You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
122 lines
6.5 KiB
Markdown
122 lines
6.5 KiB
Markdown
# SiMS HQ — Deployment Paths & Names (reference)
|
|
|
|
The single source of truth for **where things live and what they're called** in production.
|
|
If a name here disagrees with a command you're about to run, this file wins. Server is the
|
|
existing company **Amazon Linux 2** EC2 box; HQ runs as its own Docker container beside the
|
|
other apps. (D20 target, revised: `.in` not `.com`, Docker not RDS — see notes at bottom.)
|
|
|
|
> ✅ **Live** at `https://hq.simssoftware.in` since 2026-07-21 (D39 in `docs/06-DECISIONS.md`).
|
|
> `docs/DEPLOY-HQ.md` describes an earlier RDS/GoDaddy/`.com` plan that was **not** what
|
|
> shipped — this file is the accurate one.
|
|
|
|
## Identity
|
|
|
|
| Thing | Value |
|
|
|---|---|
|
|
| Public URL | `https://hq.simssoftware.in` |
|
|
| EC2 public IP (Elastic) | `13.232.53.115` |
|
|
| DNS record | `A` · `hq` → `13.232.53.115`, in the **simssoftware.in** zone (same place as `gitea.simssoftware.in`) |
|
|
| SSH user | `ec2-user` |
|
|
| Box hostname | `ip-172-31-14-238` |
|
|
|
|
## Git
|
|
|
|
| Thing | Value |
|
|
|---|---|
|
|
| Repo (Gitea) | `https://gitea.simssoftware.in/SIMS/sims-hq.git` (moved from `gitadmin/`; old URL redirects) |
|
|
| Branch | `main` |
|
|
|
|
## Folders on the box
|
|
|
|
| Path | What it is |
|
|
|---|---|
|
|
| `/usr/share/nginx/sims-hq` | **App folder** — the whole project (owned by `ec2-user`). Docker builds from here. |
|
|
| `/usr/share/nginx/sims-hq/apps/hq/src/db-pg.ts` | Holds the **hardcoded DB connection** (`HARDCODED_DATABASE_URL`) — moved here from `server.ts` (pre-ship audit FIX A, one shared `resolveDbUrl()`). No `.env` is used. |
|
|
| `/usr/share/nginx/sims-hq/deploy/sims.hq.conf` | nginx vhost **source** (copied into nginx below). |
|
|
| `/etc/nginx/conf.d/sims.hq.conf` | **Live nginx vhost** (must end in `.conf`; `sudo` to edit). |
|
|
| `/etc/ssl/sims/sims.crt` · `/etc/ssl/sims/sims.key` | Wildcard TLS cert for `*.simssoftware.in` (shared). |
|
|
|
|
> Rule: anything under `/etc/` (nginx, ssl) is **root-owned** — create/edit it in the PuTTY
|
|
> terminal with `sudo`, never via WinSCP. WinSCP can only write `/usr/share/nginx/sims-hq`
|
|
> (after `chown ec2-user`) and your home folder.
|
|
|
|
## Docker
|
|
|
|
| Thing | Value |
|
|
|---|---|
|
|
| HQ container name | `sims-hq` |
|
|
| HQ image | `sims-hq` (built from `Dockerfile`) |
|
|
| Compose file | `/usr/share/nginx/sims-hq/docker-compose.yml` |
|
|
| HQ port (host→container) | `127.0.0.1:5182` → `5182` (localhost only; nginx proxies to it) |
|
|
| Postgres container | `accurate-postgres` (image `postgres`) — **shared** with other apps |
|
|
| Postgres port (host) | `0.0.0.0:5432` |
|
|
| How HQ reaches Postgres | `host.docker.internal:5432` (via the host gateway) |
|
|
|
|
## Database (inside `accurate-postgres`)
|
|
|
|
| Thing | Value |
|
|
|---|---|
|
|
| Superuser (admin) | `postgres` (connect via `sudo docker exec -it accurate-postgres psql -U postgres`) |
|
|
| HQ database | `hq` (owned by `postgres`) |
|
|
| HQ login | `postgres` — the shared superuser. Every app on this box uses it; there are **no** per-app roles (checked 2026-07-18). A dedicated `hq` role is a future hardening. |
|
|
| Connection string | `postgres://postgres:<postgres-password>@host.docker.internal:5432/hq` — **hardcoded** in `apps/hq/src/server.ts` (`HARDCODED_DATABASE_URL`), not a `.env` |
|
|
|
|
## Configuration — hardcoded in code (no `.env`)
|
|
|
|
Team decision (for now; may move to `.env`/secrets later): config is **hardcoded in the
|
|
source**, matching the box's other apps. `NODE_ENV=production` (set in the Dockerfile)
|
|
activates the hardcoded values; dev and the test suite are unaffected and still use SQLite.
|
|
|
|
| Setting | Where | Value |
|
|
|---|---|---|
|
|
| DB connection | `apps/hq/src/db-pg.ts` → `HARDCODED_DATABASE_URL` | `postgres://postgres:inv123@host.docker.internal:5432/hq` |
|
|
| Owner login email | `apps/hq/src/seed.ts` → `OWNER_EMAIL` default | `simssoftware13@gmail.com` |
|
|
| Port | `HQ_PORT` env, else default | `5182` |
|
|
| PIN pepper | *(unset)* | password hashes are un-peppered — a future hardening |
|
|
| Gmail secret key | *(unset)* | set only when connecting Gmail |
|
|
|
|
> ⚠️ **Deviation from the original plan (accepted, D39):** the real password is committed to
|
|
> Gitea, not kept as a `CHANGE_ME_PASSWORD` placeholder — Gitea is internal/single-user, so
|
|
> this was accepted for now. Rotating this password is the top item whenever the hardening
|
|
> pass happens; whoever does it must also update the value in `db-pg.ts` and rebuild.
|
|
>
|
|
> **To change the DB later:** edit `HARDCODED_DATABASE_URL` in `db-pg.ts`, then rebuild
|
|
> (see Everyday commands below).
|
|
|
|
## Owner login
|
|
|
|
| Thing | Value |
|
|
|---|---|
|
|
| Email | `simssoftware13@gmail.com` |
|
|
| First password | printed **once** in `sudo docker logs sims-hq` on first boot — change immediately |
|
|
|
|
## Everyday commands (run from `/usr/share/nginx/sims-hq`)
|
|
|
|
> ⚠️ **Docker Compose V2 is not installed on this box** (only the standalone `docker-compose`
|
|
> 1.21.0 from 2018, too old for this file's `extra_hosts: host-gateway`). `docker-compose.yml`
|
|
> is kept as the source of truth for what the container needs, but it's run manually via plain
|
|
> `docker build`/`docker run` below until the Compose V2 plugin is installed (see install
|
|
> command in `docs/06-DECISIONS.md` D39, or run `docker compose version` to check if someone
|
|
> already added it).
|
|
|
|
| Do this | Command |
|
|
|---|---|
|
|
| Build | `sudo docker build -t sims-hq .` |
|
|
| Start (first time / after removing the old container) | `sudo docker run -d --name sims-hq --restart unless-stopped -p 127.0.0.1:5182:5182 --add-host host.docker.internal:host-gateway sims-hq` |
|
|
| Rebuild + replace (code changed) | `sudo docker stop sims-hq && sudo docker rm sims-hq`, then Build + Start above |
|
|
| View logs | `sudo docker logs sims-hq` (`-f` to follow) |
|
|
| Restart (no code change) | `sudo docker restart sims-hq` |
|
|
| Stop | `sudo docker stop sims-hq` |
|
|
| Health check | `curl -s localhost:5182/api/health` → `{"ok":true}` |
|
|
| nginx test + reload | `sudo nginx -t && sudo systemctl reload nginx` |
|
|
| Deploy code changes | WinSCP-copy the whole project folder (except `node_modules`, `dist`, `.git`, `.env`, `data`, `*.log`) into `/usr/share/nginx/sims-hq`, overwriting — this box doesn't use `git pull` |
|
|
|
|
## Notes / decisions
|
|
- Domain is **`.in`** (not `.com`): the wildcard cert is `*.simssoftware.in` and every other
|
|
app is on `.in`; `hq.simssoftware.com` was a stray easyDNS URL-forward.
|
|
- **Docker, not RDS**: the box is Amazon Linux 2 (glibc 2.26) which can't run Node 20 natively,
|
|
and Postgres already runs in the `accurate-postgres` container — so HQ is containerized and
|
|
reuses that DB with its own isolated `hq` database + role.
|
|
- Node runs **only inside the container** (node:20); the host's Node 16 and the other apps are
|
|
untouched.
|