From 013c829c9206ef80312d70dc9300fe47adcf00e0 Mon Sep 17 00:00:00 2001
From: Dmitry <cinnabarflower@gmail.com>
Date: Sun, 23 Nov 2025 00:14:18 +0300
Subject: [PATCH] stuff

---
 .forgejo/workflows/deploy.yaml        | 179 +++++++++++++++++++++++++-
 tools/ci/deploy.yaml                  |  77 ++++++++++-
 tools/deploy/backend/deploy_remote.sh |  77 ++++++++++-
 tools/deploy/backend/server_build.sh  |  75 -----------
 4 files changed, 314 insertions(+), 94 deletions(-)
 delete mode 100644 tools/deploy/backend/server_build.sh

diff --git a/.forgejo/workflows/deploy.yaml b/.forgejo/workflows/deploy.yaml
index f54903c..8c60b71 100644
--- a/.forgejo/workflows/deploy.yaml
+++ b/.forgejo/workflows/deploy.yaml
@@ -15,6 +15,11 @@ jobs:
     name: Deploy Backend
     runs-on: ubuntu-latest
     steps:
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
       - name: Checkout code
         uses: actions/checkout@v3
 
@@ -42,13 +47,173 @@ jobs:
             mnemo_cards_backend \
             ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }}:~/
 
-          # Sync build script
-          rsync -avz tools/deploy/backend/server_build.sh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }}:~/mnemo_cards_backend/
-          ssh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} "chmod +x ~/mnemo_cards_backend/server_build.sh"
-
-      - name: Trigger Remote Build
+      - name: Obtain Certificates
         run: |
-          ssh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} "~/mnemo_cards_backend/server_build.sh"
+          ssh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} << 'ENDSSH'
+            set -e
+            echo "🔐 Checking Let's Encrypt certificates..."
+            
+            # Проверяем наличие multi-domain сертификата
+            if [ -d "/etc/letsencrypt/live/mnemo-cards.online" ] && [ -f "/etc/letsencrypt/live/mnemo-cards.online/fullchain.pem" ]; then
+                echo "✅ Let's Encrypt multi-domain сертификаты уже существуют"
+            else
+                echo "⚠️  Сертификаты не найдены. Пытаемся получить через webroot (nginx продолжает работать)..."
+                
+                # Убеждаемся, что nginx запущен
+                if ! sudo systemctl is-active --quiet nginx; then
+                    echo "🚀 Запускаем nginx для webroot режима..."
+                    sudo systemctl start nginx
+                fi
+                
+                # Создаем директорию для webroot challenge
+                sudo mkdir -p /var/www/html/.well-known/acme-challenge
+                sudo chown -R www-data:www-data /var/www/html
+                
+                # Убеждаемся, что nginx может обслуживать ACME challenge
+                # Проверяем, есть ли конфигурация для /.well-known
+                if ! grep -q "\.well-known" /etc/nginx/sites-enabled/* 2>/dev/null; then
+                    echo "📝 Добавляем поддержку ACME challenge в nginx..."
+                    # Создаем временную конфигурацию для ACME challenge
+                    sudo tee /etc/nginx/sites-available/acme-challenge > /dev/null << 'NGINX_EOF'
+server {
+    listen 80;
+    server_name _;
+    
+    location /.well-known/acme-challenge/ {
+        root /var/www/html;
+        try_files $uri =404;
+    }
+    
+    location / {
+        return 404;
+    }
+}
+NGINX_EOF
+                    sudo ln -sf /etc/nginx/sites-available/acme-challenge /etc/nginx/sites-enabled/acme-challenge
+                    sudo nginx -t && sudo systemctl reload nginx
+                fi
+                
+                # Получаем multi-domain сертификат через webroot
+                echo "🔐 Получаем Let's Encrypt multi-domain сертификат через webroot..."
+                if sudo certbot certonly --webroot \
+                    -w /var/www/html \
+                    -d mnemo-cards.online \
+                    -d api.mnemo-cards.online \
+                    -d code.mnemo-cards.online \
+                    -d vscode.mnemo-cards.online \
+                    --cert-name mnemo-cards.online \
+                    --non-interactive --agree-tos --email admin@mnemo-cards.online; then
+                    echo "✅ Let's Encrypt multi-domain сертификат успешно получен через webroot!"
+                else
+                    echo "⚠️  Не удалось получить сертификат через webroot. Продолжаем без HTTPS..."
+                fi
+            fi
+          ENDSSH
+
+      - name: Get Dependencies
+        run: |
+          ssh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} << 'ENDSSH'
+            set -e
+            cd ~/mnemo_cards_backend
+            echo "📦 Getting dependencies..."
+            dart pub get
+          ENDSSH
+
+      - name: Compile Server
+        run: |
+          ssh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} << 'ENDSSH'
+            set -e
+            cd ~/mnemo_cards_backend
+            echo "🔨 Compiling server..."
+            dart compile exe --verbose lib/main.dart -o server_build.exe
+          ENDSSH
+
+      - name: Stop Service
+        run: |
+          ssh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} << 'ENDSSH'
+            set -e
+            echo "🛑 Stopping service..."
+            sudo systemctl stop mnemo_cards_server || true
+          ENDSSH
+
+      - name: Update Service Configuration
+        run: |
+          ssh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} << 'ENDSSH'
+            set -e
+            cd ~/mnemo_cards_backend
+            echo "⚙️ Updating service configuration..."
+            sudo chmod 777 mnemo_cards_server.service
+            sudo cp mnemo_cards_server.service /etc/systemd/system/
+          ENDSSH
+
+      - name: Update Executable
+        run: |
+          ssh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} << 'ENDSSH'
+            set -e
+            cd ~/mnemo_cards_backend
+            echo "🔄 Replacing executable..."
+            sudo cp server_build.exe server.exe
+            rm server_build.exe
+          ENDSSH
+
+      - name: Configure Certificates
+        run: |
+          ssh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} << 'ENDSSH'
+            set -e
+            # Check certificates and configure mode
+            # Используем multi-domain сертификат mnemo-cards.online (если есть)
+            if [ -d "/etc/letsencrypt/live/mnemo-cards.online" ] && [ -f "/etc/letsencrypt/live/mnemo-cards.online/fullchain.pem" ]; then
+                echo "✅ Let's Encrypt multi-domain сертификат найден. Настраиваем HTTPS режим..."
+                sudo sed -i 's|ExecStart=/root/mnemo_cards_backend/server.exe.*|ExecStart=/root/mnemo_cards_backend/server.exe --certs /etc/letsencrypt/live/mnemo-cards.online -a 0.0.0.0 -p 8081|' /etc/systemd/system/mnemo_cards_server.service
+            elif [ -d "/etc/letsencrypt/live/api.mnemo-cards.online" ]; then
+                echo "✅ Let's Encrypt сертификат для API найден. Настраиваем dual mode..."
+                sudo sed -i 's|ExecStart=/root/mnemo_cards_backend/server.exe.*|ExecStart=/root/mnemo_cards_backend/server.exe --dual --certs /etc/letsencrypt/live/api.mnemo-cards.online -a 0.0.0.0 -p 8081|' /etc/systemd/system/mnemo_cards_server.service
+            else
+                echo "⚠️ No certificates found. Configuring HTTP mode..."
+                sudo sed -i 's|ExecStart=/root/mnemo_cards_backend/server.exe.*|ExecStart=/root/mnemo_cards_backend/server.exe -a 0.0.0.0 -p 8081|' /etc/systemd/system/mnemo_cards_server.service
+            fi
+          ENDSSH
+
+      - name: Restart Service
+        run: |
+          ssh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} << 'ENDSSH'
+            set -e
+            echo "🚀 Restarting service..."
+            sudo systemctl daemon-reload
+            sudo systemctl start mnemo_cards_server
+            sleep 2
+            systemctl status mnemo_cards_server --no-pager
+          ENDSSH
+
+      - name: Ensure Nginx Running
+        run: |
+          ssh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} << 'ENDSSH'
+            set -e
+            echo "🔍 Проверяем статус nginx..."
+            if sudo systemctl is-active --quiet nginx; then
+                echo "✅ nginx уже запущен"
+                # Перезагружаем конфигурацию на всякий случай
+                if sudo nginx -t 2>/dev/null; then
+                    sudo systemctl reload nginx
+                    echo "✅ Конфигурация nginx перезагружена"
+                fi
+            else
+                echo "⚠️  nginx не запущен, запускаем..."
+                if sudo nginx -t 2>/dev/null; then
+                    sudo systemctl start nginx
+                    sleep 2
+                    if sudo systemctl is-active --quiet nginx; then
+                        echo "✅ nginx успешно запущен"
+                    else
+                        echo "❌ Ошибка: не удалось запустить nginx!"
+                        sudo systemctl status nginx --no-pager || true
+                    fi
+                else
+                    echo "❌ Ошибка в конфигурации nginx!"
+                    sudo nginx -t || true
+                fi
+            fi
+          ENDSSH
 
   deploy-web:
     name: Deploy Web App
@@ -71,7 +236,7 @@ jobs:
 
       - name: Install Dependencies
         run: |
-          apt-get update && apt-get install -y rsync openssh-client jq git
+          apt-get update && apt-get install -y rsync openssh-client jq git nodejs npm
     
       - name: Setup SSH
         run: |
diff --git a/tools/ci/deploy.yaml b/tools/ci/deploy.yaml
index bdbc2bc..054cb34 100644
--- a/tools/ci/deploy.yaml
+++ b/tools/ci/deploy.yaml
@@ -34,13 +34,78 @@ jobs:
             mnemo_cards_backend \
             ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }}:~/
 
-          # Sync build script
-          rsync -avz tools/deploy/backend/server_build.sh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }}:~/mnemo_cards_backend/
-          ssh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} "chmod +x ~/mnemo_cards_backend/server_build.sh"
-
-      - name: Trigger Remote Build
+      - name: Build and Deploy Backend
         run: |
-          ssh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} "~/mnemo_cards_backend/server_build.sh"
+          ssh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} << 'ENDSSH'
+            set -e -v
+            
+            cd ~/mnemo_cards_backend
+            
+            # Get dependencies and compile
+            echo "📦 Getting dependencies..."
+            dart pub get
+            
+            echo "🔨 Compiling server..."
+            dart compile exe --verbose lib/main.dart -o server_build.exe
+            
+            # Stop service
+            echo "🛑 Stopping service..."
+            sudo systemctl stop mnemo_cards_server || true
+            
+            # Update service file
+            echo "⚙️ Updating service configuration..."
+            sudo chmod 777 mnemo_cards_server.service
+            sudo cp mnemo_cards_server.service /etc/systemd/system/
+            
+            # Update executable
+            echo "🔄 Replacing executable..."
+            sudo cp server_build.exe server.exe
+            rm server_build.exe
+            
+            # Check certificates and configure mode
+            if [ -d "/etc/letsencrypt/live/api.mnemo-cards.online" ]; then
+                echo "✅ Let's Encrypt certificates found. Configuring dual mode..."
+                sudo sed -i 's|ExecStart=/root/mnemo_cards_backend/server.exe.*|ExecStart=/root/mnemo_cards_backend/server.exe --dual --certs /etc/letsencrypt/live/api.mnemo-cards.online -a 0.0.0.0 -p 8081|' /etc/systemd/system/mnemo_cards_server.service
+            else
+                echo "⚠️ No certificates found. Configuring HTTP mode..."
+                sudo sed -i 's|ExecStart=/root/mnemo_cards_backend/server.exe.*|ExecStart=/root/mnemo_cards_backend/server.exe -a 0.0.0.0 -p 8081|' /etc/systemd/system/mnemo_cards_server.service
+            fi
+            
+            # Reload and restart
+            echo "🚀 Restarting service..."
+            sudo systemctl daemon-reload
+            sudo systemctl start mnemo_cards_server
+            
+            # Check status
+            sleep 2
+            systemctl status mnemo_cards_server --no-pager
+            
+            # Гарантируем, что nginx запущен (важно для работы code.mnemo-cards.online)
+            echo "🔍 Проверяем статус nginx..."
+            if sudo systemctl is-active --quiet nginx; then
+                echo "✅ nginx уже запущен"
+                # Перезагружаем конфигурацию на всякий случай
+                if sudo nginx -t 2>/dev/null; then
+                    sudo systemctl reload nginx
+                    echo "✅ Конфигурация nginx перезагружена"
+                fi
+            else
+                echo "⚠️  nginx не запущен, запускаем..."
+                if sudo nginx -t 2>/dev/null; then
+                    sudo systemctl start nginx
+                    sleep 2
+                    if sudo systemctl is-active --quiet nginx; then
+                        echo "✅ nginx успешно запущен"
+                    else
+                        echo "❌ Ошибка: не удалось запустить nginx!"
+                        sudo systemctl status nginx --no-pager || true
+                    fi
+                else
+                    echo "❌ Ошибка в конфигурации nginx!"
+                    sudo nginx -t || true
+                fi
+            fi
+          ENDSSH
 
   deploy-web:
     name: Deploy Web App
diff --git a/tools/deploy/backend/deploy_remote.sh b/tools/deploy/backend/deploy_remote.sh
index a327735..8e8e187 100755
--- a/tools/deploy/backend/deploy_remote.sh
+++ b/tools/deploy/backend/deploy_remote.sh
@@ -32,13 +32,78 @@ rsync -avz --delete --exclude '.*' --exclude 'build' --exclude 'server.exe' \
     mnemo_cards_backend \
     "${SERVER_USER}@${SERVER_IP}:~/"
 
-# Sync build script
-rsync -avz tools/deploy/backend/server_build.sh "${SERVER_USER}@${SERVER_IP}:~/mnemo_cards_backend/"
-ssh "${SERVER_USER}@${SERVER_IP}" "chmod +x ~/mnemo_cards_backend/server_build.sh"
-
 echo -e "${BLUE}[INFO]${NC} Triggering remote build..."
 
-# Execute remote build script
-ssh -t "${SERVER_USER}@${SERVER_IP}" "~/mnemo_cards_backend/server_build.sh"
+# Execute build directly via SSH
+ssh -t "${SERVER_USER}@${SERVER_IP}" << 'ENDSSH'
+  set -e -v
+  
+  cd ~/mnemo_cards_backend
+  
+  # Get dependencies and compile
+  echo "📦 Getting dependencies..."
+  dart pub get
+  
+  echo "🔨 Compiling server..."
+  dart compile exe --verbose lib/main.dart -o server_build.exe
+  
+  # Stop service
+  echo "🛑 Stopping service..."
+  sudo systemctl stop mnemo_cards_server || true
+  
+  # Update service file
+  echo "⚙️ Updating service configuration..."
+  sudo chmod 777 mnemo_cards_server.service
+  sudo cp mnemo_cards_server.service /etc/systemd/system/
+  
+  # Update executable
+  echo "🔄 Replacing executable..."
+  sudo cp server_build.exe server.exe
+  rm server_build.exe
+  
+  # Check certificates and configure mode
+  if [ -d "/etc/letsencrypt/live/api.mnemo-cards.online" ]; then
+      echo "✅ Let's Encrypt certificates found. Configuring dual mode..."
+      sudo sed -i 's|ExecStart=/root/mnemo_cards_backend/server.exe.*|ExecStart=/root/mnemo_cards_backend/server.exe --dual --certs /etc/letsencrypt/live/api.mnemo-cards.online -a 0.0.0.0 -p 8081|' /etc/systemd/system/mnemo_cards_server.service
+  else
+      echo "⚠️ No certificates found. Configuring HTTP mode..."
+      sudo sed -i 's|ExecStart=/root/mnemo_cards_backend/server.exe.*|ExecStart=/root/mnemo_cards_backend/server.exe -a 0.0.0.0 -p 8081|' /etc/systemd/system/mnemo_cards_server.service
+  fi
+  
+  # Reload and restart
+  echo "🚀 Restarting service..."
+  sudo systemctl daemon-reload
+  sudo systemctl start mnemo_cards_server
+  
+  # Check status
+  sleep 2
+  systemctl status mnemo_cards_server --no-pager
+  
+  # Гарантируем, что nginx запущен (важно для работы code.mnemo-cards.online)
+  echo "🔍 Проверяем статус nginx..."
+  if sudo systemctl is-active --quiet nginx; then
+      echo "✅ nginx уже запущен"
+      # Перезагружаем конфигурацию на всякий случай
+      if sudo nginx -t 2>/dev/null; then
+          sudo systemctl reload nginx
+          echo "✅ Конфигурация nginx перезагружена"
+      fi
+  else
+      echo "⚠️  nginx не запущен, запускаем..."
+      if sudo nginx -t 2>/dev/null; then
+          sudo systemctl start nginx
+          sleep 2
+          if sudo systemctl is-active --quiet nginx; then
+              echo "✅ nginx успешно запущен"
+          else
+              echo "❌ Ошибка: не удалось запустить nginx!"
+              sudo systemctl status nginx --no-pager || true
+          fi
+      else
+          echo "❌ Ошибка в конфигурации nginx!"
+          sudo nginx -t || true
+      fi
+  fi
+ENDSSH
 
 echo -e "${GREEN}[SUCCESS]${NC} Backend deployment triggered successfully!"
diff --git a/tools/deploy/backend/server_build.sh b/tools/deploy/backend/server_build.sh
deleted file mode 100644
index b6b8ad9..0000000
--- a/tools/deploy/backend/server_build.sh
+++ /dev/null
@@ -1,75 +0,0 @@
-#!/bin/bash
-
-# Script to build backend on the server
-# This script assumes source code is already present (synced via rsync)
-# Usage: ./server_build.sh
-
-set -e -v
-
-# Go to backend directory
-cd ~/mnemo_cards_backend
-
-# Get dependencies and compile
-echo "📦 Getting dependencies..."
-dart pub get
-
-echo "🔨 Compiling server..."
-dart compile exe --verbose lib/main.dart -o server_build.exe
-
-# Stop service
-echo "🛑 Stopping service..."
-sudo systemctl stop mnemo_cards_server || true
-
-# Update service file
-echo "⚙️ Updating service configuration..."
-sudo chmod 777 mnemo_cards_server.service
-sudo cp mnemo_cards_server.service /etc/systemd/system/
-
-# Update executable
-echo "🔄 Replacing executable..."
-sudo cp server_build.exe server.exe
-rm server_build.exe
-
-# Check certificates and configure mode
-if [ -d "/etc/letsencrypt/live/api.mnemo-cards.online" ]; then
-    echo "✅ Let's Encrypt certificates found. Configuring dual mode..."
-    sudo sed -i 's|ExecStart=/root/mnemo_cards_backend/server.exe.*|ExecStart=/root/mnemo_cards_backend/server.exe --dual --certs /etc/letsencrypt/live/api.mnemo-cards.online -a 0.0.0.0 -p 8081|' /etc/systemd/system/mnemo_cards_server.service
-else
-    echo "⚠️ No certificates found. Configuring HTTP mode..."
-    sudo sed -i 's|ExecStart=/root/mnemo_cards_backend/server.exe.*|ExecStart=/root/mnemo_cards_backend/server.exe -a 0.0.0.0 -p 8081|' /etc/systemd/system/mnemo_cards_server.service
-fi
-
-# Reload and restart
-echo "🚀 Restarting service..."
-sudo systemctl daemon-reload
-sudo systemctl start mnemo_cards_server
-
-# Check status
-sleep 2
-systemctl status mnemo_cards_server --no-pager
-
-# Гарантируем, что nginx запущен (важно для работы code.mnemo-cards.online)
-echo "🔍 Проверяем статус nginx..."
-if sudo systemctl is-active --quiet nginx; then
-    echo "✅ nginx уже запущен"
-    # Перезагружаем конфигурацию на всякий случай
-    if sudo nginx -t 2>/dev/null; then
-        sudo systemctl reload nginx
-        echo "✅ Конфигурация nginx перезагружена"
-    fi
-else
-    echo "⚠️  nginx не запущен, запускаем..."
-    if sudo nginx -t 2>/dev/null; then
-        sudo systemctl start nginx
-        sleep 2
-        if sudo systemctl is-active --quiet nginx; then
-            echo "✅ nginx успешно запущен"
-        else
-            echo "❌ Ошибка: не удалось запустить nginx!"
-            sudo systemctl status nginx --no-pager || true
-        fi
-    else
-        echo "❌ Ошибка в конфигурации nginx!"
-        sudo nginx -t || true
-    fi
-fi