 : 1); }).on('error', () => process.exit(1))"]
       interval: 30s
       timeout: 10s
       retries: 3
@@ -87,10 +88,12 @@ services:
     image: nginx:alpine
     container_name: dyolink_nginx_staging
     depends_on:
-      - backend
+      backend:
-      - frontend
+        condition: service_healthy
+      frontend:
+        condition: service_healthy
     ports:
-      - "${STAGING_HTTP_PORT:-8088}:80"
+      - "127.0.0.1:${STAGING_LOCAL_PORT:-18088}:80"
     volumes:
       - ./nginx/http-only.conf:/etc/nginx/conf.d/default.conf:ro
       - ./logs/nginx-staging:/var/log/nginx

infrastructure/env.staging.example

@@ -1,13 +1,13 @@
 # Copy to .env.staging next to docker-compose.staging.yml (optional).
 # Used only for compose variable substitution (build args, host port).
 
-STAGING_HTTP_PORT=8088
+STAGING_HTTP_PORT=80
 
 # Public URLs baked into the frontend image at build time — must match how users open the app.
-STAGING_NEXT_PUBLIC_API_URL=http://178.131.50.201:8088/api
+STAGING_NEXT_PUBLIC_API_URL=http://wixur.ir/api
-STAGING_NEXT_PUBLIC_APP_URL=http://178.131.50.201:8088
+STAGING_NEXT_PUBLIC_APP_URL=http://wixur.ir
 STAGING_NEXT_PUBLIC_APP_NAME=Dyolink
 
-# Change the IP/port if your server address differs.
+# Must match how users open staging (http://wixur.ir).
 
 # Registry / pull-only deploy (see deploy.registry.env.example + docker-compose.registry.yml).

infrastructure/nginx/http-only.conf

@@ -1,15 +1,10 @@
 # HTTP only — local dev and IP-based staging (no TLS).
 # Use with: docker compose and map host port e.g. 8080:80 or 8088:80
+#
+# Dynamic proxy_pass via Docker DNS (127.0.0.11) so nginx starts even if
+# backend/frontend containers are not up yet (static upstream blocks fail at boot).
 
-upstream dyolink_backend {
+resolver 127.0.0.11 valid=10s ipv6=off;
-    server backend:3000;
-    keepalive 32;
-}
-
-upstream dyolink_frontend {
-    server frontend:3000;
-    keepalive 32;
-}
 
 server {
     listen 80;
@@ -19,7 +14,8 @@ server {
     client_max_body_size 50M;
 
     location / {
-        proxy_pass http://dyolink_frontend;
+        set $frontend_upstream http://frontend:3000;
+        proxy_pass $frontend_upstream;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection 'upgrade';
@@ -33,7 +29,8 @@ server {
     }
 
     location /api {
-        proxy_pass http://dyolink_backend;
+        set $backend_upstream http://backend:3000;
+        proxy_pass $backend_upstream;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection 'upgrade';

infrastructure/nginx/windows-edge-http.conf

@@ -0,0 +1,78 @@
+# Windows host nginx.conf — paste over
+#   C:\tools\nginx-1.29.5\conf\nginx.conf
+#
+# :80  — LAN / 127.0.0.1 only (Mobinnet keeps public :80 for the modem)
+# :443 — public https://wixur.ir  (router must forward 443 → this PC)
+#
+# Put Let's Encrypt PEMs in conf\ssl\ (win-acme --pemfilesname wixur):
+#   ssl\wixur-chain.pem
+#   ssl\wixur-key.pem
+#
+# After save: nginx -t   then restart nginx
+#   curl.exe https://wixur.ir/health   →  healthy
+# (curl to 127.0.0.1:443 fails name-check; cert is for wixur.ir)
+
+#user  nobody;
+worker_processes  1;
+
+events {
+    worker_connections  1024;
+}
+
+
+http {
+    include       mime.types;
+    default_type  application/octet-stream;
+
+    sendfile        on;
+    keepalive_timeout  65;
+    client_max_body_size 50M;
+
+    # Shared proxy to Docker staging
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        ''      close;
+    }
+
+    server {
+        listen       80 default_server;
+        listen       [::]:80 default_server;
+        server_name  wixur.ir www.wixur.ir localhost 127.0.0.1;
+
+        location / {
+            proxy_pass http://127.0.0.1:18088;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_read_timeout 300;
+            proxy_connect_timeout 300;
+        }
+    }
+
+    server {
+        listen       443 ssl;
+        listen       [::]:443 ssl;
+        server_name  wixur.ir www.wixur.ir localhost 127.0.0.1;
+
+        ssl_certificate      ssl/wixur-chain.pem;
+        ssl_certificate_key  ssl/wixur-key.pem;
+        ssl_protocols        TLSv1.2 TLSv1.3;
+
+        location / {
+            proxy_pass http://127.0.0.1:18088;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_read_timeout 300;
+            proxy_connect_timeout 300;
+        }
+    }
+}

infrastructure/nginx/windows-ssl-letsencrypt.snippet.conf

@@ -0,0 +1,4 @@
+# After win-acme writes Let's Encrypt PEMs into conf/ssl/:
+#   ssl_certificate      ssl/wixur-chain.pem;
+#   ssl_certificate_key  ssl/wixur-key.pem;
+# (exact filenames: dir C:\tools\nginx-1.29.5\conf\ssl )

infrastructure/scripts/prod-remote-deploy.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Run on the Linux production host (CI SSHs here after pushing :v* images).
+# Usage: ./prod-remote-deploy.sh v1.0.1
+set -euo pipefail
+
+TAG="${1:?usage: prod-remote-deploy.sh v1.0.1}"
+INFRA="${PROD_INFRA_DIR:-/opt/dyolink/infrastructure}"
+cd "$INFRA"
+
+if [ ! -f .env ]; then
+  echo "Missing $INFRA/.env — copy deploy.prod.env.example and set DOMAIN=nudentic.ir REGISTRY_PREFIX=wixur.ir:3000/<owner>"
+  exit 1
+fi
+
+if ! grep -q '^REGISTRY_PREFIX=.\+' .env; then
+  echo "Set REGISTRY_PREFIX in .env (Gitea registry, e.g. wixur.ir:3000/admin). Do not use Docker Hub :latest for tag deploys."
+  exit 1
+fi
+
+export TAG
+echo "Pulling backend/frontend :$TAG from Gitea (REGISTRY_PREFIX in .env)"
+docker compose -f docker-compose.prod.yml --env-file .env pull backend frontend
+docker compose -f docker-compose.prod.yml --env-file .env up -d
+echo "=== Status ==="
+docker compose -f docker-compose.prod.yml --env-file .env ps
+echo "Health: https://nudentic.ir/api/health"

infrastructure/scripts/windows-renew-wixur-cert.cmd

@@ -0,0 +1,11 @@
+@echo off
+REM Run as Administrator. Stops nginx so win-acme can bind 443 (TLS-ALPN),
+REM renews, then starts nginx again. Point the win-acme scheduled task here
+REM instead of calling wacs.exe directly.
+cd /d C:\tools\nginx-1.29.5
+taskkill /F /IM nginx.exe >nul 2>&1
+timeout /t 2 /nobreak >nul
+cd /d C:\tools\win-acme
+wacs.exe --renew --closeonfinish
+cd /d C:\tools\nginx-1.29.5
+start "" nginx.exe