sims-hq/deploy/PATHS-AND-NAMES.md

SiMS HQ — Deployment Paths & Names (reference)

The single source of truth for where things live and what they're called in production. If a name here disagrees with a command you're about to run, this file wins. Server is the existing company Amazon Linux 2 EC2 box; HQ runs as its own Docker container beside the other apps. (D20 target, revised: .in not .com, Docker not RDS — see notes at bottom.)

Identity

Thing	Value
Public URL	https://hq.simssoftware.in
EC2 public IP (Elastic)	13.232.53.115
DNS record	A · hq → 13.232.53.115, in the simssoftware.in zone (same place as gitea.simssoftware.in)
SSH user	ec2-user
Box hostname	ip-172-31-14-238

Git

Thing	Value
Repo (Gitea)	https://gitea.simssoftware.in/SIMS/sims-hq.git (moved from gitadmin/; old URL redirects)
Branch	main

Folders on the box

Path	What it is
/usr/share/nginx/sims-hq	App folder — the whole project (owned by ec2-user). Docker builds from here.
/usr/share/nginx/sims-hq/apps/hq/src/server.ts	Holds the hardcoded DB connection (HARDCODED_DATABASE_URL) — no .env is used.
/usr/share/nginx/sims-hq/deploy/sims.hq.conf	nginx vhost source (copied into nginx below).
/etc/nginx/conf.d/sims.hq.conf	Live nginx vhost (must end in .conf; sudo to edit).
/etc/ssl/sims/sims.crt · /etc/ssl/sims/sims.key	Wildcard TLS cert for *.simssoftware.in (shared).

Rule: anything under /etc/ (nginx, ssl) is root-owned — create/edit it in the PuTTY terminal with sudo, never via WinSCP. WinSCP can only write /usr/share/nginx/sims-hq (after chown ec2-user) and your home folder.

Docker

Thing	Value
HQ container name	sims-hq
HQ image	sims-hq (built from Dockerfile)
Compose file	/usr/share/nginx/sims-hq/docker-compose.yml
HQ port (host→container)	127.0.0.1:5182 → 5182 (localhost only; nginx proxies to it)
Postgres container	accurate-postgres (image postgres) — shared with other apps
Postgres port (host)	0.0.0.0:5432
How HQ reaches Postgres	host.docker.internal:5432 (via the host gateway)

Database (inside accurate-postgres)

Thing	Value
Superuser (admin)	postgres (connect via sudo docker exec -it accurate-postgres psql -U postgres)
HQ database	hq (owned by postgres)
HQ login	postgres — the shared superuser. Every app on this box uses it; there are no per-app roles (checked 2026-07-18). A dedicated hq role is a future hardening.
Connection string	postgres://postgres:<postgres-password>@host.docker.internal:5432/hq — hardcoded in apps/hq/src/server.ts (HARDCODED_DATABASE_URL), not a .env

Configuration — hardcoded in code (no .env)

Team decision (for now; may move to .env/secrets later): config is hardcoded in the source, matching the box's other apps. NODE_ENV=production (set in the Dockerfile) activates the hardcoded values; dev and the test suite are unaffected and still use SQLite.

Setting	Where	Value
DB connection	apps/hq/src/server.ts → HARDCODED_DATABASE_URL	postgres://postgres:<password>@host.docker.internal:5432/hq — replace CHANGE_ME_PASSWORD on the box, then rebuild
Owner login email	apps/hq/src/seed.ts → OWNER_EMAIL default	simssoftware13@gmail.com
Port	HQ_PORT env, else default	5182
PIN pepper	(unset)	password hashes are un-peppered — a future hardening
Gmail secret key	(unset)	set only when connecting Gmail

⚠️ To change the DB later: edit HARDCODED_DATABASE_URL in server.ts on the box, then sudo docker compose up -d --build (a rebuild, not just a restart). The real password lives only in the box's copy — never push the filled-in server.ts to Gitea (the repo keeps the CHANGE_ME_PASSWORD placeholder).

Owner login

Thing	Value
Email	simssoftware13@gmail.com
First password	printed once in sudo docker logs sims-hq on first boot — change immediately

Everyday commands (run from /usr/share/nginx/sims-hq)

Do this	Command
Build + start	sudo docker compose up -d --build
View logs	sudo docker logs sims-hq (-f to follow)
Restart	sudo docker compose restart hq
Stop	sudo docker compose down
Health check	curl -s localhost:5182/api/health → {"ok":true}
nginx test + reload	sudo nginx -t && sudo systemctl reload nginx

Notes / decisions

• Domain is .in (not .com): the wildcard cert is *.simssoftware.in and every other app is on .in; hq.simssoftware.com was a stray easyDNS URL-forward.
• Docker, not RDS: the box is Amazon Linux 2 (glibc 2.26) which can't run Node 20 natively, and Postgres already runs in the accurate-postgres container — so HQ is containerized and reuses that DB with its own isolated hq database + role.
• Node runs only inside the container (node:20); the host's Node 16 and the other apps are untouched.