|
|
@@ -0,0 +1,109 @@
|
|
|
1
|
+# Deploying BizGaze Support
|
|
|
2
|
+
|
|
|
3
|
+The app runs as a Docker container behind the existing **Nginx Proxy Manager**,
|
|
|
4
|
+which terminates TLS and proxies `https://remote.bizgaze.com` → `bizgaze-support:8090`
|
|
|
5
|
+on the shared `nginx_proxy_manager_default` network. No host ports are published.
|
|
|
6
|
+
|
|
|
7
|
+Deployment model: **the server holds a git clone of this repo.** Each deploy is a
|
|
|
8
|
+`git pull` + rebuild via [`deploy.sh`](deploy.sh). Two files are *not* in git and
|
|
|
9
|
+live only on the server — they survive every pull:
|
|
|
10
|
+
|
|
|
11
|
+| File | Purpose |
|
|
|
12
|
+|------|---------|
|
|
|
13
|
+| `.env` | Secrets — TURN credentials, optional `SSO_SECRET`, `BIZGAZE_WEBHOOK_URL`. See [.env.example](.env.example). |
|
|
|
14
|
+| `server/cert.pem`, `server/key.pem` | Self-signed cert for the app's *optional* direct-HTTPS listener (8443). Not needed behind NPM, but harmless. |
|
|
|
15
|
+
|
|
|
16
|
+Server facts:
|
|
|
17
|
+- Host: `root@118.95.33.89` port `61`
|
|
|
18
|
+- App path: `/opt/bizgaze-support`
|
|
|
19
|
+- Data: Docker named volume `bizgaze_support_data` → `/data/data.db` (persists across rebuilds)
|
|
|
20
|
+- Backups: `/opt/bizgaze-support.backups/` (newest 3 `.tgz` snapshots, auto-rotated)
|
|
|
21
|
+
|
|
|
22
|
+---
|
|
|
23
|
+
|
|
|
24
|
+## One-time bootstrap (server → git clone)
|
|
|
25
|
+
|
|
|
26
|
+Run **once** to convert the existing folder into a git checkout without losing the
|
|
|
27
|
+secrets. Prerequisite: the deployment files (Dockerfile, docker-compose.yml,
|
|
|
28
|
+deploy.sh, etc.) are committed and pushed to `origin/master` first.
|
|
|
29
|
+
|
|
|
30
|
+```bash
|
|
|
31
|
+ssh -p 61 root@118.95.33.89 # or: plink -ssh -P 61 -pw '<pw>' root@118.95.33.89
|
|
|
32
|
+
|
|
|
33
|
+# 1. Store git credentials so pulls are non-interactive (once per server).
|
|
|
34
|
+git config --global credential.helper store
|
|
|
35
|
+printf 'https://devops%%40bizgaze.com:Bizgaze%%40123@code.bizgaze.com\n' > ~/.git-credentials
|
|
|
36
|
+chmod 600 ~/.git-credentials
|
|
|
37
|
+
|
|
|
38
|
+# 2. Stash the live secrets.
|
|
|
39
|
+cd /opt
|
|
|
40
|
+cp -a bizgaze-support /opt/bizgaze-support.preclone.bak
|
|
|
41
|
+mkdir -p /tmp/bzsecrets
|
|
|
42
|
+cp bizgaze-support/.env /tmp/bzsecrets/ 2>/dev/null || true
|
|
|
43
|
+cp bizgaze-support/server/cert.pem /tmp/bzsecrets/ 2>/dev/null || true
|
|
|
44
|
+cp bizgaze-support/server/key.pem /tmp/bzsecrets/ 2>/dev/null || true
|
|
|
45
|
+
|
|
|
46
|
+# 3. Replace the folder with a fresh clone.
|
|
|
47
|
+rm -rf bizgaze-support
|
|
|
48
|
+git clone https://code.bizgaze.com/Sravan/BizGaze_Remote.git bizgaze-support
|
|
|
49
|
+cd bizgaze-support
|
|
|
50
|
+
|
|
|
51
|
+# 4. Restore the secrets the clone doesn't carry.
|
|
|
52
|
+cp /tmp/bzsecrets/.env ./.env
|
|
|
53
|
+cp /tmp/bzsecrets/cert.pem ./server/cert.pem 2>/dev/null || true
|
|
|
54
|
+cp /tmp/bzsecrets/key.pem ./server/key.pem 2>/dev/null || true
|
|
|
55
|
+rm -rf /tmp/bzsecrets
|
|
|
56
|
+
|
|
|
57
|
+# 5. Build & launch.
|
|
|
58
|
+chmod +x deploy.sh
|
|
|
59
|
+docker compose up -d --build
|
|
|
60
|
+docker compose ps
|
|
|
61
|
+```
|
|
|
62
|
+
|
|
|
63
|
+If `.env` did not exist yet, create it from the template and fill in the TURN secret:
|
|
|
64
|
+
|
|
|
65
|
+```bash
|
|
|
66
|
+cp .env.example .env && nano .env
|
|
|
67
|
+```
|
|
|
68
|
+
|
|
|
69
|
+---
|
|
|
70
|
+
|
|
|
71
|
+## Routine deploy
|
|
|
72
|
+
|
|
|
73
|
+After pushing changes to `origin/master`:
|
|
|
74
|
+
|
|
|
75
|
+```bash
|
|
|
76
|
+ssh -p 61 root@118.95.33.89 'cd /opt/bizgaze-support && ./deploy.sh'
|
|
|
77
|
+```
|
|
|
78
|
+
|
|
|
79
|
+`deploy.sh` snapshots the current tree (keeping 3 backups), `git reset --hard`s to
|
|
|
80
|
+`origin/master`, rebuilds, and verifies `/api/ice`. Flags:
|
|
|
81
|
+
|
|
|
82
|
+- `./deploy.sh --no-pull` — rebuild the current checkout without pulling
|
|
|
83
|
+- `./deploy.sh --rollback` — restore the newest backup snapshot and rebuild
|
|
|
84
|
+
|
|
|
85
|
+---
|
|
|
86
|
+
|
|
|
87
|
+## Verify
|
|
|
88
|
+
|
|
|
89
|
+```bash
|
|
|
90
|
+curl https://remote.bizgaze.com/api/ice
|
|
|
91
|
+```
|
|
|
92
|
+
|
|
|
93
|
+Response must list the public STUN entry **and** a TURN entry at
|
|
|
94
|
+`global.relay.metered.ca`. If only STUN appears, `.env` isn't reaching the
|
|
|
95
|
+container — check `docker exec bizgaze-support env | grep TURN`.
|
|
|
96
|
+
|
|
|
97
|
+---
|
|
|
98
|
+
|
|
|
99
|
+## Rollback
|
|
|
100
|
+
|
|
|
101
|
+```bash
|
|
|
102
|
+cd /opt/bizgaze-support && ./deploy.sh --rollback # newest snapshot
|
|
|
103
|
+# or restore a specific snapshot:
|
|
|
104
|
+ls -1t /opt/bizgaze-support.backups/*.tgz
|
|
|
105
|
+tar -xzf /opt/bizgaze-support.backups/<stamp>.tgz -C /opt/bizgaze-support && docker compose up -d --build
|
|
|
106
|
+```
|
|
|
107
|
+
|
|
|
108
|
+The `data.db` volume is never overwritten by a rebuild, so data is retained
|
|
|
109
|
+regardless of code version.
|
avinash
1 nedēļu atpakaļ