SiMS HQ — Deployment Paths & Names (reference)
The single source of truth for where things live and what they're called in production.
If a name here disagrees with a command you're about to run, this file wins. Server is the
existing company Amazon Linux 2 EC2 box; HQ runs as its own Docker container beside the
other apps. (D20 target, revised: .in not .com, Docker not RDS — see notes at bottom.)
✅ Live at https://hq.simssoftware.in since 2026-07-21 (D39 in docs/06-DECISIONS.md).
docs/DEPLOY-HQ.md describes an earlier RDS/GoDaddy/.com plan that was not what
shipped — this file is the accurate one.
Identity
| Thing |
Value |
| Public URL |
https://hq.simssoftware.in |
| EC2 public IP (Elastic) |
13.232.53.115 |
| DNS record |
A · hq → 13.232.53.115, in the simssoftware.in zone (same place as gitea.simssoftware.in) |
| SSH user |
ec2-user |
| Box hostname |
ip-172-31-14-238 |
Git
| Thing |
Value |
| Repo (Gitea) |
https://gitea.simssoftware.in/SIMS/sims-hq.git (moved from gitadmin/; old URL redirects) |
| Branch |
main |
Folders on the box
| Path |
What it is |
/usr/share/nginx/sims-hq |
App folder — the whole project (owned by ec2-user). Docker builds from here. |
/usr/share/nginx/sims-hq/apps/hq/src/db-pg.ts |
Holds the hardcoded DB connection (HARDCODED_DATABASE_URL) — moved here from server.ts (pre-ship audit FIX A, one shared resolveDbUrl()). No .env is used. |
/usr/share/nginx/sims-hq/deploy/sims.hq.conf |
nginx vhost source (copied into nginx below). |
/etc/nginx/conf.d/sims.hq.conf |
Live nginx vhost (must end in .conf; sudo to edit). |
/etc/ssl/sims/sims.crt · /etc/ssl/sims/sims.key |
Wildcard TLS cert for *.simssoftware.in (shared). |
Rule: anything under /etc/ (nginx, ssl) is root-owned — create/edit it in the PuTTY
terminal with sudo, never via WinSCP. WinSCP can only write /usr/share/nginx/sims-hq
(after chown ec2-user) and your home folder.
Docker
| Thing |
Value |
| HQ container name |
sims-hq |
| HQ image |
sims-hq (built from Dockerfile) |
| Compose file |
/usr/share/nginx/sims-hq/docker-compose.yml |
| HQ port (host→container) |
127.0.0.1:5182 → 5182 (localhost only; nginx proxies to it) |
| Postgres container |
accurate-postgres (image postgres) — shared with other apps |
| Postgres port (host) |
0.0.0.0:5432 |
| How HQ reaches Postgres |
host.docker.internal:5432 (via the host gateway) |
Database (inside accurate-postgres)
| Thing |
Value |
| Superuser (admin) |
postgres (connect via sudo docker exec -it accurate-postgres psql -U postgres) |
| HQ database |
hq (owned by postgres) |
| HQ login |
postgres — the shared superuser. Every app on this box uses it; there are no per-app roles (checked 2026-07-18). A dedicated hq role is a future hardening. |
| Connection string |
postgres://postgres:<postgres-password>@host.docker.internal:5432/hq — hardcoded in apps/hq/src/server.ts (HARDCODED_DATABASE_URL), not a .env |
Configuration — hardcoded in code (no .env)
Team decision (for now; may move to .env/secrets later): config is hardcoded in the
source, matching the box's other apps. NODE_ENV=production (set in the Dockerfile)
activates the hardcoded values; dev and the test suite are unaffected and still use SQLite.
| Setting |
Where |
Value |
| DB connection |
apps/hq/src/db-pg.ts → HARDCODED_DATABASE_URL |
postgres://postgres:inv123@host.docker.internal:5432/hq |
| Owner login email |
apps/hq/src/seed.ts → OWNER_EMAIL default |
simssoftware13@gmail.com |
| Port |
HQ_PORT env, else default |
5182 |
| PIN pepper |
(unset) |
password hashes are un-peppered — a future hardening |
| Gmail secret key |
(unset) |
set only when connecting Gmail |
⚠️ Deviation from the original plan (accepted, D39): the real password is committed to
Gitea, not kept as a CHANGE_ME_PASSWORD placeholder — Gitea is internal/single-user, so
this was accepted for now. Rotating this password is the top item whenever the hardening
pass happens; whoever does it must also update the value in db-pg.ts and rebuild.
To change the DB later: edit HARDCODED_DATABASE_URL in db-pg.ts, then rebuild
(see Everyday commands below).
Owner login
| Thing |
Value |
| Email |
simssoftware13@gmail.com |
| First password |
printed once in sudo docker logs sims-hq on first boot — change immediately |
Everyday commands (run from /usr/share/nginx/sims-hq)
⚠️ Docker Compose V2 is not installed on this box (only the standalone docker-compose
1.21.0 from 2018, too old for this file's extra_hosts: host-gateway). docker-compose.yml
is kept as the source of truth for what the container needs, but it's run manually via plain
docker build/docker run below until the Compose V2 plugin is installed (see install
command in docs/06-DECISIONS.md D39, or run docker compose version to check if someone
already added it).
| Do this |
Command |
| Build |
sudo docker build -t sims-hq . |
| Start (first time / after removing the old container) |
sudo docker run -d --name sims-hq --restart unless-stopped -p 127.0.0.1:5182:5182 --add-host host.docker.internal:host-gateway sims-hq |
| Rebuild + replace (code changed) |
sudo docker stop sims-hq && sudo docker rm sims-hq, then Build + Start above |
| View logs |
sudo docker logs sims-hq (-f to follow) |
| Restart (no code change) |
sudo docker restart sims-hq |
| Stop |
sudo docker stop sims-hq |
| Health check |
curl -s localhost:5182/api/health → {"ok":true} |
| nginx test + reload |
sudo nginx -t && sudo systemctl reload nginx |
| Deploy code changes |
WinSCP-copy the whole project folder (except node_modules, dist, .git, .env, data, *.log) into /usr/share/nginx/sims-hq, overwriting — this box doesn't use git pull |
Notes / decisions
- Domain is
.in (not .com): the wildcard cert is *.simssoftware.in and every other
app is on .in; hq.simssoftware.com was a stray easyDNS URL-forward.
- Docker, not RDS: the box is Amazon Linux 2 (glibc 2.26) which can't run Node 20 natively,
and Postgres already runs in the
accurate-postgres container — so HQ is containerized and
reuses that DB with its own isolated hq database + role.
- Node runs only inside the container (node:20); the host's Node 16 and the other apps are
untouched.