auto deploy on production server now finalized ready for smoke test.

windows ssl
Document staging HTTPS on wixur.ir (Windows nginx + Let's Encrypt).
2026-08-29 16:25:27 +03:30 · 2026-08-29 14:46:41 +03:30 · 2026-08-29 14:46:05 +03:30 · 2026-08-29 12:09:50 +03:30
18 changed files with 558 additions and 128 deletions
--- a/.gitea/workflows/prod-tag-deploy.yml
+++ b/.gitea/workflows/prod-tag-deploy.yml
@@ -0,0 +1,217 @@
+# Production: build images for https://nudentic.ir, push :v* to Gitea (not :latest),
+# SCP compose to Linux, docker login wixur.ir:3000, compose pull + up.
+#
+# Triggers: git tag v1.0.1 (and v*.*.*), or Actions → this workflow → Run (input tag).
+# Staging stays on master: .gitea/workflows/registry-build-deploy.yml
+#
+# Do NOT push :latest — staging already uses :latest with the wixur.ir frontend bake.
+#
+# Variables:
+#   REGISTRY_HOST          Windows Docker push host, e.g. host.docker.internal:3000
+#   REGISTRY_OWNER         Gitea user/org for packages
+#   CLONE_HOST             git clone, e.g. 127.0.0.1:3000
+#   PROD_PUBLIC_BASE_URL   https://nudentic.ir  (no trailing slash)
+#   PROD_REGISTRY_HOST     Linux pull host, e.g. wixur.ir:3000  (HTTP; insecure-registries on the VPS)
+#   PROD_INFRA_DIR         /opt/dyolink/infrastructure
+#
+# Secrets (in addition to REGISTRY_USERNAME / REGISTRY_PASSWORD):
+#   PROD_SSH_HOST          Linux public IP or hostname
+#   PROD_SSH_USER          e.g. dyolink
+#   PROD_SSH_KEY           OpenSSH private key (full PEM)
+#   PROD_SSH_PORT          optional, default 22
+#
+# One-time on Linux: insecure-registries ["wixur.ir:3000"], .env REGISTRY_PREFIX + DOMAIN=nudentic.ir
+# See infrastructure/DEPLOY.md
+
+name: Production — tag build, push, deploy
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag to build and deploy (e.g. v1.0.1)'
+        required: true
+
+defaults:
+  run:
+    shell: powershell
+
+jobs:
+  build-and-push:
+    runs-on: windows
+    outputs:
+      image_tag: ${{ steps.meta.outputs.image_tag }}
+    steps:
+      - name: Checkout (this Gitea)
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $cloneHost = '${{ vars.CLONE_HOST }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($cloneHost)) {
+            $Server = "${{ github.server_url }}".TrimEnd('/')
+          } elseif ($cloneHost -match '^https?://') {
+            $Server = $cloneHost.TrimEnd('/')
+          } else {
+            $Server = 'http://' + $cloneHost
+          }
+          $Repo = "${{ github.repository }}"
+          $dispatchTag = '${{ github.event.inputs.tag }}'.Trim()
+          if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) {
+            $Branch = $dispatchTag
+          } else {
+            $Branch = "${{ github.ref_name }}"
+          }
+          $Token = "${{ github.token }}"
+          $Actor = "${{ github.actor }}"
+          $hp = $Server -replace '^https?://', ''
+          if ($Server.StartsWith('https')) {
+            $cloneUrl = 'https://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
+          } else {
+            $cloneUrl = 'http://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
+          }
+          $env:GIT_TERMINAL_PROMPT = '0'
+          git clone --depth 1 --branch $Branch $cloneUrl .
+
+      - name: Resolve image tag (v*.*.* only)
+        id: meta
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $dispatchTag = '${{ github.event.inputs.tag }}'.Trim()
+          if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) {
+            $tag = $dispatchTag
+          } else {
+            $tag = "${{ github.ref_name }}"
+          }
+          if ($tag -notmatch '^v\d+\.\d+\.\d+') {
+            Write-Host "Production images must be tagged vMAJOR.MINOR.PATCH (got: $tag)"
+            exit 1
+          }
+          $utf8 = New-Object System.Text.UTF8Encoding $false
+          [System.IO.File]::AppendAllText($env:GITHUB_OUTPUT, "image_tag=$tag`n", $utf8)
+          $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}"
+          [System.IO.File]::AppendAllText($env:GITHUB_ENV, "REGISTRY_PREFIX=$prefix`n", $utf8)
+          Write-Host "image_tag=$tag REGISTRY_PREFIX=$prefix"
+
+      - name: Log in to container registry
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $pass = @'
+          ${{ secrets.REGISTRY_PASSWORD }}
+          '@
+          $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+
+      - name: Build and push backend (tag only, not :latest)
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $tag = "${{ steps.meta.outputs.image_tag }}"
+          docker build -t "$env:REGISTRY_PREFIX/dyolink-backend:$tag" ./backend
+          docker push "$env:REGISTRY_PREFIX/dyolink-backend:$tag"
+
+      - name: Build and push frontend (nudentic.ir baked in)
+        env:
+          PROD_PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $tag = "${{ steps.meta.outputs.image_tag }}"
+          $base = $env:PROD_PUBLIC_BASE_URL.Trim()
+          if ([string]::IsNullOrWhiteSpace($base)) { $base = 'https://nudentic.ir' }
+          $base = $base.TrimEnd('/')
+          docker build `
+            --build-arg "NEXT_PUBLIC_API_URL=$base/api" `
+            --build-arg "NEXT_PUBLIC_APP_URL=$base" `
+            --build-arg "NEXT_PUBLIC_APP_NAME=Dyolink" `
+            -t "$env:REGISTRY_PREFIX/dyolink-frontend:$tag" `
+            ./frontend
+          docker push "$env:REGISTRY_PREFIX/dyolink-frontend:$tag"
+
+  deploy:
+    needs: build-and-push
+    runs-on: windows
+    steps:
+      - name: Checkout (tagged tree for compose file)
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $cloneHost = '${{ vars.CLONE_HOST }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($cloneHost)) {
+            $Server = "${{ github.server_url }}".TrimEnd('/')
+          } elseif ($cloneHost -match '^https?://') {
+            $Server = $cloneHost.TrimEnd('/')
+          } else {
+            $Server = 'http://' + $cloneHost
+          }
+          $Repo = "${{ github.repository }}"
+          $dispatchTag = '${{ github.event.inputs.tag }}'.Trim()
+          if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) {
+            $Branch = $dispatchTag
+          } else {
+            $Branch = "${{ github.ref_name }}"
+          }
+          $Token = "${{ github.token }}"
+          $Actor = "${{ github.actor }}"
+          $hp = $Server -replace '^https?://', ''
+          if ($Server.StartsWith('https')) {
+            $cloneUrl = 'https://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
+          } else {
+            $cloneUrl = 'http://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
+          }
+          $env:GIT_TERMINAL_PROMPT = '0'
+          git clone --depth 1 --branch $Branch $cloneUrl .
+
+      - name: Write SSH key
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $raw = @'
+          ${{ secrets.PROD_SSH_KEY }}
+          '@
+          $key = $raw.Trim()
+          if ($key -notmatch 'BEGIN') {
+            Write-Host "Set secret PROD_SSH_KEY to an OpenSSH private key"
+            exit 1
+          }
+          $keyPath = Join-Path $env:RUNNER_TEMP 'prod_ssh'
+          $normalized = $key.Replace("`r`n", "`n").TrimEnd() + "`n"
+          [System.IO.File]::WriteAllText($keyPath, $normalized)
+          icacls $keyPath /inheritance:r | Out-Null
+          icacls $keyPath /grant:r "$($env:USERNAME):(R)" | Out-Null
+          [System.IO.File]::AppendAllText($env:GITHUB_ENV, "PROD_SSH_KEY_PATH=$keyPath`n")
+
+      - name: Copy compose + deploy script to Linux
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $hostName = '${{ secrets.PROD_SSH_HOST }}'.Trim()
+          $user = '${{ secrets.PROD_SSH_USER }}'.Trim()
+          $port = '${{ secrets.PROD_SSH_PORT }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($port)) { $port = '22' }
+          $infra = '${{ vars.PROD_INFRA_DIR }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($infra)) { $infra = '/opt/dyolink/infrastructure' }
+          $ssh = @('-i', $env:PROD_SSH_KEY_PATH, '-o', 'StrictHostKeyChecking=accept-new')
+          ssh.exe @ssh -p $port "${user}@${hostName}" "mkdir -p $infra/scripts"
+          scp.exe @ssh -P $port `
+            infrastructure/docker-compose.prod.yml `
+            "${user}@${hostName}:${infra}/docker-compose.prod.yml"
+          scp.exe @ssh -P $port `
+            infrastructure/scripts/prod-remote-deploy.sh `
+            "${user}@${hostName}:${infra}/scripts/prod-remote-deploy.sh"
+          ssh.exe @ssh -p $port "${user}@${hostName}" "chmod +x $infra/scripts/prod-remote-deploy.sh"
+
+      - name: Login on Linux and deploy tag
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $hostName = '${{ secrets.PROD_SSH_HOST }}'.Trim()
+          $user = '${{ secrets.PROD_SSH_USER }}'.Trim()
+          $port = '${{ secrets.PROD_SSH_PORT }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($port)) { $port = '22' }
+          $infra = '${{ vars.PROD_INFRA_DIR }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($infra)) { $infra = '/opt/dyolink/infrastructure' }
+          $regHost = '${{ vars.PROD_REGISTRY_HOST }}'.Trim()
+          if ([string]::IsNullOrWhiteSpace($regHost)) { $regHost = 'wixur.ir:3000' }
+          $tag = "${{ needs.build-and-push.outputs.image_tag }}"
+          $pass = @'
+          ${{ secrets.REGISTRY_PASSWORD }}
+          '@
+          $regUser = '${{ secrets.REGISTRY_USERNAME }}'
+          $ssh = @('-i', $env:PROD_SSH_KEY_PATH, '-o', 'StrictHostKeyChecking=accept-new')
+          $remote = "docker login $regHost -u $regUser --password-stdin && PROD_INFRA_DIR=$infra $infra/scripts/prod-remote-deploy.sh $tag"
+          $pass.Trim() | ssh.exe @ssh -p $port "${user}@${hostName}" $remote
--- a/.gitea/workflows/registry-build-deploy.yml
+++ b/.gitea/workflows/registry-build-deploy.yml
@@ -1,31 +1,32 @@
 # Staging: build backend/frontend images, push to Gitea Container Registry, deploy on self-hosted runner.
 #
 # Triggers: push to master/main, or manual workflow_dispatch.
+# Production (nudentic.ir / git tags): .gitea/workflows/prod-tag-deploy.yml — this file is Windows staging only.
 #
 # Repository Variables (Settings → Actions → Variables):
-#   REGISTRY_HOST        Docker registry host:port (no http/https). Same PC as Gitea → 127.0.0.1:3000
+#   REGISTRY_HOST        Docker registry host:port (no http/https). Windows Docker Desktop → host.docker.internal:3000
 #   REGISTRY_OWNER       Gitea user or org that owns the packages
-#   PUBLIC_BASE_URL      URL users sopen in browser, e.g. http://178.131.50.201:8088  (no trailing slash)
+#   PUBLIC_BASE_URL      URL users open in the browser, e.g. http://wixur.ir  (no trailing slash, no :8088)
 #   DEPLOY_SECRETS_DIR   absolute path on runner, e.g. C:/dyolink/secrets
 #
 # Optional:
-#   STAGING_HTTP_PORT    public port (default 8088) — Windows portproxy listens here
-#   STAGING_LOCAL_PORT   Docker bind on 127.0.0.1 (default 18088) — must not equal 8088 if portproxy owns 8088
+#   STAGING_HTTP_PORT    public HTTP port (default 80) — Windows portproxy listens here → 18088
+#   STAGING_LOCAL_PORT   Docker bind on 127.0.0.1 (default 18088) — must not equal the public port if portproxy owns it
 #   CLONE_HOST           git clone host when runner = Gitea host → 127.0.0.1:3000
 #
 # Same Windows PC runs Gitea + runner + deploy:
 #   CLONE_HOST           → 127.0.0.1:3000  (git runs on Windows host)
 #   REGISTRY_HOST        → host.docker.internal:3000  (docker commands run inside Docker Desktop VM)
-#   Gitea app.ini ROOT_URL → http://host.docker.internal:3000/
-#   PUBLIC_BASE_URL      → public IP:8088 (browser URL for staging app)
+#   Gitea app.ini ROOT_URL → http://host.docker.internal:3000/  (Docker registry auth; browsers use http://wixur.ir:3000)
+#   PUBLIC_BASE_URL      → http://wixur.ir  (staging app; Gitea stays on :3000)
 #
-# Add host.docker.internal:3000 to Docker Desktop insecure-registries.
+# Add host.docker.internal:3000 (and wixur.ir:3000 if you pull by public hostname) to Docker Desktop insecure-registries.
 #
 # Repository Secrets (Settings → Actions → Secrets):
 #   REGISTRY_USERNAME    Gitea username for docker login
 #   REGISTRY_PASSWORD    Gitea access token (packages:read/write) or account password
 #
-# Docker on runner: add registry hosts to insecure-registries, e.g. ["127.0.0.1:3000","178.131.50.201:3000"]
+# Docker on runner: insecure-registries e.g. ["host.docker.internal:3000","wixur.ir:3000"]
 #
 # Runner: self-hosted with Docker + git. Default shell is powershell (Windows act_runner).

@@ -162,7 +163,7 @@ jobs:
            exit 1
          }
          $stagingPort = '${{ vars.STAGING_HTTP_PORT }}'.Trim()
-          if ([string]::IsNullOrWhiteSpace($stagingPort)) { $stagingPort = '8088' }
+          if ([string]::IsNullOrWhiteSpace($stagingPort)) { $stagingPort = '80' }
          $localPort = '${{ vars.STAGING_LOCAL_PORT }}'.Trim()
          if ([string]::IsNullOrWhiteSpace($localPort)) { $localPort = '18088' }
          $imageTag = "${{ needs.build-and-push.outputs.image_tag }}"
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -10,7 +10,7 @@ Dental clinic ↔ lab platform (monorepo):
 |------|--------|
 | `backend/` | NestJS, Prisma, PostgreSQL |
 | `frontend/` | Next.js 16, React 19, next-intl, Tailwind |
-| `infrastructure/` | Docker, nginx, deploy scripts — prod: `DEPLOY.md`, staging: `STAGING-DEPLOY.md` |
+| `infrastructure/` | Docker — staging `https://wixur.ir` (Windows, `STAGING-DEPLOY.md`); prod `https://nudentic.ir` (Linux, `DEPLOY.md`) |

 **Organization types:** `CLINIC` (patients, appointments, treatment) and `LAB` (cases, tasks). Many features are org-type-specific. Permissions use `TAB_*_READ` / `TAB_*_EDIT` codes — see `backend/src/common/permissions.ts`.

--- a/README.md
+++ b/README.md
@@ -8,45 +8,21 @@ Local development: see **`backend/README.md`** and **`frontend/README.md`**.

 ---

-## Production deploy (Docker Hub + HTTPS + Let's Encrypt)
+## Production deploy (`https://nudentic.ir`)

-**Full step-by-step guide:** [`infrastructure/DEPLOY.md`](infrastructure/DEPLOY.md)
+**Full guide:** [`infrastructure/DEPLOY.md`](infrastructure/DEPLOY.md)

-Minimal server setup: install Docker, create `.env` + `secrets/`, `docker login`, run one script.
+Git tag **`v1.0.1`** → Gitea workflow [`.gitea/workflows/prod-tag-deploy.yml`](.gitea/workflows/prod-tag-deploy.yml) builds images (URLs baked for nudentic.ir), pushes to Gitea registry, SSH-deploys the Linux stack.

-| On server (once) | In repo / Docker |
-|------------------|------------------|
-| DNS A record → server IP | `docker-compose.prod.yml`, nginx, certbot |
-| `docker login` (private Hub) | Build & push images from dev machine |
-| `secrets/database.env`, `secrets/backend.env` | Examples: `database.prod.env.example`, `backend.prod.env.example` |
-| `infrastructure/.env` (`DOMAIN`, `LETSENCRYPT_EMAIL`) | `deploy.prod.env.example` |
-
-**Dev machine** — build frontend with the public domain baked in, push to Docker Hub:
-
-```bash
-./infrastructure/scripts/build-and-push-prod.sh wixur.ir latest
-```
-
-**Server** — from `infrastructure/`:
-
-```bash
-cp deploy.prod.env.example .env          # edit DOMAIN, paths
-mkdir -p ../secrets && cp database.prod.env.example ../secrets/database.env
-cp backend.prod.env.example ../secrets/backend.env   # set passwords + FRONTEND_URL
-docker login
-chmod +x scripts/*.sh
-./scripts/deploy-prod.sh
-```
-
-SSL is issued automatically via **Certbot** (`scripts/init-letsencrypt.sh`). Nginx config is generated from `DOMAIN` in `.env`. When you move to another domain (e.g. `dyolink.com`), update `.env` + `backend.env`, re-run `init-letsencrypt.sh`, and **rebuild the frontend image** with the new URL.
+First-time SSL / Hub fallback: same `DEPLOY.md`.

 ---

-## Staging deploy (Gitea Actions + Windows)
+## Staging deploy (`https://wixur.ir`)

 **Full guide:** [`infrastructure/STAGING-DEPLOY.md`](infrastructure/STAGING-DEPLOY.md)

-Merge or push to **`master`** → Gitea Actions builds images → deploys to `http://<host>:8088`.
+Merge or push to **`master`** → Gitea Actions builds images → deploys to `https://wixur.ir` (Gitea: `http://wixur.ir:3000`).

 Workflow: [`.gitea/workflows/registry-build-deploy.yml`](.gitea/workflows/registry-build-deploy.yml)

--- a/infrastructure/DEPLOY.md
+++ b/infrastructure/DEPLOY.md
@@ -1,13 +1,84 @@
 # Dyolink — Production Server Deploy Guide

-Deploy the full stack (Postgres, NestJS API, Next.js, Nginx, Let's Encrypt) on a fresh Linux server using **Docker Hub** images.
+Linux VPS serves **`https://nudentic.ir` only**. Images come from the **Gitea registry** (`wixur.ir:3000`) on git tags. Staging is Windows (`https://wixur.ir`) — see [`STAGING-DEPLOY.md`](STAGING-DEPLOY.md).

-**Example used in production:** `https://wixur.ir` on server `185.243.48.140`.
+**Automated path:** tag `v1.0.1` → [`.gitea/workflows/prod-tag-deploy.yml`](../.gitea/workflows/prod-tag-deploy.yml) (Windows runner builds, SSH to this server).
+
+**Manual / first SSL:** Docker Hub + [`scripts/build-and-push-prod.sh`](scripts/build-and-push-prod.sh) is still documented below as a fallback.
+
+**Example host:** `https://nudentic.ir` (do not point `wixur.ir` at this VPS).
+
+---
+
+## Automated deploy (Gitea tags)
+
+```
+git tag v1.0.1 && git push origin v1.0.1
+        ↓
+Windows act_runner builds frontend with https://nudentic.ir
+        ↓
+Push wixur.ir:3000/<owner>/dyolink-*:v1.0.1   (never :latest)
+        ↓
+SSH → Linux  docker login wixur.ir:3000  →  compose pull + up
+        ↓
+https://nudentic.ir
+```
+
+`:latest` is **staging only** (wixur.ir baked in). Production compose must pin `TAG=v1.0.1`.
+
+### One-time on the Linux server
+
+1. **HTTP registry** — Gitea is `http://wixur.ir:3000`. In `/etc/docker/daemon.json`:
+
+```json
+{
+  "insecure-registries": ["wixur.ir:3000"]
+}
+```
+
+Then `sudo systemctl restart docker` (containers restart).
+
+2. **`.env`** in `/opt/dyolink/infrastructure/` — from [`deploy.prod.env.example`](deploy.prod.env.example):
+
+- `DOMAIN=nudentic.ir`
+- `REGISTRY_PREFIX=wixur.ir:3000/<gitea-owner>` (same owner as Gitea `REGISTRY_OWNER`)
+- `TAG=v1.0.1` (CI overrides per release)
+
+3. **`secrets/backend.env`:** `FRONTEND_URL=https://nudentic.ir`, `COOKIE_SECURE=true`
+
+4. **SSH** — user that can run `docker` (e.g. `dyolink` in the `docker` group). Put the matching **public** key in `~/.ssh/authorized_keys`.
+
+5. **Test pull** (after a staging or prod image exists):
+
+```bash
+docker login wixur.ir:3000 -u <gitea-user>
+docker pull wixur.ir:3000/<owner>/dyolink-backend:<sha-or-tag>
+```
+
+### Gitea (same repo as staging)
+
+**Variables:** `PROD_PUBLIC_BASE_URL=https://nudentic.ir`, `PROD_REGISTRY_HOST=wixur.ir:3000`, `PROD_INFRA_DIR=/opt/dyolink/infrastructure`, plus existing `REGISTRY_HOST` / `REGISTRY_OWNER` / `CLONE_HOST`.
+
+**Secrets:** `PROD_SSH_HOST`, `PROD_SSH_USER`, `PROD_SSH_KEY` (private key). Reuse `REGISTRY_USERNAME` / `REGISTRY_PASSWORD`. Optional `PROD_SSH_PORT` (default 22).
+
+OpenSSH must be on the Windows runner (`ssh.exe` / `scp.exe`).
+
+### Release
+
+```bash
+git tag v1.0.1
+git push origin v1.0.1
+```
+
+Or Gitea → Actions → **Production — tag build, push, deploy** → Run → tag `v1.0.1`.
+
+Check `https://nudentic.ir/api/health`.

 ---

 ## Architecture

+
 ```
 Internet → Nginx (:80 / :443)
              ├── /      → frontend:3000  (Next.js)
@@ -18,8 +89,8 @@ Internet → Nginx (:80 / :443)
 | Service   | Image                              | Notes                          |
 |-----------|------------------------------------|--------------------------------|
 | postgres  | `postgres:15-alpine`               | Data in Docker volume          |
-| backend   | `dyolink/dyolink-backend:latest`   | Runs migrations + seed on start |
-| frontend  | `dyolink/dyolink-frontend:latest`  | URLs baked in at **build time** |
+| backend   | `REGISTRY_PREFIX/dyolink-backend:TAG` | Gitea `v*` or Hub `dyolink/…` |
+| frontend  | `REGISTRY_PREFIX/dyolink-frontend:TAG` | URLs baked in at **build time** |
 | nginx     | `nginx:alpine`                     | SSL termination + reverse proxy |
 | certbot   | `certbot/certbot`                  | Auto-renews certificates       |

@@ -289,16 +360,19 @@ Open `https://YOUR_DOMAIN` in a browser.

 ## Updating the app (new release)

-**On Mac** — build & push:
+**Preferred:** `git tag vX.Y.Z && git push origin vX.Y.Z` (Gitea production workflow).
+
+**Fallback (Docker Hub from a Mac):**

 ```bash
-./infrastructure/scripts/build-and-push-prod.sh wixur.ir latest
+./infrastructure/scripts/build-and-push-prod.sh nudentic.ir v1.0.1
 ```

-**On server:**
+**On server** (if not using CI):

 ```bash
 cd /opt/dyolink/infrastructure
+# TAG in .env or: TAG=v1.0.1 docker compose -f docker-compose.prod.yml --env-file .env pull backend frontend
 docker compose -f docker-compose.prod.yml --env-file .env pull backend frontend
 docker compose -f docker-compose.prod.yml --env-file .env up -d
 ```
@@ -361,6 +435,10 @@ docker volume rm dyolink_postgres_data_prod
 ./scripts/deploy-prod.sh
 ```

+### Docker login to `wixur.ir:3000`: `http response to HTTPS client`
+
+Add `"insecure-registries": ["wixur.ir:3000"]` to `/etc/docker/daemon.json` and restart Docker.
+
 ### View logs

 ```bash
@@ -385,12 +463,13 @@ docker compose -f docker-compose.prod.yml --env-file .env exec frontend \

 | Path on server | Purpose |
 |----------------|---------|
-| `/opt/dyolink/infrastructure/.env` | Domain, Docker Hub user, Let's Encrypt email |
+| `/opt/dyolink/infrastructure/.env` | `DOMAIN`, `REGISTRY_PREFIX`, `TAG`, Let's Encrypt email |
 | `/opt/dyolink/secrets/database.env` | Postgres credentials |
-| `/opt/dyolink/secrets/backend.env` | API secrets, DATABASE_URL, JWT, SMS |
+| `/opt/dyolink/secrets/backend.env` | API secrets, DATABASE_URL, JWT, SMS, `FRONTEND_URL` |
 | `/opt/dyolink/infrastructure/nginx/generated/default.conf` | Auto-generated nginx SSL config |
-| `/opt/dyolink/infrastructure/scripts/deploy-prod.sh` | Main deploy entry point |
-| `/opt/dyolink/infrastructure/scripts/build-and-push-prod.sh` | Build & push (run on Mac) |
+| `/opt/dyolink/infrastructure/scripts/prod-remote-deploy.sh` | Tag deploy (CI SSH) |
+| `/opt/dyolink/infrastructure/scripts/deploy-prod.sh` | First-time SSL + stack up |
+| `.gitea/workflows/prod-tag-deploy.yml` | CI: build, push `:v*`, SSH deploy |

 ---

--- a/infrastructure/STAGING-DEPLOY.md
+++ b/infrastructure/STAGING-DEPLOY.md
@@ -2,9 +2,13 @@

 Automatic staging on a **self-hosted Gitea** machine: merge (or push) to **`master`** → build Docker images → push to Gitea Container Registry → deploy on the same host.

-**Example:** Gitea at `http://178.131.50.201:3000`, staging app at `http://178.131.50.201:8088`.
+| Public URL | What |
+|------------|------|
+| `https://wixur.ir` | Staging app (port **443** → Windows nginx → Docker). Mobinnet: public **80** is the modem. |
+| `http://wixur.ir:8088` | HTTP fallback |
+| `http://wixur.ir:3000` | Gitea + container registry |

-Production (`nudentic.ir` on Linux, tag-based releases) is documented in [`DEPLOY.md`](DEPLOY.md).
+DNS `wixur.ir` must point at the **Windows** host. Production (`https://nudentic.ir` on Linux) is separate — see [`DEPLOY.md`](DEPLOY.md). Do **not** point `wixur.ir` at the Linux VPS.

 ---

@@ -19,7 +23,9 @@ Build backend + frontend → push to Gitea registry
        ↓
 docker compose pull + up -d (docker-compose.registry.yml)
        ↓
-http://<host-ip>:8088  →  nginx → frontend / backend → postgres
+https://wixur.ir       →  Windows nginx :443 →  127.0.0.1:18088  →  Docker nginx → app
+http://wixur.ir:8088   →  portproxy :8088    →  127.0.0.1:18088  (fallback)
+http://wixur.ir:3000   →  Gitea (native, no Docker)
 ```

 | Service  | Image source                                      |
@@ -29,7 +35,26 @@ http://<host-ip>:8088  →  nginx → frontend / backend → postgres
 | frontend | `<REGISTRY_HOST>/<owner>/dyolink-frontend:<sha>`  |
 | nginx    | `nginx:alpine`                                    |

-Frontend public URLs are **baked in at build time** via `PUBLIC_BASE_URL`.
+Frontend public URLs are **baked in at build time** via `PUBLIC_BASE_URL`. After changing the public URL, re-run the Gitea workflow (or push to `master`) and set `FRONTEND_URL` in `C:\dyolink\secrets\backend.staging.env` to the same origin.
+
+---
+
+## Cut over from `:8088` to `http://wixur.ir`
+
+DNS A record for `wixur.ir` → Windows IP (already done if `http://wixur.ir:3000` and `:8088` work).
+
+On Windows: host nginx on **80** proxies to Docker **18088** ([`nginx/windows-edge-http.conf`](nginx/windows-edge-http.conf)). Remove portproxy on **80** (keep **8088** as fallback). Router must forward **80**. See §7.
+
+In Gitea → repo → **Settings → Actions → Variables**:
+
+- `PUBLIC_BASE_URL` = `https://wixur.ir`
+- `STAGING_HTTP_PORT` = `80` (optional; workflow default is 80)
+
+On disk: `FRONTEND_URL=https://wixur.ir` and `COOKIE_SECURE=true` in `C:\dyolink\secrets\backend.staging.env`.
+
+Then run the **Registry — build, push, deploy** workflow so the frontend image is rebuilt without `:8088`.
+
+---

 ---

@@ -59,8 +84,7 @@ Workflow file: [`.gitea/workflows/registry-build-deploy.yml`](../.gitea/workflow
  "insecure-registries": [
    "host.docker.internal:3000",
    "127.0.0.1:3000",
-    "178.131.50.201:3000",
-    "192.168.1.100:3000"
+    "wixur.ir:3000"
  ]
 }
 ```
@@ -130,7 +154,7 @@ Copy examples and edit:
 Rules:

 - `DATABASE_URL` password must match `POSTGRES_PASSWORD`.
- `FRONTEND_URL` must match `PUBLIC_BASE_URL` (e.g. `http://178.131.50.201:8088`).
+- `FRONTEND_URL` must match `PUBLIC_BASE_URL` (`http://wixur.ir`).
 - Replace JWT secrets with long random values (not `CHANGE_ME`).

 ### 4. Gitea repository Variables
@@ -139,13 +163,13 @@ Rules:

 | Name | Example | Notes |
 |------|---------|--------|
-| `REGISTRY_HOST` | `host.docker.internal:3000` | **Windows + Docker Desktop:** Docker runs in a Linux VM — `127.0.0.1` is the VM, not Gitea. Use `host.docker.internal:3000`. Also set Gitea `ROOT_URL` to match (see below). |
+| `REGISTRY_HOST` | `host.docker.internal:3000` | **Windows + Docker Desktop:** Docker runs in a Linux VM — `127.0.0.1` is the VM, not Gitea. Use `host.docker.internal:3000`. Gitea `ROOT_URL` should match this so registry login from CI works. Browsers and the Linux VPS use `http://wixur.ir:3000`. |
 | `REGISTRY_OWNER` | `admin` | Gitea user/org owning packages |
-| `PUBLIC_BASE_URL` | `http://178.131.50.201:8088` | How **users** open staging in a browser (public IP OK) |
+| `PUBLIC_BASE_URL` | `https://wixur.ir` | How **users** open staging (HTTPS on 443). No trailing slash. |
 | `DEPLOY_SECRETS_DIR` | `C:/dyolink/secrets` | Forward slashes OK on Windows |
 | `CLONE_HOST` | `127.0.0.1:3000` | Git clone (runs on Windows host, not inside Docker VM) |
-| `STAGING_HTTP_PORT` | `8088` | Public port (router + portproxy). Optional. |
-| `STAGING_LOCAL_PORT` | `18088` | Docker bind on `127.0.0.1`. Must not be `8088` if portproxy already uses 8088. |
+| `STAGING_HTTP_PORT` | `80` | Public HTTP port (portproxy). Optional; workflow default is 80. |
+| `STAGING_LOCAL_PORT` | `18088` | Docker bind on `127.0.0.1`. Must not be `80` if portproxy already uses 80. |

 **Naming note:** Gitea rejects variable names starting with `GITEA_` or `GITHUB_`. Use `CLONE_HOST`, not `GITEA_CLONE_URL`.

@@ -163,43 +187,42 @@ Create token: profile → **Settings → Applications → Generate New Token**.
 ### 6. Firewall (once)

 ```powershell
+New-NetFirewallRule -DisplayName "Dyolink Staging HTTP 80" -Direction Inbound -Protocol TCP -LocalPort 80 -Action Allow
+# Optional fallback while cutting over from :8088
 New-NetFirewallRule -DisplayName "Dyolink Staging 8088" -Direction Inbound -Protocol TCP -LocalPort 8088 -Action Allow
 ```

-### 7. External access on Windows + Docker Desktop (portproxy)
+### 7. Port 80 = host nginx (not portproxy)

-Gitea on **:3000** runs natively on Windows. Staging nginx binds **127.0.0.1:18088** (not 8088). Windows **portproxy** then maps public **8088 → 18088**. Do **not** bind Docker on 8088 — portproxy already owns that port (`bind: access permissions` if you try).
+Gitea stays on **:3000**. Docker staging nginx binds **127.0.0.1:18088**. A **Windows nginx** (the 1.29.x you already have) listens on **80** and proxies to 18088. Config: [`nginx/windows-edge-http.conf`](nginx/windows-edge-http.conf).

-Run **once** in **PowerShell as Administrator** (replace the old 8088→8088 rule if you had one):
+**Do not** run portproxy on port 80 at the same time — it will lose to nginx (404 / hang). Keep portproxy **8088 → 18088** as fallback.

 ```powershell
-netsh interface portproxy delete v4tov4 listenaddress=0.0.0.0 listenport=8088
-netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=8088 connectaddress=127.0.0.1 connectport=18088
-netsh interface portproxy show all
-Start-Service iphlpsvc
-Set-Service iphlpsvc -StartupType Automatic
+# 1) Free port 80 from portproxy (nginx will bind 80)
+netsh interface portproxy delete v4tov4 listenaddress=0.0.0.0 listenport=80
+
+# 2) Confirm Docker staging is up
+curl.exe http://127.0.0.1:18088/health
+
+# 3) Install windows-edge-http.conf into host nginx, then:
+#    nginx -t
+#    nginx -s reload
+#    (paths depend on where nginx is installed)
+
+# 4) Must print "healthy" (not 404)
+curl.exe http://127.0.0.1/health
 ```

-Verify on the server:
+Replace any **default_server** / leftover `server { listen 80; }` in the host nginx that returns 404, or this file will never win.

-```powershell
-curl http://127.0.0.1:18088/health
-curl http://127.0.0.1:8088/health
-```
-
-From your Mac:
+From another machine (after **router forward TCP 80** → this PC):

 ```bash
-curl http://178.131.50.201:8088/health
+curl http://wixur.ir/health
 ```

-If the public IP still fails but LAN works, add **router port forward 8088** → Windows PC (same as Gitea **3000**).
-
-To remove portproxy later:
-
-```powershell
-netsh interface portproxy delete v4tov4 listenaddress=0.0.0.0 listenport=8088
-```
+**Mobinnet:** public **80** is the modem. Use **443** instead: router forward **TCP 443 → 192.168.1.100**, then `https://wixur.ir`. Let's Encrypt after mobile-data `/health` works (self-signed is enough for that test).

 ---

@@ -240,13 +263,13 @@ Expect: `dyolink_nginx_staging`, `dyolink_backend_staging`, `dyolink_frontend_st
 **From browser or another machine:**

 ```text
-http://178.131.50.201:8088
+http://wixur.ir
 ```

 **Health check:**

 ```powershell
-curl http://178.131.50.201:8088/api/health
+curl http://wixur.ir/api/health
 ```

 Expected: `{"status":"ok",...}`
@@ -263,7 +286,7 @@ On the Windows host, from repo `infrastructure/`:

 1. Create `deploy.registry.env` from [`deploy.registry.env.example`](deploy.registry.env.example)
 2. Set `REGISTRY_PREFIX`, `IMAGE_TAG`, `STAGING_HTTP_PORT`, `DEPLOY_SECRETS_DIR`
-3. `docker login 178.131.50.201:3000 -u <user>`
+3. `docker login host.docker.internal:3000 -u <user>`  (on Windows Docker Desktop; Linux prod will use `wixur.ir:3000`)
 4. `docker compose -f docker-compose.registry.yml --env-file deploy.registry.env pull backend frontend`
 5. `docker compose -f docker-compose.registry.yml --env-file deploy.registry.env up -d`

@@ -282,8 +305,10 @@ On the Windows host, from repo `infrastructure/`:
 | `Missing database.staging.env` | Check `DEPLOY_SECRETS_DIR` path and file names |
 | `docker login` denied | Token needs package permissions; check username/secret |
 | Git clone fails in workflow | Set `CLONE_HOST=127.0.0.1:3000` |
+| Port 80 bind forbidden / access permissions | Portproxy already owns 80. Bind Docker to `18088` and point portproxy **80 → 127.0.0.1:18088**. Free IIS if it holds 80. |
+| `http://wixur.ir` unreachable / empty reply | Docker Desktop: run **portproxy** (§7). `127.0.0.1:18088/health` must work on Windows first. Router must forward **80**. |
 | Port 8088 bind forbidden / access permissions | Portproxy already owns 8088. Bind Docker to `18088` and point portproxy **8088 → 127.0.0.1:18088**. |
-| Port 8088 unreachable from Mac / empty reply | Docker Desktop: run **portproxy** (§7). `127.0.0.1:18088/health` must work on Windows first. |
+| Port 8088 unreachable from Mac / empty reply | Legacy URL. Prefer `http://wixur.ir`. Same 18088 backend; add portproxy 8088 only as fallback. |
 | Backend restart loop | JWT secrets still placeholder; fix `backend.staging.env` |
 | Backend DB auth error | `DATABASE_URL` password ≠ `POSTGRES_PASSWORD` |
 | `dumb-init docker-entrypoint.sh: No such file or directory` | Windows CRLF in shell scripts — fixed in Dockerfiles (rebuild images). |
@@ -308,15 +333,16 @@ docker logs dyolink_frontend_staging --tail 50
 | `infrastructure/deploy.registry.env.example` | Manual deploy env template |
 | `infrastructure/database.staging.env.example` | Postgres secrets template |
 | `infrastructure/backend.staging.env.example` | API secrets template |
-| `infrastructure/nginx/http-only.conf` | HTTP reverse proxy for staging |
+| `infrastructure/nginx/http-only.conf` | HTTP reverse proxy **inside Docker** staging |
+| `infrastructure/nginx/windows-edge-http.conf` | Windows **host** nginx on port 80 → 18088 |

 ---

-## Production (later)
+## Production (Linux + tags)

 | Environment | Trigger | Host |
 |-------------|---------|------|
-| Staging | Push/merge to `master` | Windows + Gitea |
-| Production | Git tag `v*.*.*` | Linux + `nudentic.ir` |
+| Staging | Push/merge to `master` | Windows + `https://wixur.ir` |
+| Production | Git tag `v*.*.*` | Linux + `https://nudentic.ir` |

-Production flow will use Docker Hub (or registry) + [`DEPLOY.md`](DEPLOY.md) — not yet wired to the same workflow.
+Workflow: [`.gitea/workflows/prod-tag-deploy.yml`](../.gitea/workflows/prod-tag-deploy.yml). Do **not** push production images as `:latest`. Setup: [`DEPLOY.md`](DEPLOY.md).
--- a/infrastructure/backend.prod.env.example
+++ b/infrastructure/backend.prod.env.example
@@ -12,7 +12,7 @@ JWT_REFRESH_SECRET=replace_with_a_different_openssl_rand_hex_32_output
 JWT_REFRESH_EXPIRES_IN=30d

 # Must match DOMAIN in .env — used for CORS, invite links, cookies
-FRONTEND_URL=https://wixur.ir
+FRONTEND_URL=https://nudentic.ir

 # Required for HTTPS — browsers reject Secure cookies over plain HTTP
 COOKIE_SECURE=true
--- a/infrastructure/backend.staging.env.example
+++ b/infrastructure/backend.staging.env.example
@@ -9,11 +9,11 @@ JWT_EXPIRES_IN=15m
 JWT_REFRESH_SECRET=another_long_random_secret_different_from_JWT_SECRET
 JWT_REFRESH_EXPIRES_IN=30d

-# CORS, cookies, and invite links — must match how users open the app (nginx host port)
-FRONTEND_URL=http://178.131.50.201:8088
+# CORS, cookies, and invite links — must match how users open the app
+FRONTEND_URL=https://wixur.ir

-# HTTP staging — keep false unless you terminate TLS in front of the app
-COOKIE_SECURE=false
+# TLS is terminated on Windows nginx :443 — cookies must be Secure
+COOKIE_SECURE=true

 # SMS (sms.ir)
 SMS_IR_API_KEY=CHANGE_ME_SMS_IR_API_KEY
--- a/infrastructure/deploy.prod.env.example
+++ b/infrastructure/deploy.prod.env.example
@@ -1,15 +1,27 @@
-# Copy to infrastructure/.env on the server (not committed).
+# Copy to infrastructure/.env on the Linux server (not committed).
 # docker compose -f docker-compose.prod.yml --env-file .env ...

-DOMAIN=wixur.ir
+DOMAIN=nudentic.ir
+
+# Gitea Container Registry (tag auto-deploy). Same packages Windows CI pushes
+# via host.docker.internal:3000 — Linux pulls via this hostname.
+# Format: <host>:<port>/<owner>  — no http://
+REGISTRY_PREFIX=wixur.ir:3000/admin
+
+# Image tag — CI sets this per release (v1.0.1). Do not use latest for Gitea prod
+# (staging already owns :latest with the wixur.ir frontend bake).
+TAG=v1.0.1
+
+# Hub-only fallback: comment out REGISTRY_PREFIX and use:
+# REGISTRY_PREFIX=dyolink
+# TAG=latest
 DOCKER_USERNAME=dyolink
-TAG=latest

 # Let's Encrypt — certificate issuance and renewal notices
 LETSENCRYPT_EMAIL=rameen.naghdi@gmail.com

-# Optional: extra hostnames on the same cert (space-separated), e.g. www.wixur.ir
-# CERTBOT_EXTRA_DOMAINS=www.wixur.ir
+# Optional: extra hostnames on the same cert (space-separated)
+# CERTBOT_EXTRA_DOMAINS=www.nudentic.ir

 # Optional: use Let's Encrypt staging while testing (avoids rate limits)
 # LETSENCRYPT_STAGING=1
--- a/infrastructure/deploy.registry.env.example
+++ b/infrastructure/deploy.registry.env.example
@@ -6,14 +6,15 @@
 # --- Registry boundary (swap when moving Gitea → Docker Hub) ---
 # Gitea:  REGISTRY_PREFIX = <host>:<port>/<owner>
 # Hub:    REGISTRY_PREFIX = docker.io/<user>   (or your username for implicit hub)
-REGISTRY_PREFIX=178.131.50.201:3000/yourgiteauser
+# Windows CI pushes via host.docker.internal:3000; browsers/Linux use wixur.ir:3000 (same Gitea).
+REGISTRY_PREFIX=wixur.ir:3000/yourgiteauser

 # Short git SHA from CI, or "latest" after a manual pull of :latest
 IMAGE_TAG=latest

-# Public URL port (router + Windows portproxy listen here)
-STAGING_HTTP_PORT=8088
-# Docker nginx bind on localhost only (must differ from 8088 when portproxy owns 8088)
+# Public HTTP port (router + Windows portproxy listen here) — 80 so users open http://wixur.ir
+STAGING_HTTP_PORT=80
+# Docker nginx bind on localhost only (must differ from 80 if portproxy owns 80)
 STAGING_LOCAL_PORT=18088

 # Absolute path on the server where database.staging.env and backend.staging.env live.
--- a/infrastructure/docker-compose.prod.yml
+++ b/infrastructure/docker-compose.prod.yml
@@ -1,13 +1,11 @@
-# Production stack — pull images from Docker Hub, HTTPS via Let's Encrypt (certbot).
+# Production stack — pull backend/frontend from Gitea (or Docker Hub fallback).
+# HTTPS via Let's Encrypt (certbot) on this host only (nudentic.ir).
 #
-# Server setup (minimal):
-#   1. Copy deploy.prod.env.example → .env  (DOMAIN, DOCKER_USERNAME, LETSENCRYPT_EMAIL)
-#   2. Copy secrets/*.example → ../secrets/ (database.env, backend.env) — outside git
-#   3. docker login   (private Docker Hub images)
-#   4. ./scripts/init-letsencrypt.sh   (first time only)
-#   5. docker compose -f docker-compose.prod.yml --env-file .env up -d
+# Gitea tag deploy: set REGISTRY_PREFIX=wixur.ir:3000/<owner> and TAG=v1.0.1 in .env
+# Hub fallback: omit REGISTRY_PREFIX, set DOCKER_USERNAME=dyolink (image dyolink/dyolink-*).
 #
-# Updates: docker compose pull && docker compose up -d
+# First SSL: ./scripts/init-letsencrypt.sh then up -d
+# Tag updates: CI runs scripts/prod-remote-deploy.sh (or pull + up locally)

 name: dyolink-prod

@@ -39,7 +37,7 @@ services:
      start_period: 40s

  backend:
-    image: ${DOCKER_USERNAME}/dyolink-backend:${TAG:-latest}
+    image: ${REGISTRY_PREFIX:-dyolink}/dyolink-backend:${TAG:-latest}
    container_name: dyolink_backend_prod
    depends_on:
      postgres:
@@ -68,7 +66,7 @@ services:
      start_period: 60s

  frontend:
-    image: ${DOCKER_USERNAME}/dyolink-frontend:${TAG:-latest}
+    image: ${REGISTRY_PREFIX:-dyolink}/dyolink-frontend:${TAG:-latest}
    container_name: dyolink_frontend_prod
    depends_on:
      - backend
@@ -88,7 +86,8 @@ services:
        max-size: "10m"
        max-file: "3"
    healthcheck:
-      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:3000/', (r) => {if(r.statusCode!==200)process.exit(1)})"]
+      # Next.js `/` redirects to `/en` — accept 2xx/3xx.
+      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:3000/', (r) => { process.exit(r.statusCode >= 200 && r.statusCode < 400 ? 0 : 1); }).on('error', () => process.exit(1))"]
      interval: 30s
      timeout: 10s
      retries: 3
--- a/infrastructure/docker-compose.registry.yml
+++ b/infrastructure/docker-compose.registry.yml
@@ -2,7 +2,7 @@
 # No backend/frontend source on the deployment host except this compose file + config + secrets.
 #
 # Required env (see deploy.registry.env.example):
-#   REGISTRY_PREFIX   e.g. 178.131.50.201:3000/yourgiteauser  (no protocol, no trailing slash)
+#   REGISTRY_PREFIX   e.g. host.docker.internal:3000/admin (Windows CI) or wixur.ir:3000/admin (no protocol)
 #   IMAGE_TAG         short sha or "latest" (CI sets this per deploy)
 # Optional:
 #   DEPLOY_SECRETS_DIR   absolute path on the server to database/backend *.env files (see below)
@@ -91,8 +91,8 @@ services:
      frontend:
        condition: service_healthy
    ports:
-      # Bind a private localhost port — Windows portproxy already owns public 8088.
-      # See STAGING-DEPLOY.md §7: portproxy 0.0.0.0:8088 → 127.0.0.1:18088
+      # Bind a private localhost port — Windows portproxy owns public 80 (http://wixur.ir).
+      # See STAGING-DEPLOY.md §7: portproxy 0.0.0.0:80 → 127.0.0.1:18088
      - "127.0.0.1:${STAGING_LOCAL_PORT:-18088}:80"
    volumes:
      - ./nginx/http-only.conf:/etc/nginx/conf.d/default.conf:ro
--- a/infrastructure/docker-compose.staging.yml
+++ b/infrastructure/docker-compose.staging.yml
@@ -60,8 +60,8 @@ services:
      context: ../frontend
      dockerfile: Dockerfile
      args:
-        NEXT_PUBLIC_API_URL: ${STAGING_NEXT_PUBLIC_API_URL:-http://178.131.50.201:8088/api}
-        NEXT_PUBLIC_APP_URL: ${STAGING_NEXT_PUBLIC_APP_URL:-http://178.131.50.201:8088}
+        NEXT_PUBLIC_API_URL: ${STAGING_NEXT_PUBLIC_API_URL:-http://wixur.ir/api}
+        NEXT_PUBLIC_APP_URL: ${STAGING_NEXT_PUBLIC_APP_URL:-http://wixur.ir}
        NEXT_PUBLIC_APP_NAME: ${STAGING_NEXT_PUBLIC_APP_NAME:-Dyolink}
    container_name: dyolink_frontend_staging
    depends_on:
--- a/infrastructure/env.staging.example
+++ b/infrastructure/env.staging.example
@@ -1,13 +1,13 @@
 # Copy to .env.staging next to docker-compose.staging.yml (optional).
 # Used only for compose variable substitution (build args, host port).

-STAGING_HTTP_PORT=8088
+STAGING_HTTP_PORT=80

 # Public URLs baked into the frontend image at build time — must match how users open the app.
-STAGING_NEXT_PUBLIC_API_URL=http://178.131.50.201:8088/api
-STAGING_NEXT_PUBLIC_APP_URL=http://178.131.50.201:8088
+STAGING_NEXT_PUBLIC_API_URL=http://wixur.ir/api
+STAGING_NEXT_PUBLIC_APP_URL=http://wixur.ir
 STAGING_NEXT_PUBLIC_APP_NAME=Dyolink

-# Change the IP/port if your server address differs.
+# Must match how users open staging (http://wixur.ir).

 # Registry / pull-only deploy (see deploy.registry.env.example + docker-compose.registry.yml).
--- a/infrastructure/nginx/windows-edge-http.conf
+++ b/infrastructure/nginx/windows-edge-http.conf
@@ -0,0 +1,78 @@
+# Windows host nginx.conf — paste over
+#   C:\tools\nginx-1.29.5\conf\nginx.conf
+#
+# :80  — LAN / 127.0.0.1 only (Mobinnet keeps public :80 for the modem)
+# :443 — public https://wixur.ir  (router must forward 443 → this PC)
+#
+# Put Let's Encrypt PEMs in conf\ssl\ (win-acme --pemfilesname wixur):
+#   ssl\wixur-chain.pem
+#   ssl\wixur-key.pem
+#
+# After save: nginx -t   then restart nginx
+#   curl.exe https://wixur.ir/health   →  healthy
+# (curl to 127.0.0.1:443 fails name-check; cert is for wixur.ir)
+
+#user  nobody;
+worker_processes  1;
+
+events {
+    worker_connections  1024;
+}
+
+
+http {
+    include       mime.types;
+    default_type  application/octet-stream;
+
+    sendfile        on;
+    keepalive_timeout  65;
+    client_max_body_size 50M;
+
+    # Shared proxy to Docker staging
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        ''      close;
+    }
+
+    server {
+        listen       80 default_server;
+        listen       [::]:80 default_server;
+        server_name  wixur.ir www.wixur.ir localhost 127.0.0.1;
+
+        location / {
+            proxy_pass http://127.0.0.1:18088;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_read_timeout 300;
+            proxy_connect_timeout 300;
+        }
+    }
+
+    server {
+        listen       443 ssl;
+        listen       [::]:443 ssl;
+        server_name  wixur.ir www.wixur.ir localhost 127.0.0.1;
+
+        ssl_certificate      ssl/wixur-chain.pem;
+        ssl_certificate_key  ssl/wixur-key.pem;
+        ssl_protocols        TLSv1.2 TLSv1.3;
+
+        location / {
+            proxy_pass http://127.0.0.1:18088;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_read_timeout 300;
+            proxy_connect_timeout 300;
+        }
+    }
+}
--- a/infrastructure/nginx/windows-ssl-letsencrypt.snippet.conf
+++ b/infrastructure/nginx/windows-ssl-letsencrypt.snippet.conf
@@ -0,0 +1,4 @@
+# After win-acme writes Let's Encrypt PEMs into conf/ssl/:
+#   ssl_certificate      ssl/wixur-chain.pem;
+#   ssl_certificate_key  ssl/wixur-key.pem;
+# (exact filenames: dir C:\tools\nginx-1.29.5\conf\ssl )
--- a/infrastructure/scripts/prod-remote-deploy.sh
+++ b/infrastructure/scripts/prod-remote-deploy.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Run on the Linux production host (CI SSHs here after pushing :v* images).
+# Usage: ./prod-remote-deploy.sh v1.0.1
+set -euo pipefail
+
+TAG="${1:?usage: prod-remote-deploy.sh v1.0.1}"
+INFRA="${PROD_INFRA_DIR:-/opt/dyolink/infrastructure}"
+cd "$INFRA"
+
+if [ ! -f .env ]; then
+  echo "Missing $INFRA/.env — copy deploy.prod.env.example and set DOMAIN=nudentic.ir REGISTRY_PREFIX=wixur.ir:3000/<owner>"
+  exit 1
+fi
+
+if ! grep -q '^REGISTRY_PREFIX=.\+' .env; then
+  echo "Set REGISTRY_PREFIX in .env (Gitea registry, e.g. wixur.ir:3000/admin). Do not use Docker Hub :latest for tag deploys."
+  exit 1
+fi
+
+export TAG
+echo "Pulling backend/frontend :$TAG from Gitea (REGISTRY_PREFIX in .env)"
+docker compose -f docker-compose.prod.yml --env-file .env pull backend frontend
+docker compose -f docker-compose.prod.yml --env-file .env up -d
+echo "=== Status ==="
+docker compose -f docker-compose.prod.yml --env-file .env ps
+echo "Health: https://nudentic.ir/api/health"
--- a/infrastructure/scripts/windows-renew-wixur-cert.cmd
+++ b/infrastructure/scripts/windows-renew-wixur-cert.cmd
@@ -0,0 +1,11 @@
+@echo off
+REM Run as Administrator. Stops nginx so win-acme can bind 443 (TLS-ALPN),
+REM renews, then starts nginx again. Point the win-acme scheduled task here
+REM instead of calling wacs.exe directly.
+cd /d C:\tools\nginx-1.29.5
+taskkill /F /IM nginx.exe >nul 2>&1
+timeout /t 2 /nobreak >nul
+cd /d C:\tools\win-acme
+wacs.exe --renew --closeonfinish
+cd /d C:\tools\nginx-1.29.5
+start "" nginx.exe
Author	SHA1	Message	Date
rameen	573e5e0886	auto deploy on production server now finalized ready for smoke test. All checks were successful Production — tag build, push, deploy / build-and-push (push) Successful in 4m23s Details Production — tag build, push, deploy / deploy (push) Successful in 11m52s Details	2026-08-29 16:25:27 +03:30
rameen	23c37519b5	windows ssl	2026-08-29 14:46:41 +03:30
rameen	2e2c910d22	Document staging HTTPS on wixur.ir (Windows nginx + Let's Encrypt). Mobinnet holds public port 80, so staging is served on 443. Examples and the host nginx template now match FRONTEND_URL=https://wixur.ir. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-29 14:46:05 +03:30
rameen	c40e276b8a	migrate from http://178.131.50.201:8088 to wixur.ir	2026-08-29 12:09:50 +03:30