Merge pull request 'improvement: docker infrastructure overhauled.' (#10) from improvement/infrastructure into master

Reviewed-on: http://178.131.50.201:3000/admin/dyolink/pulls/10

.gitea/workflows/registry-build-deploy.yml

@@ -0,0 +1,117 @@
+# Build backend/frontend images, push to Gitea Container Registry, deploy with pull-only compose.
+#
+# Repository Variables (Settings → Actions → Variables) — non-secret:
+#   REGISTRY_HOST        e.g. 178.131.50.201:3000   (no http/https)
+#   REGISTRY_OWNER       Gitea user or org that owns the packages (same as image namespace)
+#   PUBLIC_BASE_URL      URL users open in browser, e.g. http://178.131.50.201:8088  (no trailing slash)
+#
+# Repository Secrets (Settings → Actions → Secrets):
+#   REGISTRY_USERNAME    Gitea username for docker login
+#   REGISTRY_PASSWORD    Gitea access token (packages:read/write) or account password
+#
+# Optional:
+#   STAGING_HTTP_PORT       host port for nginx (default 8088)
+#
+# Required for deploy job (absolute path on the runner host — forward slashes ok on Windows):
+#   DEPLOY_SECRETS_DIR      folder containing database.staging.env + backend.staging.env
+#
+# Runner: self-hosted with Docker; Git Bash recommended on Windows (shell: bash).
+
+name: Registry — build, push, deploy
+
+on:
+  push:
+    branches: [main, master]
+  workflow_dispatch:
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  build-and-push:
+    runs-on: self-hosted
+    outputs:
+      image_tag: ${{ steps.meta.outputs.image_tag }}
+    steps:
+      - name: Checkout
+        uses: https://gitea.com/actions/checkout@v4
+
+      - name: Image tag and registry prefix
+        id: meta
+        run: |
+          echo "image_tag=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
+          echo "REGISTRY_PREFIX=${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}" >> "$GITHUB_ENV"
+
+      - name: Log in to container registry
+        run: |
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${{ vars.REGISTRY_HOST }}" \
+            -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+
+      - name: Build and push backend
+        run: |
+          TAG="${{ steps.meta.outputs.image_tag }}"
+          docker build \
+            -t "${REGISTRY_PREFIX}/dyolink-backend:${TAG}" \
+            -t "${REGISTRY_PREFIX}/dyolink-backend:latest" \
+            ./backend
+          docker push "${REGISTRY_PREFIX}/dyolink-backend:${TAG}"
+          docker push "${REGISTRY_PREFIX}/dyolink-backend:latest"
+
+      - name: Build and push frontend
+        env:
+          PUBLIC_BASE_URL: ${{ vars.PUBLIC_BASE_URL }}
+        run: |
+          TAG="${{ steps.meta.outputs.image_tag }}"
+          docker build \
+            --build-arg NEXT_PUBLIC_API_URL="${PUBLIC_BASE_URL}/api" \
+            --build-arg NEXT_PUBLIC_APP_URL="${PUBLIC_BASE_URL}" \
+            --build-arg NEXT_PUBLIC_APP_NAME="Dyolink" \
+            -t "${REGISTRY_PREFIX}/dyolink-frontend:${TAG}" \
+            -t "${REGISTRY_PREFIX}/dyolink-frontend:latest" \
+            ./frontend
+          docker push "${REGISTRY_PREFIX}/dyolink-frontend:${TAG}"
+          docker push "${REGISTRY_PREFIX}/dyolink-frontend:latest"
+
+  deploy:
+    needs: build-and-push
+    runs-on: self-hosted
+    steps:
+      - name: Checkout infrastructure only
+        uses: https://gitea.com/actions/checkout@v4
+        with:
+          sparse-checkout: |
+            infrastructure
+          sparse-checkout-cone-mode: true
+
+      - name: Write deploy.registry.env and validate secrets path
+        run: |
+          SD='${{ vars.DEPLOY_SECRETS_DIR }}'
+          if [ -z "$SD" ]; then
+            echo "Set repository variable DEPLOY_SECRETS_DIR to the absolute path on this runner"
+            echo "where database.staging.env and backend.staging.env live (not in git)."
+            exit 1
+          fi
+          test -f "${SD}/database.staging.env" || { echo "Missing ${SD}/database.staging.env"; exit 1; }
+          test -f "${SD}/backend.staging.env" || { echo "Missing ${SD}/backend.staging.env"; exit 1; }
+          cd infrastructure
+          STAGING_PORT='${{ vars.STAGING_HTTP_PORT }}'
+          STAGING_PORT="${STAGING_PORT:-8088}"
+          {
+            echo "REGISTRY_PREFIX=${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}"
+            echo "IMAGE_TAG=${{ needs.build-and-push.outputs.image_tag }}"
+            echo "STAGING_HTTP_PORT=${STAGING_PORT}"
+            echo "DEPLOY_SECRETS_DIR=${SD}"
+          } > deploy.registry.env
+
+      - name: Log in to container registry (for pull)
+        run: |
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${{ vars.REGISTRY_HOST }}" \
+            -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+
+      - name: Pull and start stack
+        run: |
+          set -e
+          cd infrastructure
+          docker compose -f docker-compose.registry.yml --env-file deploy.registry.env pull backend frontend
+          docker compose -f docker-compose.registry.yml --env-file deploy.registry.env up -d

.gitignore

@@ -82,8 +82,10 @@ secrets/
 *.db
 *.sqlite3
 
-# === Gitea specific ===
-.gitea/
+# === Gitea specific (keep Actions workflows; ignore other local .gitea noise) ===
+.gitea/*
+!.gitea/workflows
+!.gitea/workflows/**
 
 # Prisma generated files
 prisma/*.db

backend/Dockerfile

@@ -1,92 +1,58 @@
 # ============================================
 # STAGE 1: BUILDER STAGE
 # ============================================
-# This stage builds the application and prepares assets
 FROM node:18-alpine AS builder
 
-# Set working directory
 WORKDIR /app
 
-# Copy package.json and package-lock.json first (for better caching)
 COPY package*.json ./
-
-# Copy Prisma schema (needed for Prisma client generation)
 COPY prisma ./prisma/
 
-# Install ALL dependencies (including dev dependencies for build)
 RUN npm ci
 
-# Copy source code
 COPY . .
 
-# Generate Prisma client
 RUN npx prisma generate
-
-# Build the NestJS application
 RUN npm run build
-
-# Remove development dependencies to reduce size
 RUN npm prune --production
 
 
 # ============================================
 # STAGE 2: PRODUCTION STAGE
 # ============================================
-# This stage creates the final production image
 FROM node:18-alpine
 
-# Install dumb-init for proper signal handling
 RUN apk add --no-cache dumb-init
 
-# Set working directory
 WORKDIR /app
 
-# Create non-root user for security
 RUN addgroup -g 1001 -S nodejs && \
     adduser -S dyolink -u 1001
 
-# Copy package.json files
 COPY package*.json ./
-
-# Copy Prisma schema
 COPY prisma ./prisma/
 
-# Install ONLY production dependencies
 RUN npm ci --only=production && \
     npm cache clean --force
 
-# Generate Prisma client in production
 RUN npx prisma generate
 
-# Copy built application from builder stage
 COPY --from=builder /app/dist ./dist
-
-# Copy node_modules (already pruned)
 COPY --from=builder /app/node_modules ./node_modules
 
-# Create necessary directories with proper permissions
+COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+RUN chmod +x /usr/local/bin/docker-entrypoint.sh
+
 RUN mkdir -p /app/logs && \
     chown -R dyolink:nodejs /app
 
-# Set ownership of all files to non-root user
-RUN chown -R dyolink:nodejs /app
-
-# Switch to non-root user
 USER dyolink
 
-# Expose the application port
 EXPOSE 3000
 
-# Health check configuration
 HEALTHCHECK --interval=30s --timeout=5s --start-period=40s --retries=3 \
-  CMD node -e "require('http').get('http://localhost:3000/api/health', (r) => {if(r.statusCode!==200)throw new Error()})" || exit 1
+  CMD node -e "require('http').get('http://127.0.0.1:3000/api/health', (r) => {if(r.statusCode!==200)process.exit(1)})"
 
-# Copy entrypoint script
-COPY docker-entrypoint.sh /usr/local/bin/
-RUN chmod +x /usr/local/bin/docker-entrypoint.sh
-
-# Use dumb-init to properly handle signals
 ENTRYPOINT ["dumb-init", "--", "docker-entrypoint.sh"]
 
-# Start the application
 CMD ["node", "dist/main"]

backend/docker-entrypoint.sh

@@ -1,76 +1,36 @@
 #!/bin/sh
 set -e
 
-# ============================================
-# DOCKER ENTRYPOINT SCRIPT
-# This script runs BEFORE the application starts
-# ============================================
+echo "=========================================="
+echo "  Dyolink Backend - Docker Entrypoint"
+echo "=========================================="
 
-# Colors for logging (optional, for better readability)
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-NC='\033[0m' # No Color
-
-echo "${GREEN}========================================${NC}"
-echo "${GREEN}  Dyolink Backend - Docker Entrypoint  ${NC}"
-echo "${GREEN}========================================${NC}"
-
-# Check if we're in development or production
 if [ "$NODE_ENV" = "production" ]; then
-    echo "${GREEN}Running in PRODUCTION mode${NC}"
-    
-    # Run database migrations
-    echo "${YELLOW}Running database migrations...${NC}"
+    echo "Running in PRODUCTION mode"
+    echo "Running database migrations..."
     npx prisma migrate deploy
-    
-    # Check if migrations were successful
-    if [ $? -eq 0 ]; then
-        echo "${GREEN}✓ Database migrations completed successfully${NC}"
-    else
-        echo "${RED}✗ Database migrations failed!${NC}"
-        exit 1
-    fi
 else
-    echo "${YELLOW}Running in DEVELOPMENT mode${NC}"
-    
-    # In development, we might want to push schema instead of migrations
-    echo "${YELLOW}Syncing database schema...${NC}"
+    echo "Running in DEVELOPMENT mode"
+    echo "Syncing database schema..."
     npx prisma db push
+fi
 
-    if [ $? -eq 0 ]; then
-        echo "${GREEN}✓ Database schema synced successfully${NC}"
-    else
-        echo "${RED}✗ Database schema sync failed!${NC}"
-        exit 1
+if [ "$NODE_ENV" != "production" ]; then
+    if [ -f "prisma/seed.ts" ] || [ -f "prisma/seed.js" ]; then
+        echo "Running database seed..."
+        npx prisma db seed
     fi
 fi
 
-# Optional: Run seed script if it exists and NODE_ENV is not production
-if [ "$NODE_ENV" != "production" ] && [ -f "prisma/seed.js" ]; then
-    echo "${YELLOW}Running database seed...${NC}"
-    npx prisma db seed
-    echo "${GREEN}✓ Database seeded successfully${NC}"
-fi
-
-# Verify database connection
-echo "${YELLOW}Verifying database connection...${NC}"
-npx prisma db execute --file /dev/null --schema prisma/schema.prisma 2>/dev/null
-
-if [ $? -eq 0 ]; then
-    echo "${GREEN}✓ Database connection verified${NC}"
-else
-    echo "${RED}✗ Cannot connect to database!${NC}"
+echo "Verifying database connection..."
+if ! echo "SELECT 1" | npx prisma db execute --stdin --schema prisma/schema.prisma >/dev/null 2>&1; then
+    echo "Cannot connect to database or execute query."
     exit 1
 fi
+echo "Database connection OK"
 
-# Print application information
-echo "${GREEN}========================================${NC}"
-echo "${GREEN}Starting Dyolink Backend Application...${NC}"
-echo "${GREEN}  • Environment: ${NODE_ENV:-development}${NC}"
-echo "${GREEN}  • Port: ${PORT:-3000}${NC}"
-echo "${GREEN}  • Database: ${DATABASE_URL%%@*}@***${NC}"
-echo "${GREEN}========================================${NC}"
+echo "Starting Dyolink Backend..."
+echo "  Environment: ${NODE_ENV:-development}"
+echo "  Port: ${PORT:-3000}"
 
-# Execute the main command (passed as CMD)
 exec "$@"

backend/prisma/migrations/20260430184000_add_treatment_permissions/migration.sql

@@ -0,0 +1,24 @@
+-- Ensure Treatment feature and permissions exist for existing databases.
+WITH treatment_feature AS (
+  INSERT INTO "features" ("id", "name")
+  VALUES (md5(random()::text || clock_timestamp()::text), 'Treatment')
+  ON CONFLICT ("name") DO UPDATE SET "name" = EXCLUDED."name"
+  RETURNING "id"
+),
+selected_feature AS (
+  SELECT "id" FROM treatment_feature
+  UNION ALL
+  SELECT f."id" FROM "features" f WHERE f."name" = 'Treatment' LIMIT 1
+)
+INSERT INTO "permissions" ("id", "name", "featureId")
+SELECT md5(random()::text || clock_timestamp()::text), 'TAB_TREATMENT_READ', sf."id"
+FROM selected_feature sf
+ON CONFLICT ("name") DO NOTHING;
+
+WITH treatment_feature AS (
+  SELECT "id" FROM "features" WHERE "name" = 'Treatment' LIMIT 1
+)
+INSERT INTO "permissions" ("id", "name", "featureId")
+SELECT md5(random()::text || clock_timestamp()::text), 'TAB_TREATMENT_EDIT', tf."id"
+FROM treatment_feature tf
+ON CONFLICT ("name") DO NOTHING;

backend/prisma/seed.ts

@@ -69,21 +69,25 @@ async function main() {
       name: 'Today',
       permissions: ['TAB_TODAY_READ', 'TAB_TODAY_EDIT'],
     },
+    {
+      name: 'Staff',
+      permissions: ['TAB_STAFF_READ', 'TAB_STAFF_EDIT'],
+    },
+    {
+      name: 'Labs / Clinics',
+      permissions: ['TAB_LAB_READ', 'TAB_LAB_EDIT'],
+    },
     {
       name: 'Patients',
       permissions: ['TAB_PATIENTS_READ', 'TAB_PATIENTS_EDIT'],
     },
     {
-      name: 'Appointments',
+      name: 'Appointment',
       permissions: ['TAB_APPOINTMENTS_READ', 'TAB_APPOINTMENTS_EDIT'],
     },
     {
-      name: 'Staff Management',
-      permissions: ['TAB_STAFF_READ', 'TAB_STAFF_EDIT'],
-    },
-    {
-      name: 'Lab Management',
-      permissions: ['TAB_LAB_READ', 'TAB_LAB_EDIT'],
+      name: 'Treatment',
+      permissions: ['TAB_TREATMENT_READ', 'TAB_TREATMENT_EDIT'],
     },
     {
       name: 'Billing',

backend/src/app.controller.ts

@@ -22,4 +22,13 @@ export class AppController {
   getHello(): string {
     return this.appService.getHello();
   }
+
+  /** Used by Docker / load balancer health checks (GET /api/health) */
+  @Get('health')
+  health() {
+    return {
+      status: 'ok',
+      timestamp: new Date().toISOString(),
+    };
+  }
 }

backend/src/common/permissions.ts

@@ -2,14 +2,16 @@
 export const ALL_TAB_PERMISSIONS = [
   'TAB_TODAY_READ',
   'TAB_TODAY_EDIT',
-  'TAB_PATIENTS_READ',
-  'TAB_PATIENTS_EDIT',
-  'TAB_APPOINTMENTS_READ',
-  'TAB_APPOINTMENTS_EDIT',
   'TAB_STAFF_READ',
   'TAB_STAFF_EDIT',
   'TAB_LAB_READ',
   'TAB_LAB_EDIT',
+  'TAB_PATIENTS_READ',
+  'TAB_PATIENTS_EDIT',
+  'TAB_APPOINTMENTS_READ',
+  'TAB_APPOINTMENTS_EDIT',
+  'TAB_TREATMENT_READ',
+  'TAB_TREATMENT_EDIT',
   'TAB_BILLING_READ',
   'TAB_BILLING_EDIT',
   'TAB_REPORTS_READ',
@@ -37,6 +39,7 @@ const EDIT_TO_READ: Record<string, string> = {
   TAB_APPOINTMENTS_EDIT: 'TAB_APPOINTMENTS_READ',
   TAB_STAFF_EDIT: 'TAB_STAFF_READ',
   TAB_LAB_EDIT: 'TAB_LAB_READ',
+  TAB_TREATMENT_EDIT: 'TAB_TREATMENT_READ',
   TAB_BILLING_EDIT: 'TAB_BILLING_READ',
   TAB_REPORTS_EDIT: 'TAB_REPORTS_READ',
 };

backend/src/modules/auth/auth.service.ts

@@ -18,14 +18,16 @@ import { JwtPayload } from './interfaces/jwt-payload.interface';
 const ALL_PERMISSIONS = [
   'TAB_TODAY_READ',
   'TAB_TODAY_EDIT',
-  'TAB_PATIENTS_READ',
-  'TAB_PATIENTS_EDIT',
-  'TAB_APPOINTMENTS_READ',
-  'TAB_APPOINTMENTS_EDIT',
   'TAB_STAFF_READ',
   'TAB_STAFF_EDIT',
   'TAB_LAB_READ',
   'TAB_LAB_EDIT',
+  'TAB_PATIENTS_READ',
+  'TAB_PATIENTS_EDIT',
+  'TAB_APPOINTMENTS_READ',
+  'TAB_APPOINTMENTS_EDIT',
+  'TAB_TREATMENT_READ',
+  'TAB_TREATMENT_EDIT',
   'TAB_BILLING_READ',
   'TAB_BILLING_EDIT',
   'TAB_REPORTS_READ',
@@ -34,10 +36,11 @@ const ALL_PERMISSIONS = [
 
 const READ_ONLY_PERMISSIONS = [
   'TAB_TODAY_READ',
-  'TAB_PATIENTS_READ',
-  'TAB_APPOINTMENTS_READ',
   'TAB_STAFF_READ',
   'TAB_LAB_READ',
+  'TAB_PATIENTS_READ',
+  'TAB_APPOINTMENTS_READ',
+  'TAB_TREATMENT_READ',
   'TAB_BILLING_READ',
   'TAB_REPORTS_READ',
 ];

frontend/Dockerfile

@@ -1,72 +1,53 @@
-# Build stage
+# Build stage — produces `.next/standalone` (see next.config.ts output: standalone)
 FROM node:18-alpine AS builder
 
 WORKDIR /app
 
-# Copy package files
 COPY package*.json ./
 RUN npm ci
 
-# Copy source code
 COPY . .
 
-# Set build-time environment variables
+ARG NEXT_PUBLIC_API_URL
+ARG NEXT_PUBLIC_APP_URL
+ARG NEXT_PUBLIC_APP_NAME
+
 ENV NEXT_TELEMETRY_DISABLED=1
 ENV NODE_ENV=production
+ENV NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL}
+ENV NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL}
+ENV NEXT_PUBLIC_APP_NAME=${NEXT_PUBLIC_APP_NAME}
 
-# Build Next.js application
 RUN npm run build
 
-# Production stage
-FROM node:18-alpine
+# Production — minimal runtime using Next.js standalone bundle
+FROM node:18-alpine AS runner
+
+RUN apk add --no-cache dumb-init
 
 WORKDIR /app
 
-# Install dumb-init for proper signal handling
-RUN apk add --no-cache dumb-init
-
-# Create non-root user
 RUN addgroup -g 1001 -S nodejs && \
     adduser -S dyolink -u 1001
 
-# Copy package files
-COPY package*.json ./
+ENV NODE_ENV=production
+ENV PORT=3000
+ENV HOSTNAME=0.0.0.0
 
-# Install production dependencies only
-RUN npm ci --only=production && \
-    npm cache clean --force
-
-# Copy built application
-COPY --from=builder /app/.next ./.next
 COPY --from=builder /app/public ./public
-COPY --from=builder /app/next.config.js ./next.config.js
-COPY --from=builder /app/package.json ./package.json
+COPY --from=builder --chown=dyolink:nodejs /app/.next/standalone ./
+COPY --from=builder --chown=dyolink:nodejs /app/.next/static ./.next/static
 
-# Create logs directory
-RUN mkdir -p /app/logs && \
-    chown -R dyolink:nodejs /app
+COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+RUN chmod +x /usr/local/bin/docker-entrypoint.sh
 
-# Set ownership
-RUN chown -R dyolink:nodejs /app
-
-# Switch to non-root user
 USER dyolink
 
-# Health check
-HEALTHCHECK --interval=30s --timeout=5s --start-period=40s --retries=3 \
-  CMD node -e "require('http').get('http://localhost:3000', (r) => {if(r.statusCode!==200)throw new Error()})" || exit 1
-
 EXPOSE 3000
 
-ENV PORT=3000
-ENV HOSTNAME="0.0.0.0"
-ENV NODE_ENV=production
+HEALTHCHECK --interval=30s --timeout=5s --start-period=40s --retries=3 \
+  CMD node -e "require('http').get('http://127.0.0.1:3000/', (r) => {if(r.statusCode!==200)process.exit(1)})"
 
-# Copy entrypoint script
-COPY docker-entrypoint.sh /usr/local/bin/
-RUN chmod +x /usr/local/bin/docker-entrypoint.sh
-
-# Use dumb-init for signal handling
 ENTRYPOINT ["dumb-init", "--", "docker-entrypoint.sh"]
 
-CMD ["npm", "start"]
+CMD ["node", "server.js"]

frontend/next.config.ts

@@ -1,6 +1,17 @@
 import type { NextConfig } from "next";
 
-// frontend/next.config.js
+function publicAppHostname(): string | null {
+  const url = process.env.NEXT_PUBLIC_APP_URL;
+  if (!url) return null;
+  try {
+    return new URL(url).hostname;
+  } catch {
+    return null;
+  }
+}
+
+const appHost = publicAppHostname();
+
 /** @type {import('next').NextConfig} */
 const nextConfig = {
   // Enable React strict mode
@@ -9,12 +20,19 @@ const nextConfig = {
   // Disable x-powered-by header for security
   poweredByHeader: false,
   
-  // Configure allowed remote image sources
+  // Configure allowed remote image sources (hostname derived from NEXT_PUBLIC_APP_URL at build time)
   images: {
-    remotePatterns:
-      process.env.NODE_ENV === 'production'
-        ? [{ protocol: 'https', hostname: 'yourdomain.com' }]
-        : [{ protocol: 'http', hostname: 'localhost' }],
+    remotePatterns: [
+      { protocol: "http", hostname: "localhost" },
+      ...(appHost
+        ? [
+            { protocol: "http" as const, hostname: appHost },
+            { protocol: "https" as const, hostname: appHost },
+          ]
+        : []),
+      { protocol: "https", hostname: "dyolink.com" },
+      { protocol: "https", hostname: "www.dyolink.com" },
+    ],
   },
   
   // Environment variables that will be available at build time

frontend/package.json

@@ -5,7 +5,7 @@
   "scripts": {
     "dev": "next dev -p 3001",
     "build": "next build",
-    "start": "next start -p 3001",
+    "start": "next start -p 3000",
     "lint": "next lint"
   },
   "dependencies": {

frontend/src/app/(dashboard)/staff/components/staffPermissions.ts

@@ -1,10 +1,11 @@
 /** Feature groups for staff invite/edit UI — matches backend seed */
 export const STAFF_FEATURE_GROUPS = [
   { label: 'Today', read: 'TAB_TODAY_READ', edit: 'TAB_TODAY_EDIT' },
+  { label: 'Staff', read: 'TAB_STAFF_READ', edit: 'TAB_STAFF_EDIT' },
+  { label: 'Labs / Clinics', read: 'TAB_LAB_READ', edit: 'TAB_LAB_EDIT' },
   { label: 'Patients', read: 'TAB_PATIENTS_READ', edit: 'TAB_PATIENTS_EDIT' },
-  { label: 'Appointments', read: 'TAB_APPOINTMENTS_READ', edit: 'TAB_APPOINTMENTS_EDIT' },
-  { label: 'Staff Management', read: 'TAB_STAFF_READ', edit: 'TAB_STAFF_EDIT' },
-  { label: 'Lab Management', read: 'TAB_LAB_READ', edit: 'TAB_LAB_EDIT' },
+  { label: 'Appointment', read: 'TAB_APPOINTMENTS_READ', edit: 'TAB_APPOINTMENTS_EDIT' },
+  { label: 'Treatment', read: 'TAB_TREATMENT_READ', edit: 'TAB_TREATMENT_EDIT' },
   { label: 'Billing', read: 'TAB_BILLING_READ', edit: 'TAB_BILLING_EDIT' },
   { label: 'Reports', read: 'TAB_REPORTS_READ', edit: 'TAB_REPORTS_EDIT' },
 ] as const;

frontend/src/app/(dashboard)/staff/page.tsx

@@ -12,6 +12,7 @@ import {
   permissionNamesFromFeatureState,
   emptyFeaturePermissionState,
   featureStateFromPermissionNames,
+  resolveStaffFeatureLabel,
   formatAccessSummary,
   type FeaturePermState,
 } from './staff-permission-form';
@@ -23,6 +24,33 @@ import { Input } from '@/components/ui/common/Input';
 import { Checkbox } from '@/components/ui/common/Checkbox';
 import type { ApiError } from '@/types/api';
 
+type StoredInviteLink = {
+  membershipId: string;
+  email: string;
+  invitationUrl: string;
+};
+
+function inviteLinksStorageKey(orgId: string): string {
+  return `staffInviteLinks:${orgId}`;
+}
+
+function readStoredInviteLinks(orgId: string): Record<string, StoredInviteLink> {
+  if (typeof window === 'undefined') return {};
+  try {
+    const raw = window.localStorage.getItem(inviteLinksStorageKey(orgId));
+    if (!raw) return {};
+    const parsed = JSON.parse(raw) as Record<string, StoredInviteLink>;
+    return parsed && typeof parsed === 'object' ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+function writeStoredInviteLinks(orgId: string, links: Record<string, StoredInviteLink>) {
+  if (typeof window === 'undefined') return;
+  window.localStorage.setItem(inviteLinksStorageKey(orgId), JSON.stringify(links));
+}
+
 function formatApiMessage(err: unknown): string {
   if (!err || typeof err !== 'object') return 'Something went wrong';
   const m = (err as ApiError).message;
@@ -35,10 +63,12 @@ function PermissionGrid({
   state,
   onChange,
   disabled,
+  organizationType,
 }: {
   state: FeaturePermState;
   onChange: (next: FeaturePermState) => void;
   disabled?: boolean;
+  organizationType?: 'CLINIC' | 'LAB';
 }) {
   const setRead = (editKey: string, read: boolean) => {
     const cur = state[editKey] ?? { read: false, edit: false };
@@ -65,7 +95,9 @@ function PermissionGrid({
             key={g.edit}
             className="flex flex-col gap-3 rounded-[var(--radius-md)] border border-border/60 bg-background-card/50 px-3 py-3"
           >
-            <span className="text-sm font-medium text-text-primary">{g.label}</span>
+            <span className="text-sm font-medium text-text-primary">
+              {resolveStaffFeatureLabel(g, organizationType)}
+            </span>
             <div className="flex flex-col gap-2.5 pl-0.5">
               <Checkbox
                 checked={cell.read}
@@ -105,13 +137,15 @@ export default function StaffPage() {
   const [inviteName, setInviteName] = useState('');
   const [invitePerms, setInvitePerms] = useState(() => emptyFeaturePermissionState());
   const [inviteLoading, setInviteLoading] = useState(false);
-  const [copiedInviteLink, setCopiedInviteLink] = useState(false);
+  const [copiedInviteMembershipId, setCopiedInviteMembershipId] = useState<string | null>(null);
   const [lastInviteInfo, setLastInviteInfo] = useState<{
+    membershipId: string;
     name: string;
     email: string;
     invitationUrl: string | null;
     invitationStatus: 'PENDING' | 'ACCEPTED';
   } | null>(null);
+  const [pendingInviteLinks, setPendingInviteLinks] = useState<Record<string, StoredInviteLink>>({});
 
   const [editing, setEditing] = useState<StaffMemberDto | null>(null);
   const [editName, setEditName] = useState('');
@@ -140,6 +174,34 @@ export default function StaffPage() {
     }
   }, []);
 
+  useEffect(() => {
+    if (!currentOrganization?.id) return;
+    setPendingInviteLinks(readStoredInviteLinks(currentOrganization.id));
+  }, [currentOrganization?.id]);
+
+  useEffect(() => {
+    if (!currentOrganization?.id || loading) return;
+
+    const activeMemberIds = new Set(
+      members
+        .filter((m) => m.isOwner || m.invitationStatus === 'ACTIVE')
+        .map((m) => m.id),
+    );
+
+    let changed = false;
+    const nextLinks: Record<string, StoredInviteLink> = { ...pendingInviteLinks };
+    for (const memberId of Object.keys(nextLinks)) {
+      if (activeMemberIds.has(memberId)) {
+        delete nextLinks[memberId];
+        changed = true;
+      }
+    }
+    if (!changed) return;
+
+    setPendingInviteLinks(nextLinks);
+    writeStoredInviteLinks(currentOrganization.id, nextLinks);
+  }, [currentOrganization?.id, loading, members, pendingInviteLinks]);
+
   useEffect(() => {
     void load();
   }, [load]);
@@ -171,11 +233,24 @@ export default function StaffPage() {
         permissionNames,
       });
       setLastInviteInfo({
+        membershipId: res.data.membershipId,
         name: displayName,
         email: res.data.email,
         invitationUrl: res.data.invitationUrl,
         invitationStatus: res.data.invitationStatus,
       });
+      if (currentOrganization?.id && res.data.invitationUrl) {
+        const nextLinks = {
+          ...pendingInviteLinks,
+          [res.data.membershipId]: {
+            membershipId: res.data.membershipId,
+            email: res.data.email,
+            invitationUrl: res.data.invitationUrl,
+          },
+        };
+        setPendingInviteLinks(nextLinks);
+        writeStoredInviteLinks(currentOrganization.id, nextLinks);
+      }
       setSuccess('');
       setInviteOpen(false);
       setInviteEmail('');
@@ -328,15 +403,21 @@ export default function StaffPage() {
                   onClick={async () => {
                     try {
                       await navigator.clipboard.writeText(lastInviteInfo.invitationUrl as string);
-                      setCopiedInviteLink(true);
-                      setTimeout(() => setCopiedInviteLink(false), 1500);
+                      setCopiedInviteMembershipId(lastInviteInfo.membershipId);
+                      setTimeout(() => setCopiedInviteMembershipId(null), 1500);
                     } catch {
                       setError('Could not copy invitation link');
                     }
                   }}
                 >
-                  {copiedInviteLink ? <Check className="w-4 h-4" /> : <Copy className="w-4 h-4" />}
-                  <span className="ml-1">{copiedInviteLink ? 'Copied' : 'Copy link'}</span>
+                  {copiedInviteMembershipId === lastInviteInfo.membershipId ? (
+                    <Check className="w-4 h-4" />
+                  ) : (
+                    <Copy className="w-4 h-4" />
+                  )}
+                  <span className="ml-1">
+                    {copiedInviteMembershipId === lastInviteInfo.membershipId ? 'Copied' : 'Copy link'}
+                  </span>
                 </Button>
               </div>
               <p className="text-xs text-text-muted">
@@ -364,7 +445,7 @@ export default function StaffPage() {
             </thead>
             <tbody>
               {members.map((m) => (
-                <tr key={m.id} className="border-b border-border/40 last:border-0">
+                <tr key={m.id} className="h-14 border-b border-border/40 last:border-0">
                   <td className="p-3 text-text-primary">{m.name}</td>
                   <td className="p-3 text-text-secondary">{m.email}</td>
                   <td className="p-3">
@@ -374,7 +455,7 @@ export default function StaffPage() {
                       <span className="text-text-secondary">Staff</span>
                     )}
                   </td>
-                  <td className="p-3">
+                  <td className="p-3 align-middle">
                     {m.isOwner || m.invitationStatus === 'ACTIVE' ? (
                       <span className="inline-flex items-center rounded-full border border-emerald-600/40 bg-emerald-600/15 px-2 py-0.5 text-xs text-emerald-400">
                         Active
@@ -395,13 +476,36 @@ export default function StaffPage() {
                       <span className="text-text-muted">All features</span>
                     ) : (
                       <span className="line-clamp-3 text-sm leading-relaxed">
-                        {formatAccessSummary(m.permissions)}
+                        {formatAccessSummary(m.permissions, currentOrganization?.type)}
                       </span>
                     )}
                   </td>
-                  <td className="p-3">
+                  <td className="p-3 align-middle">
                     {!m.isOwner && (
-                      <div className="flex items-center gap-1">
+                      <div className="flex min-h-[36px] items-center justify-end gap-1">
+                        {m.invitationStatus === 'PENDING' && pendingInviteLinks[m.id]?.invitationUrl && (
+                          <button
+                            type="button"
+                            className="p-2 rounded-md text-text-secondary hover:bg-background-card/80 hover:text-text-primary"
+                            onClick={async () => {
+                              try {
+                                await navigator.clipboard.writeText(pendingInviteLinks[m.id].invitationUrl);
+                                setCopiedInviteMembershipId(m.id);
+                                setTimeout(() => setCopiedInviteMembershipId(null), 1500);
+                              } catch {
+                                setError('Could not copy invitation link');
+                              }
+                            }}
+                            aria-label="Copy invite link"
+                            title="Copy invite link"
+                          >
+                            {copiedInviteMembershipId === m.id ? (
+                              <Check className="w-4 h-4" />
+                            ) : (
+                              <Copy className="w-4 h-4" />
+                            )}
+                          </button>
+                        )}
                         <button
                           type="button"
                           className={`p-2 rounded-md ${
@@ -469,7 +573,11 @@ export default function StaffPage() {
             />
             <div>
               <p className="text-sm font-medium text-text-secondary mb-2">Tab access</p>
-              <PermissionGrid state={invitePerms} onChange={setInvitePerms} />
+              <PermissionGrid
+                state={invitePerms}
+                onChange={setInvitePerms}
+                organizationType={currentOrganization?.type}
+              />
             </div>
             <div className="flex justify-end gap-2 pt-2">
               <Button variant="outline" type="button" onClick={() => setInviteOpen(false)}>
@@ -500,7 +608,11 @@ export default function StaffPage() {
             <Input label="Display name" value={editName} onChange={(e) => setEditName(e.target.value)} />
             <div>
               <p className="text-sm font-medium text-text-secondary mb-2">Tab access</p>
-              <PermissionGrid state={editPerms} onChange={setEditPerms} />
+              <PermissionGrid
+                state={editPerms}
+                onChange={setEditPerms}
+                organizationType={currentOrganization?.type}
+              />
             </div>
             <div className="flex justify-end gap-2 pt-2">
               <Button variant="outline" type="button" onClick={() => setEditing(null)}>

frontend/src/app/(dashboard)/staff/staff-permission-form.ts

@@ -5,15 +5,27 @@
 
 export const STAFF_FEATURE_GROUPS = [
   { label: 'Today', read: 'TAB_TODAY_READ', edit: 'TAB_TODAY_EDIT' },
+  { label: 'Staff', read: 'TAB_STAFF_READ', edit: 'TAB_STAFF_EDIT' },
+  { label: 'Labs', read: 'TAB_LAB_READ', edit: 'TAB_LAB_EDIT' },
   { label: 'Patients', read: 'TAB_PATIENTS_READ', edit: 'TAB_PATIENTS_EDIT' },
-  { label: 'Appointments', read: 'TAB_APPOINTMENTS_READ', edit: 'TAB_APPOINTMENTS_EDIT' },
-  { label: 'Staff Management', read: 'TAB_STAFF_READ', edit: 'TAB_STAFF_EDIT' },
-  { label: 'Lab Management', read: 'TAB_LAB_READ', edit: 'TAB_LAB_EDIT' },
+  { label: 'Appointment', read: 'TAB_APPOINTMENTS_READ', edit: 'TAB_APPOINTMENTS_EDIT' },
+  { label: 'Treatment', read: 'TAB_TREATMENT_READ', edit: 'TAB_TREATMENT_EDIT' },
   { label: 'Billing', read: 'TAB_BILLING_READ', edit: 'TAB_BILLING_EDIT' },
   { label: 'Reports', read: 'TAB_REPORTS_READ', edit: 'TAB_REPORTS_EDIT' },
 ] as const;
 
 export type FeaturePermState = Record<string, { read: boolean; edit: boolean }>;
+export type OrgType = 'CLINIC' | 'LAB' | null | undefined;
+
+export function resolveStaffFeatureLabel(
+  group: (typeof STAFF_FEATURE_GROUPS)[number],
+  organizationType: OrgType,
+): string {
+  if (group.read === 'TAB_LAB_READ') {
+    return organizationType === 'LAB' ? 'Clinics' : 'Labs';
+  }
+  return group.label;
+}
 
 export function emptyFeaturePermissionState(): FeaturePermState {
   const s: FeaturePermState = {};
@@ -46,7 +58,10 @@ export function permissionNamesFromFeatureState(state: FeaturePermState): string
 }
 
 /** Human-readable access for the team table — feature name, or "Feature (Read only)" */
-export function formatAccessSummary(permissionNames: string[] | null | undefined): string {
+export function formatAccessSummary(
+  permissionNames: string[] | null | undefined,
+  organizationType?: OrgType,
+): string {
   if (!permissionNames?.length) return 'No tab access';
   const set = new Set(permissionNames);
   const parts: string[] = [];
@@ -54,7 +69,8 @@ export function formatAccessSummary(permissionNames: string[] | null | undefined
     const hasEdit = set.has(g.edit);
     const hasRead = set.has(g.read) || hasEdit;
     if (!hasRead) continue;
-    parts.push(hasEdit ? g.label : `${g.label} (Read only)`);
+    const label = resolveStaffFeatureLabel(g, organizationType);
+    parts.push(hasEdit ? label : `${label} (Read only)`);
   }
   return parts.length ? parts.join(' · ') : 'No tab access';
 }

frontend/src/app/(dashboard)/treatment/page.tsx

@@ -0,0 +1,10 @@
+export default function TreatmentPage() {
+  return (
+    <div className="space-y-3">
+      <h1 className="text-2xl font-semibold text-text-primary">Treatment</h1>
+      <p className="text-sm text-text-secondary">
+        Treatment module is coming soon.
+      </p>
+    </div>
+  );
+}

frontend/src/components/ui/common/Sidebar.tsx

@@ -17,10 +17,10 @@ import { canViewTab } from '@/shared/permissions';
 
 const menu = [
   { name: 'Today', path: '/today', icon: LayoutDashboard, read: 'TAB_TODAY_READ' as const },
+  { name: 'Staff', path: '/staff', icon: UserCog, read: 'TAB_STAFF_READ' as const },
   { name: 'Patients', path: '/patients', icon: Users, read: 'TAB_PATIENTS_READ' as const },
-  { name: 'Appointments', path: '/appointments', icon: Calendar, read: 'TAB_APPOINTMENTS_READ' as const },
-  { name: 'Staff Management', path: '/staff', icon: UserCog, read: 'TAB_STAFF_READ' as const },
-  { name: 'Lab Management', path: '/lab', icon: FlaskConical, read: 'TAB_LAB_READ' as const },
+  { name: 'Appointment', path: '/appointments', icon: Calendar, read: 'TAB_APPOINTMENTS_READ' as const },
+  { name: 'Treatment', path: '/treatment', icon: FlaskConical, read: 'TAB_TREATMENT_READ' as const },
   { name: 'Billing', path: '/billing', icon: CreditCard, read: 'TAB_BILLING_READ' as const },
   { name: 'Reports', path: '/reports', icon: FileText, read: 'TAB_REPORTS_READ' as const },
 ];
@@ -28,10 +28,23 @@ const menu = [
 function Sidebar() {
   const pathname = usePathname();
   const { currentOrganization } = useAuth();
+  const counterpartLabel = currentOrganization?.type === 'LAB' ? 'Clinics' : 'Labs';
 
   const visibleMenu = useMemo(
-    () => menu.filter((item) => canViewTab(currentOrganization, item.read)),
-    [currentOrganization],
+    () => {
+      const withCounterpartTab = [
+        menu[0],
+        menu[1],
+        { name: counterpartLabel, path: '/lab', icon: FlaskConical, read: 'TAB_LAB_READ' as const },
+        menu[2],
+        menu[3],
+        menu[4],
+        menu[5],
+        menu[6],
+      ];
+      return withCounterpartTab.filter((item) => canViewTab(currentOrganization, item.read));
+    },
+    [counterpartLabel, currentOrganization],
   );
 
   return (

frontend/src/shared/permissions.ts

@@ -2,10 +2,11 @@ import type { Organization } from '@/types/organization';
 
 const ROUTE_TAB_READ: { prefix: string; permission: string }[] = [
   { prefix: '/today', permission: 'TAB_TODAY_READ' },
-  { prefix: '/patients', permission: 'TAB_PATIENTS_READ' },
-  { prefix: '/appointments', permission: 'TAB_APPOINTMENTS_READ' },
   { prefix: '/staff', permission: 'TAB_STAFF_READ' },
   { prefix: '/lab', permission: 'TAB_LAB_READ' },
+  { prefix: '/patients', permission: 'TAB_PATIENTS_READ' },
+  { prefix: '/appointments', permission: 'TAB_APPOINTMENTS_READ' },
+  { prefix: '/treatment', permission: 'TAB_TREATMENT_READ' },
   { prefix: '/billing', permission: 'TAB_BILLING_READ' },
   { prefix: '/reports', permission: 'TAB_REPORTS_READ' },
 ];

infrastructure/.env.example

@@ -20,3 +20,6 @@ DOMAIN=dyolink.com
 # NEXT_PUBLIC_API_URL=/api
 # NEXT_PUBLIC_APP_NAME=Dyolink
 # NEXT_PUBLIC_APP_URL=https://dyolink.com
+
+# --- Staging on your server (docker-compose.staging.yml) ---
+# See env.staging.example, database.staging.env.example, backend.staging.env.example

infrastructure/backend.staging.env.example

@@ -0,0 +1,12 @@
+# Copy to backend.staging.env — DATABASE_URL must match database.staging.env credentials.
+NODE_ENV=production
+PORT=3000
+
+DATABASE_URL=postgresql://postgres:changeme_staging_strong_password@postgres:5432/dyolink_db
+
+JWT_SECRET=replace_with_a_long_random_secret
+JWT_EXPIRES_IN=15m
+JWT_REFRESH_SECRET=another_long_random_secret_different_from_JWT_SECRET
+JWT_REFRESH_EXPIRES_IN=30d
+
+FRONTEND_URL=http://178.131.50.201:8088

infrastructure/database.staging.env.example

@@ -0,0 +1,4 @@
+# Copy to database.staging.env (do not commit real passwords).
+POSTGRES_USER=postgres
+POSTGRES_PASSWORD=changeme_staging_strong_password
+POSTGRES_DB=dyolink_db

infrastructure/deploy.registry.env.example

@@ -0,0 +1,19 @@
+# Template for manual pull-only deploy (when not using CI-generated deploy.registry.env).
+# CI workflow generates this file automatically; you normally only need secrets on disk.
+#
+# docker compose -f docker-compose.registry.yml --env-file deploy.registry.env up -d
+
+# --- Registry boundary (swap when moving Gitea → Docker Hub) ---
+# Gitea:  REGISTRY_PREFIX = <host>:<port>/<owner>
+# Hub:    REGISTRY_PREFIX = docker.io/<user>   (or your username for implicit hub)
+REGISTRY_PREFIX=178.131.50.201:3000/yourgiteauser
+
+# Short git SHA from CI, or "latest" after a manual pull of :latest
+IMAGE_TAG=latest
+
+# Host port published for nginx (URL = http://<your-ip>:<this-port>)
+STAGING_HTTP_PORT=8088
+
+# Absolute path on the server where database.staging.env and backend.staging.env live.
+# Use forward slashes on Windows. Same variable as Gitea Actions → DEPLOY_SECRETS_DIR.
+# DEPLOY_SECRETS_DIR=D:/dyolink/secrets

infrastructure/docker-compose.prod.yml

@@ -53,7 +53,7 @@ services:
         max-size: "10m"
         max-file: "3"
     healthcheck:
-      test: ["CMD", "node", "-e", "require('http').get('http://localhost:3000/api/health', (r) => {if(r.statusCode!==200)process.exit(1)})"]
+      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:3000/api/health', (r) => {if(r.statusCode!==200)process.exit(1)})"]
       interval: 30s
       timeout: 10s
       retries: 3
@@ -81,7 +81,7 @@ services:
         max-size: "10m"
         max-file: "3"
     healthcheck:
-      test: ["CMD", "node", "-e", "require('http').get('http://localhost:3000', (r) => {if(r.statusCode!==200)process.exit(1)})"]
+      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:3000/', (r) => {if(r.statusCode!==200)process.exit(1)})"]
       interval: 30s
       timeout: 10s
       retries: 3

infrastructure/docker-compose.registry.yml

@@ -0,0 +1,105 @@
+# Pull-only staging stack — uses images from a registry (Gitea Packages / Docker Hub / etc.).
+# No backend/frontend source on the deployment host except this compose file + config + secrets.
+#
+# Required env (see deploy.registry.env.example):
+#   REGISTRY_PREFIX   e.g. 178.131.50.201:3000/yourgiteauser  (no protocol, no trailing slash)
+#   IMAGE_TAG         short sha or "latest" (CI sets this per deploy)
+# Optional:
+#   DEPLOY_SECRETS_DIR   absolute path on the server to database/backend *.env files (see below)
+#
+# Deploy:
+#   docker compose -f docker-compose.registry.yml --env-file deploy.registry.env pull
+#   docker compose -f docker-compose.registry.yml --env-file deploy.registry.env up -d
+
+name: dyolink-registry
+
+services:
+  postgres:
+    image: postgres:15-alpine
+    container_name: dyolink_postgres_staging
+    env_file:
+      - ${DEPLOY_SECRETS_DIR:-.}/database.staging.env
+    environment:
+      TZ: UTC
+    volumes:
+      - postgres_data_staging:/var/lib/postgresql/data
+      - ./database/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
+      - ./database/backups:/backups
+    networks:
+      - dyolink_staging
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER"]
+      interval: 15s
+      timeout: 10s
+      retries: 5
+      start_period: 40s
+
+  backend:
+    image: ${REGISTRY_PREFIX}/dyolink-backend:${IMAGE_TAG:-latest}
+    container_name: dyolink_backend_staging
+    depends_on:
+      postgres:
+        condition: service_healthy
+    env_file:
+      - ${DEPLOY_SECRETS_DIR:-.}/backend.staging.env
+    environment:
+      NODE_ENV: production
+      TZ: UTC
+      PORT: "3000"
+    expose:
+      - "3000"
+    networks:
+      - dyolink_staging
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:3000/api/health', (r) => {if(r.statusCode!==200)process.exit(1)})"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 60s
+
+  frontend:
+    image: ${REGISTRY_PREFIX}/dyolink-frontend:${IMAGE_TAG:-latest}
+    container_name: dyolink_frontend_staging
+    depends_on:
+      - backend
+    environment:
+      NODE_ENV: production
+      TZ: UTC
+      PORT: "3000"
+      HOSTNAME: "0.0.0.0"
+    expose:
+      - "3000"
+    networks:
+      - dyolink_staging
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:3000/', (r) => {if(r.statusCode!==200)process.exit(1)})"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 60s
+
+  nginx:
+    image: nginx:alpine
+    container_name: dyolink_nginx_staging
+    depends_on:
+      - backend
+      - frontend
+    ports:
+      - "${STAGING_HTTP_PORT:-8088}:80"
+    volumes:
+      - ./nginx/http-only.conf:/etc/nginx/conf.d/default.conf:ro
+      - ./logs/nginx-staging:/var/log/nginx
+    networks:
+      - dyolink_staging
+    restart: unless-stopped
+
+networks:
+  dyolink_staging:
+    name: dyolink_staging
+
+volumes:
+  postgres_data_staging:
+    name: dyolink_postgres_data_staging

infrastructure/docker-compose.staging.yml

@@ -0,0 +1,107 @@
+# Staging stack — builds images from local backend/frontend (needs full repo clone).
+# For pull-only images + registry (no app source on server), use docker-compose.registry.yml
+# and .gitea/workflows/registry-build-deploy.yml instead.
+#
+# From this directory:
+#   docker compose -f docker-compose.staging.yml --env-file .env.staging up -d --build
+
+name: dyolink-staging
+
+services:
+  postgres:
+    image: postgres:15-alpine
+    container_name: dyolink_postgres_staging
+    env_file:
+      - database.staging.env
+    environment:
+      TZ: UTC
+    volumes:
+      - postgres_data_staging:/var/lib/postgresql/data
+      - ./database/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
+      - ./database/backups:/backups
+    networks:
+      - dyolink_staging
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER"]
+      interval: 15s
+      timeout: 10s
+      retries: 5
+      start_period: 40s
+
+  backend:
+    build:
+      context: ../backend
+      dockerfile: Dockerfile
+    container_name: dyolink_backend_staging
+    depends_on:
+      postgres:
+        condition: service_healthy
+    env_file:
+      - backend.staging.env
+    environment:
+      NODE_ENV: production
+      TZ: UTC
+      PORT: "3000"
+    expose:
+      - "3000"
+    networks:
+      - dyolink_staging
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:3000/api/health', (r) => {if(r.statusCode!==200)process.exit(1)})"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 60s
+
+  frontend:
+    build:
+      context: ../frontend
+      dockerfile: Dockerfile
+      args:
+        NEXT_PUBLIC_API_URL: ${STAGING_NEXT_PUBLIC_API_URL:-http://178.131.50.201:8088/api}
+        NEXT_PUBLIC_APP_URL: ${STAGING_NEXT_PUBLIC_APP_URL:-http://178.131.50.201:8088}
+        NEXT_PUBLIC_APP_NAME: ${STAGING_NEXT_PUBLIC_APP_NAME:-Dyolink}
+    container_name: dyolink_frontend_staging
+    depends_on:
+      - backend
+    environment:
+      NODE_ENV: production
+      TZ: UTC
+      PORT: "3000"
+      HOSTNAME: "0.0.0.0"
+    expose:
+      - "3000"
+    networks:
+      - dyolink_staging
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:3000/', (r) => {if(r.statusCode!==200)process.exit(1)})"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 60s
+
+  nginx:
+    image: nginx:alpine
+    container_name: dyolink_nginx_staging
+    depends_on:
+      - backend
+      - frontend
+    ports:
+      - "${STAGING_HTTP_PORT:-8088}:80"
+    volumes:
+      - ./nginx/http-only.conf:/etc/nginx/conf.d/default.conf:ro
+      - ./logs/nginx-staging:/var/log/nginx
+    networks:
+      - dyolink_staging
+    restart: unless-stopped
+
+networks:
+  dyolink_staging:
+    name: dyolink_staging
+
+volumes:
+  postgres_data_staging:
+    name: dyolink_postgres_data_staging

infrastructure/docker-compose.yml

@@ -1,11 +1,14 @@
+# Copy .env.docker.example to .env.docker and adjust (optional).
+# Defaults below are for local development only.
+
 services:
   postgres:
     image: postgres:15-alpine
     container_name: dyolink_db_container
     environment:
-      POSTGRES_USER: postgres
-      POSTGRES_PASSWORD: 1234
-      POSTGRES_DB: dyolink_db
+      POSTGRES_USER: ${POSTGRES_USER:-postgres}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-dyolink_dev_change_me}
+      POSTGRES_DB: ${POSTGRES_DB:-dyolink_db}
     ports:
       - "5433:5432"
     volumes:
@@ -16,7 +19,7 @@ services:
       - dyolink_network
     restart: unless-stopped
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U postgres"]
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres}"]
       interval: 10s
       timeout: 5s
       retries: 5
@@ -30,8 +33,8 @@ services:
     env_file:
       - ../backend/.env
     environment:
-      - DATABASE_URL=postgresql://postgres:1234@postgres:5432/dyolink_db
-      - FRONTEND_URL=http://frontend:3000
+      - DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-dyolink_dev_change_me}@postgres:5432/${POSTGRES_DB:-dyolink_db}
+      - FRONTEND_URL=http://localhost:4000
       - PORT=3000
     ports:
       - "4001:3000"
@@ -53,9 +56,8 @@ services:
     environment:
       - NEXT_PUBLIC_API_URL=http://localhost:4001/api
       - NEXT_PUBLIC_APP_URL=http://localhost:4000
-      - PORT=3000
     ports:
-      - "4000:3000"
+      - "4000:3001"
     volumes:
       - ../frontend:/app:rw
       - /app/node_modules
@@ -73,10 +75,8 @@ services:
       - frontend
     ports:
       - "8080:80"
-      - "8443:443"
     volumes:
-      - ./nginx/nginx.conf:/etc/nginx/conf.d/default.conf:ro
-      - ./ssl:/etc/nginx/ssl:ro
+      - ./nginx/http-only.dev.conf:/etc/nginx/conf.d/default.conf:ro
       - ./logs/nginx:/var/log/nginx
     networks:
       - dyolink_network

infrastructure/env.docker.example

@@ -0,0 +1,6 @@
+# Optional: save as .env next to infrastructure/docker-compose.yml
+# Docker Compose reads this file automatically for variable substitution.
+
+POSTGRES_USER=postgres
+POSTGRES_PASSWORD=dyolink_dev_change_me
+POSTGRES_DB=dyolink_db

infrastructure/env.staging.example

@@ -0,0 +1,13 @@
+# Copy to .env.staging next to docker-compose.staging.yml (optional).
+# Used only for compose variable substitution (build args, host port).
+
+STAGING_HTTP_PORT=8088
+
+# Public URLs baked into the frontend image at build time — must match how users open the app.
+STAGING_NEXT_PUBLIC_API_URL=http://178.131.50.201:8088/api
+STAGING_NEXT_PUBLIC_APP_URL=http://178.131.50.201:8088
+STAGING_NEXT_PUBLIC_APP_NAME=Dyolink
+
+# Change the IP/port if your server address differs.
+
+# Registry / pull-only deploy (see deploy.registry.env.example + docker-compose.registry.yml).

infrastructure/nginx/Dockerfile

@@ -1,19 +1,13 @@
 FROM nginx:alpine
 
-# Remove default configuration
-RUN rm /etc/nginx/conf.d/default.conf
+RUN rm -f /etc/nginx/conf.d/default.conf
 
-# Copy custom configuration
-COPY nginx.conf /etc/nginx/conf.d/
+COPY http-only.conf /etc/nginx/conf.d/default.conf
 
-# Create log directory
 RUN mkdir -p /var/log/nginx && \
     chown -R nginx:nginx /var/log/nginx && \
     chmod -R 755 /var/log/nginx
 
-# Switch to non-root user
-USER nginx
-
-EXPOSE 80 443
+EXPOSE 80
 
 CMD ["nginx", "-g", "daemon off;"]

infrastructure/nginx/http-only.conf

@@ -0,0 +1,54 @@
+# HTTP only — local dev and IP-based staging (no TLS).
+# Use with: docker compose and map host port e.g. 8080:80 or 8088:80
+
+upstream dyolink_backend {
+    server backend:3000;
+    keepalive 32;
+}
+
+upstream dyolink_frontend {
+    server frontend:3000;
+    keepalive 32;
+}
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name _;
+
+    client_max_body_size 50M;
+
+    location / {
+        proxy_pass http://dyolink_frontend;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection 'upgrade';
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_cache_bypass $http_upgrade;
+        proxy_read_timeout 300;
+        proxy_connect_timeout 300;
+    }
+
+    location /api {
+        proxy_pass http://dyolink_backend;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection 'upgrade';
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_cache_bypass $http_upgrade;
+        proxy_read_timeout 300;
+        proxy_connect_timeout 300;
+    }
+
+    location /health {
+        access_log off;
+        return 200 "healthy\n";
+        add_header Content-Type text/plain;
+    }
+}

infrastructure/nginx/http-only.dev.conf

@@ -0,0 +1,54 @@
+# Dev docker-compose only: local `npm run dev` uses port 3001 (see frontend package.json).
+# Staging / registry stacks use http-only.conf (frontend:3000).
+
+upstream dyolink_backend {
+    server backend:3000;
+    keepalive 32;
+}
+
+upstream dyolink_frontend {
+    server frontend:3001;
+    keepalive 32;
+}
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name _;
+
+    client_max_body_size 50M;
+
+    location / {
+        proxy_pass http://dyolink_frontend;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection 'upgrade';
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_cache_bypass $http_upgrade;
+        proxy_read_timeout 300;
+        proxy_connect_timeout 300;
+    }
+
+    location /api {
+        proxy_pass http://dyolink_backend;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection 'upgrade';
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_cache_bypass $http_upgrade;
+        proxy_read_timeout 300;
+        proxy_connect_timeout 300;
+    }
+
+    location /health {
+        access_log off;
+        return 200 "healthy\n";
+        add_header Content-Type text/plain;
+    }
+}