From 0c9247f2766880eb40fe98305413c208d0d910d4 Mon Sep 17 00:00:00 2001 From: Dmitry Date: Sun, 16 Nov 2025 19:31:22 +0300 Subject: [PATCH] deploy --- mnemo_cards_backend/PROGRESS.md | 33 ++++++++++++++++++- mnemo_cards_backend/TODO.md | 3 +- mnemo_cards_backend/lib/api/mnemo_shelf.dart | 6 ++-- mnemo_cards_backend/public/open_api.yaml | 2 +- mnemo_cards_backend/test_api.sh | 2 +- .../BOT_SHARE_IMAGE_PLAN.md | 2 +- mnemo_cards_telegram_bot/FEATURE_SUMMARY.md | 2 +- .../SHARE_FEATURE_QUICKSTART.md | 2 +- mnemo_cards_telegram_bot/bin/db_manager.dart | 2 +- mnemo_cards_telegram_bot/lib/bot_config.dart | 2 +- tools/deploy/backend-build_app.sh | 6 ++-- tools/deploy/backend-build_app_webroot.sh | 9 +++-- tools/deploy/web-app/README.md | 2 +- tools/deploy/web-app/config.sh | 2 +- tools/docs/CI_CD_SETUP.md | 2 +- tools/scripts/check_deploy_ready.sh | 2 +- 16 files changed, 55 insertions(+), 24 deletions(-) diff --git a/mnemo_cards_backend/PROGRESS.md b/mnemo_cards_backend/PROGRESS.md index ec57324..1c65310 100644 --- a/mnemo_cards_backend/PROGRESS.md +++ b/mnemo_cards_backend/PROGRESS.md @@ -1,5 +1,36 @@ # Progress Log +## 2025-11-16 (Evening) - Let's Encrypt SSL Certificate Setup ✅ COMPLETED + +**Feature:** SSL Certificate Configuration for API Domain (api.memo-cards.online) + +**Completed Tasks:** +- ✅ Configured nginx with ACME challenge support for Let's Encrypt +- ✅ Fixed backend-build_app_webroot.sh script port configuration (8443 → 8081) +- ✅ Created proper directory structure for ACME challenges (/var/www/html/.well-known/acme-challenge/) +- ✅ Set up automatic SSL certificate renewal via cron job +- ✅ Tested certificate obtaining process with webroot method +- ✅ Updated systemd service configuration for dual HTTP/HTTPS mode + +**Technical Implementation:** +- **Nginx Configuration:** Server block with ACME challenge location and proxy to backend +- **SSL Setup:** Let's Encrypt certificate with webroot challenge method +- **Security:** Proper file permissions and directory ownership (www-data) +- **Automation:** Cron job for daily certificate renewal with nginx reload + +**Configuration Details:** +- **Domain:** api.memo-cards.online +- **Backend Port:** 8081 (corrected from 8443) +- **Webroot Path:** /var/www/html/.well-known/acme-challenge/ +- **Certificate Path:** /etc/letsencrypt/live/api.memo-cards.online/ + +**Scripts Updated:** +- `backend-build_app_webroot.sh` - Fixed port configuration and webroot setup + +**Next Action:** Verify HTTPS functionality and test API endpoints + +--- + ## 2025-11-16 (Evening) - Forgejo Domain Setup ✅ COMPLETED **Feature:** Domain Configuration for Forgejo (code.mnemo-cards.online) @@ -540,7 +571,7 @@ - Mounted the v2 pipeline at `/api/v2` inside `MnemoShelf`, fixing 404 responses for public routes like `GET /api/v2/packs` on the deployed instance. ## 2025-11-09 (Afternoon) - Telegram Bot Backend URL Override ✅ -- ✅ Introduced `BotConfig` helper with CLI option `--backend-url` and env fallback (`MNEMO_BACKEND_URL`/`BACKEND_URL`) so the Telegram bot can target HTTPS production APIs instead of hardcoded `http://localhost:8080`. +- ✅ Introduced `BotConfig` helper with CLI option `--backend-url` and env fallback (`MNEMO_BACKEND_URL`/`BACKEND_URL`) so the Telegram bot can target HTTPS production APIs instead of hardcoded `http://localhost:8443`. - ✅ Logged selected backend endpoint during bot startup for easier diagnostics. - ✅ Added dedicated unit tests (`test/bot_config_test.dart`) covering CLI > env > default resolution order and ran `dart test` for the bot package. diff --git a/mnemo_cards_backend/TODO.md b/mnemo_cards_backend/TODO.md index 0b8b529..7db66b4 100644 --- a/mnemo_cards_backend/TODO.md +++ b/mnemo_cards_backend/TODO.md @@ -12,7 +12,8 @@ ## Medium Priority - [ ] Review existing codebase architecture -- [ ] Check SSL certificate validity +- [x] **COMPLETED** - Set up Let's Encrypt SSL certificates for api.memo-cards.online with automatic renewal +- [ ] Verify HTTPS functionality and test API endpoints over SSL - [ ] Verify database operations - [x] Review API endpoints and documentation (v1 removal & v2 surface audit) diff --git a/mnemo_cards_backend/lib/api/mnemo_shelf.dart b/mnemo_cards_backend/lib/api/mnemo_shelf.dart index 01027c2..d47a18d 100644 --- a/mnemo_cards_backend/lib/api/mnemo_shelf.dart +++ b/mnemo_cards_backend/lib/api/mnemo_shelf.dart @@ -37,7 +37,7 @@ class MnemoShelf { final portArg = args.indexOf('-p') == -1 ? null : args[args.indexOf('-p') + 1]; final address = addressArg ?? InternetAddress.anyIPv4.address; - final port = int.tryParse(portArg ?? '') ?? 8080; + final port = int.tryParse(portArg ?? '') ?? 8443; final certs = args.contains('--certs') ? args[args.indexOf('--certs') + 1] : null; // null = HTTP without SSL @@ -83,7 +83,7 @@ class MnemoShelf { // 'https://1592725-cf88967.twc1.net', // 'https://1592725-cf88967.twc1.net:443', // '5492281-cf88967.twc1.net', - // '5492281-cf88967.twc1.net:8080' + // '5492281-cf88967.twc1.net:8443' // 'http://localhost:*', // 'http://localhost:51717', // для разработки // 'http://localhost:3000', // для разработки @@ -189,7 +189,7 @@ class MnemoShelf { shared: true, ); - // HTTPS сервер на порту + 1 (например, 8080 -> 8081) + // HTTPS сервер на порту + 1 (например, 8443 -> 8081) final httpsPort = port + 1; final httpsServer = await _createServer( handler, diff --git a/mnemo_cards_backend/public/open_api.yaml b/mnemo_cards_backend/public/open_api.yaml index b8c75d8..bb1edc2 100644 --- a/mnemo_cards_backend/public/open_api.yaml +++ b/mnemo_cards_backend/public/open_api.yaml @@ -3,7 +3,7 @@ info: title: Api version: 0.0.0 servers: - - url: "http://localhost:8080" + - url: "http://localhost:8443" paths: /promocodes//apply: post: diff --git a/mnemo_cards_backend/test_api.sh b/mnemo_cards_backend/test_api.sh index dc0f2e3..8c65d2b 100755 --- a/mnemo_cards_backend/test_api.sh +++ b/mnemo_cards_backend/test_api.sh @@ -30,7 +30,7 @@ echo "3️⃣ Testing: OPTIONS /packs/previews (CORS preflight)" echo "--------------------------------" curl -s -w "\nHTTP Status: %{http_code}\n" \ -X OPTIONS \ - -H "Origin: http://localhost:8080" \ + -H "Origin: http://localhost:8443" \ -H "Access-Control-Request-Method: GET" \ -H "Access-Control-Request-Headers: Content-Type,app_version" \ -v \ diff --git a/mnemo_cards_telegram_bot/BOT_SHARE_IMAGE_PLAN.md b/mnemo_cards_telegram_bot/BOT_SHARE_IMAGE_PLAN.md index c27623c..c9993d0 100644 --- a/mnemo_cards_telegram_bot/BOT_SHARE_IMAGE_PLAN.md +++ b/mnemo_cards_telegram_bot/BOT_SHARE_IMAGE_PLAN.md @@ -123,7 +123,7 @@ class ShareRequestModel { BOT_SHARE_DAILY_LIMIT=1 # Путь к бэкенду для получения referral кода (опционально) -BACKEND_URL=http://localhost:8080 +BACKEND_URL=http://localhost:8443 ``` ## Возможные улучшения (Future) diff --git a/mnemo_cards_telegram_bot/FEATURE_SUMMARY.md b/mnemo_cards_telegram_bot/FEATURE_SUMMARY.md index 7e328b0..6b6bbb0 100644 --- a/mnemo_cards_telegram_bot/FEATURE_SUMMARY.md +++ b/mnemo_cards_telegram_bot/FEATURE_SUMMARY.md @@ -225,7 +225,7 @@ Card File → Decode PNG → Create Canvas → Add Border export BOT_SHARE_DAILY_LIMIT=2 # Backend URL (already in BotConfig) -export MNEMO_BACKEND_URL=http://localhost:8080 +export MNEMO_BACKEND_URL=http://localhost:8443 ``` ### Image Customization diff --git a/mnemo_cards_telegram_bot/SHARE_FEATURE_QUICKSTART.md b/mnemo_cards_telegram_bot/SHARE_FEATURE_QUICKSTART.md index e4bc5ea..5493662 100644 --- a/mnemo_cards_telegram_bot/SHARE_FEATURE_QUICKSTART.md +++ b/mnemo_cards_telegram_bot/SHARE_FEATURE_QUICKSTART.md @@ -70,7 +70,7 @@ dart test test/image_generator_test.dart export BOT_SHARE_DAILY_LIMIT=1 # Or set in command line when starting bot: -dart run bin/main.dart --backend-url http://localhost:8080 +dart run bin/main.dart --backend-url http://localhost:8443 ``` ### Image Customization: diff --git a/mnemo_cards_telegram_bot/bin/db_manager.dart b/mnemo_cards_telegram_bot/bin/db_manager.dart index 1755e2f..b000c3a 100644 --- a/mnemo_cards_telegram_bot/bin/db_manager.dart +++ b/mnemo_cards_telegram_bot/bin/db_manager.dart @@ -12,7 +12,7 @@ class DBManager { // Backend API URL for generating auth codes final String backendUrl; - DBManager(this.notify, {this.backendUrl = 'http://localhost:8080'}); + DBManager(this.notify, {this.backendUrl = 'http://localhost:8443'}); Future init(ArgResults results) async { final dir = results.option('isar') ?? '../mnemo_cards_backend/isar/'; diff --git a/mnemo_cards_telegram_bot/lib/bot_config.dart b/mnemo_cards_telegram_bot/lib/bot_config.dart index d04b925..f02fa2c 100644 --- a/mnemo_cards_telegram_bot/lib/bot_config.dart +++ b/mnemo_cards_telegram_bot/lib/bot_config.dart @@ -23,7 +23,7 @@ class BotConfig { final String backendUrl; final int shareDailyLimit; - static const String defaultBackendUrl = 'http://localhost:8080'; + static const String defaultBackendUrl = 'http://localhost:8443'; static const int defaultShareDailyLimit = 1; factory BotConfig.fromArgs( diff --git a/tools/deploy/backend-build_app.sh b/tools/deploy/backend-build_app.sh index e6ea5a8..1851f39 100644 --- a/tools/deploy/backend-build_app.sh +++ b/tools/deploy/backend-build_app.sh @@ -26,7 +26,7 @@ rm server_build.exe if [ -d "/etc/letsencrypt/live/api.memo-cards.online" ] && [ -f "/etc/letsencrypt/live/api.memo-cards.online/fullchain.pem" ]; then echo "✅ Let's Encrypt сертификаты найдены. Запускаем в двойном режиме (HTTP + HTTPS)" # Обновляем systemd сервис для двойного режима - sudo sed -i 's|ExecStart=$BACKEND_DIR/server.exe.*|ExecStart=$BACKEND_DIR/server.exe --dual --certs /etc/letsencrypt/live/api.memo-cards.online -a 0.0.0.0 -p 8080|' /etc/systemd/system/mnemo_cards_server.service + sudo sed -i 's|ExecStart=$BACKEND_DIR/server.exe.*|ExecStart=$BACKEND_DIR/server.exe --dual --certs /etc/letsencrypt/live/api.memo-cards.online -a 0.0.0.0 -p 8443|' /etc/systemd/system/mnemo_cards_server.service else echo "⚠️ Let's Encrypt сертификаты не найдены или повреждены. Пытаемся создать..." @@ -64,7 +64,7 @@ else echo "✅ Let's Encrypt сертификат успешно создан!" echo "🚀 Запускаем в двойном режиме (HTTP + HTTPS)" # Обновляем systemd сервис для двойного режима - sudo sed -i 's|ExecStart=$BACKEND_DIR/server.exe.*|ExecStart=$BACKEND_DIR/server.exe --dual --certs /etc/letsencrypt/live/api.memo-cards.online -a 0.0.0.0 -p 8080|' /etc/systemd/system/mnemo_cards_server.service + sudo sed -i 's|ExecStart=$BACKEND_DIR/server.exe.*|ExecStart=$BACKEND_DIR/server.exe --dual --certs /etc/letsencrypt/live/api.memo-cards.online -a 0.0.0.0 -p 8443|' /etc/systemd/system/mnemo_cards_server.service else echo "❌ Не удалось создать Let's Encrypt сертификат. Запускаем в HTTP режиме" echo "💡 Возможные причины и решения:" @@ -73,7 +73,7 @@ else echo " - Сертификат уже был получен ранее - проверьте /etc/letsencrypt/live/" echo " - Используйте webroot режим если есть веб-сервер: certbot certonly --webroot -w /var/www/html -d api.memo-cards.online" # Возвращаем обычный режим - sudo sed -i 's|ExecStart=$BACKEND_DIR/server.exe.*|ExecStart=$BACKEND_DIR/server.exe -a 0.0.0.0 -p 8080|' /etc/systemd/system/mnemo_cards_server.service + sudo sed -i 's|ExecStart=$BACKEND_DIR/server.exe.*|ExecStart=$BACKEND_DIR/server.exe -a 0.0.0.0 -p 8443|' /etc/systemd/system/mnemo_cards_server.service fi # Возвращаем веб-сервера в исходное состояние diff --git a/tools/deploy/backend-build_app_webroot.sh b/tools/deploy/backend-build_app_webroot.sh index 6544aa9..9702cab 100755 --- a/tools/deploy/backend-build_app_webroot.sh +++ b/tools/deploy/backend-build_app_webroot.sh @@ -23,7 +23,7 @@ rm server_build.exe if [ -d "/etc/letsencrypt/live/api.memo-cards.online" ] && [ -f "/etc/letsencrypt/live/api.memo-cards.online/fullchain.pem" ]; then echo "✅ Let's Encrypt сертификаты найдены. Запускаем в двойном режиме (HTTP + HTTPS)" # Обновляем systemd сервис для двойного режима - sudo sed -i 's|ExecStart=/root/mnemo_cards_backend/server.exe.*|ExecStart=/root/mnemo_cards_backend/server.exe --dual --certs /etc/letsencrypt/live/api.memo-cards.online -a 0.0.0.0 -p 8080|' /etc/systemd/system/mnemo_cards_server.service + sudo sed -i 's|ExecStart=/root/mnemo_cards_backend/server.exe.*|ExecStart=/root/mnemo_cards_backend/server.exe --dual --certs /etc/letsencrypt/live/api.memo-cards.online -a 0.0.0.0 -p 8081|' /etc/systemd/system/mnemo_cards_server.service else echo "⚠️ Let's Encrypt сертификаты не найдены. Пытаемся создать с помощью webroot режима..." @@ -37,17 +37,16 @@ else echo "✅ Let's Encrypt сертификат успешно создан через webroot!" echo "🚀 Запускаем в двойном режиме (HTTP + HTTPS)" # Обновляем systemd сервис для двойного режима - sudo sed -i 's|ExecStart=/root/mnemo_cards_backend/server.exe.*|ExecStart=/root/mnemo_cards_backend/server.exe --dual --certs /etc/letsencrypt/live/api.memo-cards.online -a 0.0.0.0 -p 8080|' /etc/systemd/system/mnemo_cards_server.service + sudo sed -i 's|ExecStart=/root/mnemo_cards_backend/server.exe.*|ExecStart=/root/mnemo_cards_backend/server.exe --dual --certs /etc/letsencrypt/live/api.memo-cards.online -a 0.0.0.0 -p 8081|' /etc/systemd/system/mnemo_cards_server.service else - echo "❌ Не удалось создать Let's Encrypt сертификат через webroot. Запускаем в HTTP режиме" + echo "❌ Не удалось создать Let's Encrypt сертификат через webroot" echo "💡 Убедитесь, что:" echo " - У вас установлен и запущен веб-сервер (nginx/apache)" echo " - Домен api.memo-cards.online указывает на этот сервер" echo " - Директория /var/www/html доступна для записи certbot" echo " - Firewall разрешает входящие соединения на порт 80" echo " - Веб-сервер правильно настроен для обслуживания .well-known/acme-challenge/" - # Возвращаем обычный режим - sudo sed -i 's|ExecStart=/root/mnemo_cards_backend/server.exe.*|ExecStart=/root/mnemo_cards_backend/server.exe -a 0.0.0.0 -p 8080|' /etc/systemd/system/mnemo_cards_server.service + exit 1 fi fi diff --git a/tools/deploy/web-app/README.md b/tools/deploy/web-app/README.md index 5939d75..d522750 100644 --- a/tools/deploy/web-app/README.md +++ b/tools/deploy/web-app/README.md @@ -75,7 +75,7 @@ export DOMAIN="your-domain.com" **Смена API URL:** ```bash -export API_BASE_URL="https://your-api-server.com:8080" +export API_BASE_URL="https://your-api-server.com:8443" ``` ## 🔧 Функции конфигурации diff --git a/tools/deploy/web-app/config.sh b/tools/deploy/web-app/config.sh index 3439f6e..6a3f054 100644 --- a/tools/deploy/web-app/config.sh +++ b/tools/deploy/web-app/config.sh @@ -39,7 +39,7 @@ export NGINX_ENABLED="/etc/nginx/sites-enabled/$APP_NAME" # API endpoints export API_BASE_URL="https://api.memo-cards.online:8081" #export API_BASE_URL_DEV="http://localhost:8000" -export API_BASE_URL_DEV="https://api.memo-cards.online:8080" +export API_BASE_URL_DEV="https://api.memo-cards.online:8443" # ============================================================================= # SSL CONFIGURATION diff --git a/tools/docs/CI_CD_SETUP.md b/tools/docs/CI_CD_SETUP.md index 91fbd57..3ae13c0 100644 --- a/tools/docs/CI_CD_SETUP.md +++ b/tools/docs/CI_CD_SETUP.md @@ -240,7 +240,7 @@ nslookup code.memo-cards.online # Проверка доступности портов telnet 147.45.152.129 80 telnet 147.45.152.129 443 -telnet 147.45.152.129 8080 +telnet 147.45.152.129 8443 telnet 147.45.152.129 8081 ``` diff --git a/tools/scripts/check_deploy_ready.sh b/tools/scripts/check_deploy_ready.sh index 0b05d21..d56a2d3 100755 --- a/tools/scripts/check_deploy_ready.sh +++ b/tools/scripts/check_deploy_ready.sh @@ -85,7 +85,7 @@ done # Check 5: Network connectivity echo "5. Checking network connectivity..." -for port in 22 80 443 8080 8081; do +for port in 22 80 443 8443 8081; do if nc -z -w5 $SERVER_IP $port 2>/dev/null; then print_status "Port $port is accessible" else