# Haixun Docker Deploy

Production uses two compose stacks:

- `infra/`: Mongo + Redis + persistent volumes.
- `deploy/`: nginx static frontend, API gateway, independent workers, and one-shot init.

## Build Images

Build and push images outside the runtime host, then deploy by changing tags in `deploy/.env.prod`.

```bash
docker build -f backend/Dockerfile -t ghcr.io/kupi-cat/haixun-backend:v0.0.1 .
docker build -f backend/web/Dockerfile -t ghcr.io/kupi-cat/haixun-web:v0.0.1 .
docker build -f backend/worker/Dockerfile -t ghcr.io/kupi-cat/haixun-node-worker:v0.0.1 .

docker push ghcr.io/kupi-cat/haixun-backend:v0.0.1
docker push ghcr.io/kupi-cat/haixun-web:v0.0.1
docker push ghcr.io/kupi-cat/haixun-node-worker:v0.0.1
```

## Env files (single source of truth)

| File | 用途 | 誰讀 |
|------|------|------|
| `deploy/.env.dev` | 本機 dev 全部 env | `make dev-all`、`make dev-infra`、`make run`、`infra/start-*.sh` |
| `deploy/.env.prod` | 正式環境全部 env | `make prod-*` 的 infra / app compose |

兩份都從對應 `.example` 複製而來，實值不進 repo。

```bash
cp deploy/.env.dev.example deploy/.env.dev      # dev
cp deploy/.env.prod.example deploy/.env.prod    # prod
```

infra compose 的 Mongo / Redis 容器密碼（`MONGO_ROOT_PASSWORD` / `REDIS_PASSWORD`）必須與 app 用的 `HAIXUN_MONGO_URI`（URL-encoded）/ `HAIXUN_REDIS_PASSWORD` 一致，不能各自獨立。

## Start Infra + App（one-shot）

```bash
make prod-install
# = 啟動 infra compose（讀 deploy/.env.prod）
# + pull app image + up -d
# + 跑 init（索引 / permission / role / job template / 第一個 admin）
```

## Init Database（單獨跑）

idempotent，部署新版本若有 schema/template 變更可重跑：

```bash
make prod-rebuild   # 或單獨 init：
docker compose --env-file deploy/.env.prod -f deploy/docker-compose.yml --profile init run --rm init
```

## Start / Upgrade

```bash
make prod-install   # 首次
make prod-rebuild   # 改 tag 後升版
```

Upgrade by changing `BACKEND_TAG`, `WEB_TAG`, and `NODE_WORKER_TAG` in `deploy/.env.prod`, then run `make prod-rebuild`.

## Rollback

Change the tags back to the previous version in `deploy/.env.prod` and run `make prod-rebuild`.

## Stop

```bash
make prod-stop       # 關 app stack，保留 infra 與資料
make prod-stop-all   # 關 app + infra，保留資料 volume
```

## Public Entry

Only `web` publishes port `80`. nginx serves static files and proxies `/api/` to `gateway:8890` with SSE buffering disabled.