x

DDC_DEPLOYMENT_RUNBOOK.md

@@ -0,0 +1,184 @@
+# DDC Deployment Runbook
+
+เอกสารนี้เป็น runbook เฉพาะลูกค้า `ddc` โดยอิงจาก `DEPLOYMENT_GUIDE.md` และไฟล์ตัวอย่างใน `serverinfo/pkh-*`
+
+## Target
+
+- Project name: `ddc`
+- Website: `https://ddc.kitizone.com`
+- SPA: `https://spa.ddc.kitizone.com`
+- Admin: `https://admin.ddc.kitizone.com`
+- API: `https://api.ddc.kitizone.com`
+- Database: `ddcdb`
+- Website SSR port: `3004`
+- Backend API port: `3053`
+- Bare repo: `/home/ti/git/ddc.git`
+- Backend path: `/home/ti/projects/ddc-api`
+- Website path: `/home/ti/projects/ddc-website`
+- SPA static path: `/home/ti/projects/MyNginxMain/nginx/html/ddc/spa`
+- Admin static path: `/home/ti/projects/MyNginxMain/nginx/html/ddc/admin`
+
+## Files Prepared In This Repo
+
+- `serverinfo/ddc-post-receive`
+- `serverinfo/ddc-backend.env.example`
+- `serverinfo/ddc-nginx/ddc.kitizone.com.conf`
+- `serverinfo/ddc-nginx/spa.ddc.kitizone.com.conf`
+- `serverinfo/ddc-nginx/admin.ddc.kitizone.com.conf`
+- `serverinfo/ddc-nginx/api.ddc.kitizone.com.conf`
+
+## Preflight On Server
+
+Run on `kitizone.com` before changing live services:
+
+```bash
+ss -ltnp | grep -E ':3004|:3053' || true
+pm2 list
+```
+
+If ports `3004` or `3053` are already used, stop and choose new ports before applying these files.
+
+## 1. Create Bare Git Repository
+
+```bash
+mkdir -p /home/ti/git/ddc.git
+cd /home/ti/git/ddc.git
+git init --bare
+```
+
+## 2. Create Project Directories
+
+```bash
+mkdir -p /home/ti/projects/ddc-api
+mkdir -p /home/ti/projects/ddc-website
+mkdir -p /home/ti/projects/MyNginxMain/nginx/html/ddc/spa
+mkdir -p /home/ti/projects/MyNginxMain/nginx/html/ddc/admin
+```
+
+## 3. Create Database
+
+```bash
+docker exec -it arokro_postgres bash
+psql -U postgres -c "CREATE DATABASE ddcdb;"
+exit
+```
+
+## 4. Open Firewall Ports
+
+```bash
+sudo ufw allow 3004/tcp
+sudo ufw allow 3053/tcp
+sudo ufw reload
+```
+
+## 5. Request SSL Certificates
+
+```bash
+cd /home/ti/projects/MyNginxMain
+docker compose stop nginx
+
+docker compose run --rm certbot certonly --standalone \
+  -d ddc.kitizone.com \
+  -d spa.ddc.kitizone.com \
+  -d admin.ddc.kitizone.com \
+  -d api.ddc.kitizone.com
+```
+
+## 6. Install Nginx Configs
+
+Copy files from `serverinfo/ddc-nginx/` to:
+
+```text
+/home/ti/projects/MyNginxMain/nginx/conf.d/
+```
+
+Then validate and restart nginx:
+
+```bash
+cd /home/ti/projects/MyNginxMain
+docker compose run --rm nginx nginx -t
+docker compose up -d nginx
+```
+
+## 7. Install Backend Environment File
+
+Create this server file:
+
+```text
+/home/ti/projects/ddc-api/.env
+```
+
+Use `serverinfo/ddc-backend.env.example` as the base and replace placeholders before production use:
+
+- `postgres:password` must match the real Postgres password.
+- `JWT_SECRET` must be a new project-specific secret.
+- `OMISE_SECRET_KEY` must be set if payments are enabled.
+
+The deploy hook copies this file into `/home/ti/projects/ddc-api/apps/backend/.env` before Prisma commands.
+
+## 8. Install Git Hook
+
+Copy:
+
+```text
+serverinfo/ddc-post-receive
+```
+
+To:
+
+```text
+/home/ti/git/ddc.git/hooks/post-receive
+```
+
+Then run:
+
+```bash
+chmod +x /home/ti/git/ddc.git/hooks/post-receive
+```
+
+## 9. Deploy From Developer Machine
+
+```bash
+git remote add ddc ti@kitizone.com:/home/ti/git/ddc.git
+git push ddc master
+```
+
+## 10. Seed Database
+
+Run after the first successful deployment:
+
+```bash
+ssh ti@kitizone.com
+cd /home/ti/projects/ddc-api/apps/backend
+export PATH=$PATH:/home/ti/.bun/bin:/home/ti/.nvm/versions/node/v22.17.1/bin
+bun run prisma/seed.cjs
+```
+
+Default seeded admin account is currently `admin / homaroma123`. Change it before handing production access to the customer.
+
+## Verification
+
+```bash
+pm2 list
+curl -I https://ddc.kitizone.com
+curl -I https://spa.ddc.kitizone.com
+curl -I https://admin.ddc.kitizone.com
+curl -I https://api.ddc.kitizone.com
+```
+
+Expected PM2 processes:
+
+- `ddc-backend`
+- `ddc-website`
+
+Check browser console for:
+
+- CORS errors on admin and SPA
+- missing static assets
+- API 504 from website SSR build or runtime fetches
+
+## Known Risks
+
+- `serverinfo/ddc-post-receive` rewrites `ecosystem.config.js` at deploy time from the base `homaroma` config. This follows the existing `pkh` pattern.
+- The codebase still contains some hardcoded HomAroma URLs and storage keys in app code. This runbook only prepares infrastructure deployment, not full white-label branding cleanup.
+- Payments and LINE LIFF need customer-specific production keys before launch.

serverinfo/ddc-backend.env.example

@@ -0,0 +1,8 @@
+PORT=3053
+DATABASE_URL="postgresql://postgres:password@localhost:5132/ddcdb?schema=public"
+NODE_ENV=production
+APP_URL="https://api.ddc.kitizone.com"
+BACKEND_PUBLIC_URL="https://api.ddc.kitizone.com"
+CORS_ORIGIN="https://admin.ddc.kitizone.com,https://spa.ddc.kitizone.com,https://ddc.kitizone.com"
+JWT_SECRET="replace-with-ddc-production-secret"
+OMISE_SECRET_KEY=""

serverinfo/ddc-nginx/admin.ddc.kitizone.com.conf

@@ -0,0 +1,31 @@
+server {
+    listen 80;
+    server_name admin.ddc.kitizone.com;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name admin.ddc.kitizone.com;
+
+    ssl_certificate /etc/letsencrypt/live/admin.ddc.kitizone.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/admin.ddc.kitizone.com/privkey.pem;
+
+    root /usr/share/nginx/html/ddc/admin;
+    index index.html index.htm;
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+        expires max;
+        log_not_found off;
+    }
+}

serverinfo/ddc-nginx/api.ddc.kitizone.com.conf

@@ -0,0 +1,32 @@
+server {
+    listen 80;
+    server_name api.ddc.kitizone.com;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name api.ddc.kitizone.com;
+
+    client_max_body_size 20m;
+
+    ssl_certificate /etc/letsencrypt/live/api.ddc.kitizone.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/api.ddc.kitizone.com/privkey.pem;
+
+    location / {
+        proxy_pass http://192.168.1.167:3053;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection 'upgrade';
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}

serverinfo/ddc-nginx/ddc.kitizone.com.conf

@@ -0,0 +1,38 @@
+server {
+    listen 80;
+    server_name ddc.kitizone.com;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name ddc.kitizone.com;
+
+    ssl_certificate /etc/letsencrypt/live/ddc.kitizone.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/ddc.kitizone.com/privkey.pem;
+
+    location / {
+        proxy_pass http://192.168.1.167:3004;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection 'upgrade';
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_cache_bypass $http_upgrade;
+    }
+
+    location /_next/static/ {
+        proxy_pass http://192.168.1.167:3004;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        add_header Cache-Control "public, max-age=31536000, immutable";
+    }
+}

serverinfo/ddc-nginx/spa.ddc.kitizone.com.conf

@@ -0,0 +1,31 @@
+server {
+    listen 80;
+    server_name spa.ddc.kitizone.com;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name spa.ddc.kitizone.com;
+
+    ssl_certificate /etc/letsencrypt/live/spa.ddc.kitizone.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/spa.ddc.kitizone.com/privkey.pem;
+
+    root /usr/share/nginx/html/ddc/spa;
+    index index.html index.htm;
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+        expires max;
+        log_not_found off;
+    }
+}

serverinfo/ddc-post-receive

@@ -0,0 +1,156 @@
+#!/bin/bash
+
+# ==============================================================================
+# DDC Project - Integrated Deployment Script (post-receive hook)
+# ==============================================================================
+
+# 1. TARGET PATHS (Nginx & PM2)
+TARGET_SPA="/home/ti/projects/MyNginxMain/nginx/html/ddc/spa"
+TARGET_ADMIN="/home/ti/projects/MyNginxMain/nginx/html/ddc/admin"
+TARGET_BACKEND="/home/ti/projects/ddc-api"
+TARGET_WEBSITE="/home/ti/projects/ddc-website"
+
+# 2. REPOSITORY CONFIG
+REPO="/home/ti/git/ddc.git"
+BRANCH="master"
+TEMP_DIR="/tmp/ddc_build_$(date +%s)"
+
+# 3. BINARY PATHS & PM2
+BUN="/home/ti/.bun/bin/bun"
+PM2="/home/ti/.nvm/versions/node/v22.17.1/bin/pm2"
+PM2_NAME_BACKEND="ddc-backend"
+PM2_NAME_WEBSITE="ddc-website"
+export PATH="$PATH:/home/ti/.bun/bin:/home/ti/.nvm/versions/node/v22.17.1/bin"
+
+# 4. BUILD ENVIRONMENT
+export VITE_API_URL="https://api.ddc.kitizone.com/api"
+export NEXT_PUBLIC_API_URL="https://api.ddc.kitizone.com/api"
+
+# Customer-specific values. Fill these in on the server if enabled.
+export VITE_LIFF_ID="${VITE_LIFF_ID:-}"
+export VITE_OMISE_PUBLIC_KEY="${VITE_OMISE_PUBLIC_KEY:-}"
+
+# Service ports. Nginx proxies to these ports.
+BACKEND_PORT=3053
+SSR_PORT=3004
+
+# ------------------------------------------------------------------------------
+# START DEPLOYMENT
+# ------------------------------------------------------------------------------
+set -e
+echo "------- Starting Full Deployment: DDC Platform -------"
+
+# A. Prepare Temp Source from Checkout
+echo "Cloning branch $BRANCH to temporary directory: $TEMP_DIR"
+mkdir -p $TEMP_DIR
+git --work-tree=$TEMP_DIR --git-dir=$REPO checkout -f $BRANCH
+
+cd $TEMP_DIR
+echo "Installing monorepo dependencies..."
+$BUN install
+
+# B. Build & Deploy SPA
+echo ">>> Building SPA..."
+cd apps/spa
+$BUN run build
+echo "Deploying SPA to $TARGET_SPA..."
+mkdir -p $TARGET_SPA
+rm -rf $TARGET_SPA/*
+cp -rv dist/* $TARGET_SPA/
+cd ../..
+
+# C. Build & Deploy ADMIN PANEL
+echo ">>> Building Admin Panel..."
+cd apps/admin
+$BUN run build
+echo "Deploying Admin Panel to $TARGET_ADMIN..."
+mkdir -p $TARGET_ADMIN
+rm -rf $TARGET_ADMIN/*
+cp -rv dist/* $TARGET_ADMIN/
+cd ../..
+
+# D. Deploy & Manage BACKEND (API)
+echo ">>> Updating Backend at $TARGET_BACKEND..."
+mkdir -p $TARGET_BACKEND
+mkdir -p $TARGET_BACKEND/apps
+mkdir -p $TARGET_BACKEND/packages
+
+rsync -av --delete \
+  --exclude='.env' \
+  --exclude='public/' \
+  --exclude='node_modules/' \
+  apps/backend/ $TARGET_BACKEND/apps/backend/
+
+rsync -av packages/ $TARGET_BACKEND/packages/
+
+cp package.json bun.lock ecosystem.config.js $TARGET_BACKEND/
+sed -i 's/homaroma/ddc/g' $TARGET_BACKEND/ecosystem.config.js
+sed -i 's/PORT: 3002/PORT: 3004/g' $TARGET_BACKEND/ecosystem.config.js
+
+cd $TARGET_BACKEND
+echo "Installing backend dependencies..."
+$BUN install
+
+mkdir -p $TARGET_BACKEND/apps/backend/public
+
+cd $TARGET_BACKEND/apps/backend
+
+echo ">>> Generating Prisma Client..."
+$BUN x prisma generate
+
+if [ ! -f "$TARGET_BACKEND/.env" ]; then
+    echo "Error: .env file is missing at $TARGET_BACKEND/.env. Deployment aborted."
+    exit 1
+fi
+
+cp "$TARGET_BACKEND/.env" "$TARGET_BACKEND/apps/backend/.env"
+echo ">>> Running Prisma Migrate Deploy..."
+$BUN x prisma migrate deploy
+
+# E. PM2 Management - BACKEND
+echo ">>> Managing PM2 Process: $PM2_NAME_BACKEND..."
+$PM2 startOrReload $TARGET_BACKEND/ecosystem.config.js --only $PM2_NAME_BACKEND --env production --update-env
+echo "PM2 process '$PM2_NAME_BACKEND' is running. Waiting 10s for it to fully start..."
+sleep 10
+
+# F. Build & Deploy WEBSITE (Next.js SSR)
+echo ">>> Building Next.js SSR App inside monorepo temp dir..."
+cd $TEMP_DIR/apps/website
+$BUN run build
+
+# G. Prepare Next.js SSR
+echo ">>> Preparing Next.js SSR App..."
+rsync -av --delete \
+  $TEMP_DIR/apps/website/.next/standalone/ $TARGET_WEBSITE/
+rsync -av \
+  $TEMP_DIR/apps/website/public/ $TARGET_WEBSITE/apps/website/public/
+rsync -av \
+  $TEMP_DIR/apps/website/.next/static/ $TARGET_WEBSITE/apps/website/.next/static/
+
+cp $TEMP_DIR/ecosystem.config.js $TARGET_WEBSITE/
+sed -i 's/homaroma/ddc/g' $TARGET_WEBSITE/ecosystem.config.js
+sed -i 's/PORT: 3002/PORT: 3004/g' $TARGET_WEBSITE/ecosystem.config.js
+
+# H. Fix Permissions
+echo ">>> Fixing Permissions..."
+chown -R ti:ti $TARGET_BACKEND $TARGET_WEBSITE
+
+# I. PM2 Management - SSR Next.js
+cd $TARGET_WEBSITE
+echo ">>> Creating symlink for .next..."
+ln -sf apps/website/.next .next
+echo ">>> Managing PM2 Process: $PM2_NAME_WEBSITE..."
+$PM2 startOrReload $TARGET_WEBSITE/ecosystem.config.js --only $PM2_NAME_WEBSITE --env production --update-env
+echo "PM2 process '$PM2_NAME_WEBSITE' is running."
+
+# J. Cleanup
+echo "Cleaning up build artifacts..."
+rm -rf $TEMP_DIR
+
+echo "------- ALL DEPLOYMENTS COMPLETED SUCCESSFULLY -------"
+echo ""
+echo "Service Summary:"
+echo "   Website (SSR)  -> https://ddc.kitizone.com        (PM2: $PM2_NAME_WEBSITE, Port: $SSR_PORT)"
+echo "   SPA            -> https://spa.ddc.kitizone.com"
+echo "   Admin Panel    -> https://admin.ddc.kitizone.com"
+echo "   API Backend    -> https://api.ddc.kitizone.com    (PM2: $PM2_NAME_BACKEND, Port: $BACKEND_PORT)"