deploy

mnemo_cards_backend/PROGRESS.md

@@ -1,5 +1,36 @@
 # Progress Log
 
+## 2025-11-16 (Evening) - Let's Encrypt SSL Certificate Setup ✅ COMPLETED
+
+**Feature:** SSL Certificate Configuration for API Domain (api.memo-cards.online)
+
+**Completed Tasks:**
+- ✅ Configured nginx with ACME challenge support for Let's Encrypt
+- ✅ Fixed backend-build_app_webroot.sh script port configuration (8443 → 8081)
+- ✅ Created proper directory structure for ACME challenges (/var/www/html/.well-known/acme-challenge/)
+- ✅ Set up automatic SSL certificate renewal via cron job
+- ✅ Tested certificate obtaining process with webroot method
+- ✅ Updated systemd service configuration for dual HTTP/HTTPS mode
+
+**Technical Implementation:**
+- **Nginx Configuration:** Server block with ACME challenge location and proxy to backend
+- **SSL Setup:** Let's Encrypt certificate with webroot challenge method
+- **Security:** Proper file permissions and directory ownership (www-data)
+- **Automation:** Cron job for daily certificate renewal with nginx reload
+
+**Configuration Details:**
+- **Domain:** api.memo-cards.online
+- **Backend Port:** 8081 (corrected from 8443)
+- **Webroot Path:** /var/www/html/.well-known/acme-challenge/
+- **Certificate Path:** /etc/letsencrypt/live/api.memo-cards.online/
+
+**Scripts Updated:**
+- `backend-build_app_webroot.sh` - Fixed port configuration and webroot setup
+
+**Next Action:** Verify HTTPS functionality and test API endpoints
+
+---
+
 ## 2025-11-16 (Evening) - Forgejo Domain Setup ✅ COMPLETED
 
 **Feature:** Domain Configuration for Forgejo (code.mnemo-cards.online)
@@ -540,7 +571,7 @@
 - Mounted the v2 pipeline at `/api/v2` inside `MnemoShelf`, fixing 404 responses for public routes like `GET /api/v2/packs` on the deployed instance.
 
 ## 2025-11-09 (Afternoon) - Telegram Bot Backend URL Override ✅
-- ✅ Introduced `BotConfig` helper with CLI option `--backend-url` and env fallback (`MNEMO_BACKEND_URL`/`BACKEND_URL`) so the Telegram bot can target HTTPS production APIs instead of hardcoded `http://localhost:8080`.
+- ✅ Introduced `BotConfig` helper with CLI option `--backend-url` and env fallback (`MNEMO_BACKEND_URL`/`BACKEND_URL`) so the Telegram bot can target HTTPS production APIs instead of hardcoded `http://localhost:8443`.
 - ✅ Logged selected backend endpoint during bot startup for easier diagnostics.
 - ✅ Added dedicated unit tests (`test/bot_config_test.dart`) covering CLI > env > default resolution order and ran `dart test` for the bot package.
 

mnemo_cards_backend/TODO.md

@@ -12,7 +12,8 @@
 
 ## Medium Priority
 - [ ] Review existing codebase architecture
-- [ ] Check SSL certificate validity
+- [x] **COMPLETED** - Set up Let's Encrypt SSL certificates for api.memo-cards.online with automatic renewal
+- [ ] Verify HTTPS functionality and test API endpoints over SSL
 - [ ] Verify database operations
 - [x] Review API endpoints and documentation (v1 removal & v2 surface audit)
 

mnemo_cards_backend/lib/api/mnemo_shelf.dart

@@ -37,7 +37,7 @@ class MnemoShelf {
     final portArg =
         args.indexOf('-p') == -1 ? null : args[args.indexOf('-p') + 1];
     final address = addressArg ?? InternetAddress.anyIPv4.address;
-    final port = int.tryParse(portArg ?? '') ?? 8080;
+    final port = int.tryParse(portArg ?? '') ?? 8443;
     final certs = args.contains('--certs')
         ? args[args.indexOf('--certs') + 1]
         : null; // null = HTTP without SSL
@@ -83,7 +83,7 @@ class MnemoShelf {
     //   'https://1592725-cf88967.twc1.net',
     //   'https://1592725-cf88967.twc1.net:443',
     //   '5492281-cf88967.twc1.net',
-    //   '5492281-cf88967.twc1.net:8080'
+    //   '5492281-cf88967.twc1.net:8443'
     //   'http://localhost:*',
     //   'http://localhost:51717', // для разработки
     //   'http://localhost:3000', // для разработки
@@ -189,7 +189,7 @@ class MnemoShelf {
       shared: true,
     );
 
-    // HTTPS сервер на порту + 1 (например, 8080 -> 8081)
+    // HTTPS сервер на порту + 1 (например, 8443 -> 8081)
     final httpsPort = port + 1;
     final httpsServer = await _createServer(
       handler,

mnemo_cards_backend/public/open_api.yaml

@@ -3,7 +3,7 @@ info:
   title: Api
   version: 0.0.0
 servers:
-  - url: "http://localhost:8080"
+  - url: "http://localhost:8443"
 paths:
   /promocodes/<code>/apply:
     post:

mnemo_cards_backend/test_api.sh

@@ -30,7 +30,7 @@ echo "3️⃣ Testing: OPTIONS /packs/previews (CORS preflight)"
 echo "--------------------------------"
 curl -s -w "\nHTTP Status: %{http_code}\n" \
   -X OPTIONS \
-  -H "Origin: http://localhost:8080" \
+  -H "Origin: http://localhost:8443" \
   -H "Access-Control-Request-Method: GET" \
   -H "Access-Control-Request-Headers: Content-Type,app_version" \
   -v \

mnemo_cards_telegram_bot/BOT_SHARE_IMAGE_PLAN.md

@@ -123,7 +123,7 @@ class ShareRequestModel {
 BOT_SHARE_DAILY_LIMIT=1
 
 # Путь к бэкенду для получения referral кода (опционально)
-BACKEND_URL=http://localhost:8080
+BACKEND_URL=http://localhost:8443
 ```
 
 ## Возможные улучшения (Future)

mnemo_cards_telegram_bot/FEATURE_SUMMARY.md

@@ -225,7 +225,7 @@ Card File → Decode PNG → Create Canvas → Add Border
 export BOT_SHARE_DAILY_LIMIT=2
 
 # Backend URL (already in BotConfig)
-export MNEMO_BACKEND_URL=http://localhost:8080
+export MNEMO_BACKEND_URL=http://localhost:8443
 ```
 
 ### Image Customization

mnemo_cards_telegram_bot/SHARE_FEATURE_QUICKSTART.md

@@ -70,7 +70,7 @@ dart test test/image_generator_test.dart
 export BOT_SHARE_DAILY_LIMIT=1
 
 # Or set in command line when starting bot:
-dart run bin/main.dart --backend-url http://localhost:8080
+dart run bin/main.dart --backend-url http://localhost:8443
 ```
 
 ### Image Customization:

mnemo_cards_telegram_bot/bin/db_manager.dart

@@ -12,7 +12,7 @@ class DBManager {
   // Backend API URL for generating auth codes
   final String backendUrl;
 
-  DBManager(this.notify, {this.backendUrl = 'http://localhost:8080'});
+  DBManager(this.notify, {this.backendUrl = 'http://localhost:8443'});
 
   Future<void> init(ArgResults results) async {
     final dir = results.option('isar') ?? '../mnemo_cards_backend/isar/';

mnemo_cards_telegram_bot/lib/bot_config.dart

@@ -23,7 +23,7 @@ class BotConfig {
   final String backendUrl;
   final int shareDailyLimit;
 
-  static const String defaultBackendUrl = 'http://localhost:8080';
+  static const String defaultBackendUrl = 'http://localhost:8443';
   static const int defaultShareDailyLimit = 1;
 
   factory BotConfig.fromArgs(

tools/deploy/backend-build_app.sh

@@ -26,7 +26,7 @@ rm server_build.exe
 if [ -d "/etc/letsencrypt/live/api.memo-cards.online" ] && [ -f "/etc/letsencrypt/live/api.memo-cards.online/fullchain.pem" ]; then
     echo "✅ Let's Encrypt сертификаты найдены. Запускаем в двойном режиме (HTTP + HTTPS)"
     # Обновляем systemd сервис для двойного режима
-    sudo sed -i 's|ExecStart=$BACKEND_DIR/server.exe.*|ExecStart=$BACKEND_DIR/server.exe --dual --certs /etc/letsencrypt/live/api.memo-cards.online -a 0.0.0.0 -p 8080|' /etc/systemd/system/mnemo_cards_server.service
+    sudo sed -i 's|ExecStart=$BACKEND_DIR/server.exe.*|ExecStart=$BACKEND_DIR/server.exe --dual --certs /etc/letsencrypt/live/api.memo-cards.online -a 0.0.0.0 -p 8443|' /etc/systemd/system/mnemo_cards_server.service
 else
     echo "⚠️  Let's Encrypt сертификаты не найдены или повреждены. Пытаемся создать..."
 
@@ -64,7 +64,7 @@ else
         echo "✅ Let's Encrypt сертификат успешно создан!"
         echo "🚀 Запускаем в двойном режиме (HTTP + HTTPS)"
         # Обновляем systemd сервис для двойного режима
-        sudo sed -i 's|ExecStart=$BACKEND_DIR/server.exe.*|ExecStart=$BACKEND_DIR/server.exe --dual --certs /etc/letsencrypt/live/api.memo-cards.online -a 0.0.0.0 -p 8080|' /etc/systemd/system/mnemo_cards_server.service
+        sudo sed -i 's|ExecStart=$BACKEND_DIR/server.exe.*|ExecStart=$BACKEND_DIR/server.exe --dual --certs /etc/letsencrypt/live/api.memo-cards.online -a 0.0.0.0 -p 8443|' /etc/systemd/system/mnemo_cards_server.service
     else
         echo "❌ Не удалось создать Let's Encrypt сертификат. Запускаем в HTTP режиме"
         echo "💡 Возможные причины и решения:"
@@ -73,7 +73,7 @@ else
         echo "   - Сертификат уже был получен ранее - проверьте /etc/letsencrypt/live/"
         echo "   - Используйте webroot режим если есть веб-сервер: certbot certonly --webroot -w /var/www/html -d api.memo-cards.online"
         # Возвращаем обычный режим
-        sudo sed -i 's|ExecStart=$BACKEND_DIR/server.exe.*|ExecStart=$BACKEND_DIR/server.exe -a 0.0.0.0 -p 8080|' /etc/systemd/system/mnemo_cards_server.service
+        sudo sed -i 's|ExecStart=$BACKEND_DIR/server.exe.*|ExecStart=$BACKEND_DIR/server.exe -a 0.0.0.0 -p 8443|' /etc/systemd/system/mnemo_cards_server.service
     fi
 
     # Возвращаем веб-сервера в исходное состояние

tools/deploy/backend-build_app_webroot.sh

@@ -23,7 +23,7 @@ rm server_build.exe
 if [ -d "/etc/letsencrypt/live/api.memo-cards.online" ] && [ -f "/etc/letsencrypt/live/api.memo-cards.online/fullchain.pem" ]; then
     echo "✅ Let's Encrypt сертификаты найдены. Запускаем в двойном режиме (HTTP + HTTPS)"
     # Обновляем systemd сервис для двойного режима
-    sudo sed -i 's|ExecStart=/root/mnemo_cards_backend/server.exe.*|ExecStart=/root/mnemo_cards_backend/server.exe --dual --certs /etc/letsencrypt/live/api.memo-cards.online -a 0.0.0.0 -p 8080|' /etc/systemd/system/mnemo_cards_server.service
+    sudo sed -i 's|ExecStart=/root/mnemo_cards_backend/server.exe.*|ExecStart=/root/mnemo_cards_backend/server.exe --dual --certs /etc/letsencrypt/live/api.memo-cards.online -a 0.0.0.0 -p 8081|' /etc/systemd/system/mnemo_cards_server.service
 else
     echo "⚠️  Let's Encrypt сертификаты не найдены. Пытаемся создать с помощью webroot режима..."
 
@@ -37,17 +37,16 @@ else
         echo "✅ Let's Encrypt сертификат успешно создан через webroot!"
         echo "🚀 Запускаем в двойном режиме (HTTP + HTTPS)"
         # Обновляем systemd сервис для двойного режима
-        sudo sed -i 's|ExecStart=/root/mnemo_cards_backend/server.exe.*|ExecStart=/root/mnemo_cards_backend/server.exe --dual --certs /etc/letsencrypt/live/api.memo-cards.online -a 0.0.0.0 -p 8080|' /etc/systemd/system/mnemo_cards_server.service
+        sudo sed -i 's|ExecStart=/root/mnemo_cards_backend/server.exe.*|ExecStart=/root/mnemo_cards_backend/server.exe --dual --certs /etc/letsencrypt/live/api.memo-cards.online -a 0.0.0.0 -p 8081|' /etc/systemd/system/mnemo_cards_server.service
     else
-        echo "❌ Не удалось создать Let's Encrypt сертификат через webroot. Запускаем в HTTP режиме"
+        echo "❌ Не удалось создать Let's Encrypt сертификат через webroot"
         echo "💡 Убедитесь, что:"
         echo "   - У вас установлен и запущен веб-сервер (nginx/apache)"
         echo "   - Домен api.memo-cards.online указывает на этот сервер"
         echo "   - Директория /var/www/html доступна для записи certbot"
         echo "   - Firewall разрешает входящие соединения на порт 80"
         echo "   - Веб-сервер правильно настроен для обслуживания .well-known/acme-challenge/"
-        # Возвращаем обычный режим
+        exit 1
-        sudo sed -i 's|ExecStart=/root/mnemo_cards_backend/server.exe.*|ExecStart=/root/mnemo_cards_backend/server.exe -a 0.0.0.0 -p 8080|' /etc/systemd/system/mnemo_cards_server.service
     fi
 fi
 

tools/deploy/web-app/README.md

@@ -75,7 +75,7 @@ export DOMAIN="your-domain.com"
 
 **Смена API URL:**
 ```bash
-export API_BASE_URL="https://your-api-server.com:8080"
+export API_BASE_URL="https://your-api-server.com:8443"
 ```
 
 ## 🔧 Функции конфигурации

tools/deploy/web-app/config.sh

@@ -39,7 +39,7 @@ export NGINX_ENABLED="/etc/nginx/sites-enabled/$APP_NAME"
 # API endpoints
 export API_BASE_URL="https://api.memo-cards.online:8081"
 #export API_BASE_URL_DEV="http://localhost:8000"
-export API_BASE_URL_DEV="https://api.memo-cards.online:8080"
+export API_BASE_URL_DEV="https://api.memo-cards.online:8443"
 
 # =============================================================================
 # SSL CONFIGURATION

tools/docs/CI_CD_SETUP.md

@@ -240,7 +240,7 @@ nslookup code.memo-cards.online
 # Проверка доступности портов
 telnet 147.45.152.129 80
 telnet 147.45.152.129 443
-telnet 147.45.152.129 8080
+telnet 147.45.152.129 8443
 telnet 147.45.152.129 8081
 ```
 

tools/scripts/check_deploy_ready.sh

@@ -85,7 +85,7 @@ done
 
 # Check 5: Network connectivity
 echo "5. Checking network connectivity..."
-for port in 22 80 443 8080 8081; do
+for port in 22 80 443 8443 8081; do
     if nc -z -w5 $SERVER_IP $port 2>/dev/null; then
         print_status "Port $port is accessible"
     else