# THECR3W-DEV — STRATEGIA I PROCEDURA WDROŻENIA PRODUKCYJNEGO
## Wersja: 1.0.0 | Data: 2026-10-31

---

## 1. Środowisko Docelowe (Potwierdzone w Audycie Stage 0)

- **Host:** Netcup VPS (Ubuntu 24.04.5 LTS, 15 GiB RAM, 476 GiB wolnego dysku NVMe).
- **Docker Network:** Zewnętrzna sieć `proxy` (wykorzystywana przez istniejący kontener `caddy:2`).
- **Lokalizacja Caddyfile:** `/opt/proxy/Caddyfile`.
- **Domeny wdrożeniowe:**
  - `app.thecr3wnet.com` -> Native Update API (.NET Core)
  - `download.thecr3wnet.com` -> The Cr3w Download Center (React + Nginx)
  - `thecr3wnet.com` -> **POZOSTAJE NIENARUSZONA** (obsługiwana przez `app-app-1`). Zakaz tworzenia strony WWW.

---

## 2. Architektura Docker Compose (`infrastructure/docker/docker-compose.prod.yml`)

Usługi TheCr3w-dev zostaną zgrupowane w dedykowanym projekcie Docker Compose:
- `thecr3w-postgres` (Postgres 16 Alpine, sieć `thecr3w_internal`).
- `thecr3w-backend` (Native Update API & Deployment Control API, sieci `proxy` + `thecr3w_internal`).
- `thecr3w-download-center` (The Cr3w Download Center Frontend, sieć `proxy`).
- `thecr3w-agent` (Deployment Agent, kontrolowany dostęp do Docker engine).

```yaml
version: '3.8'

networks:
  proxy:
    external: true
  thecr3w_internal:
    driver: bridge
    internal: true

volumes:
  thecr3w_postgres_data:
    driver: local

services:
  thecr3w-postgres:
    image: postgres:16-alpine
    container_name: thecr3w-postgres
    restart: unless-stopped
    environment:
      POSTGRES_DB: thecr3w_db
      POSTGRES_USER: thecr3w_user
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
    volumes:
      - thecr3w_postgres_data:/var/lib/postgresql/data
      - ../postgres/init:/docker-entrypoint-initdb.d:ro
    networks:
      - thecr3w_internal
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U thecr3w_user -d thecr3w_db"]
      interval: 10s
      timeout: 5s
      retries: 5

  thecr3w-backend:
    image: git.thecr3wnet.com/thecr3w/backend:latest # Docelowo @sha256:...
    container_name: thecr3w-backend
    restart: unless-stopped
    depends_on:
      thecr3w-postgres:
        condition: service_healthy
    environment:
      ASPNETCORE_ENVIRONMENT: Production
      ConnectionStrings__DefaultConnection: Host=thecr3w-postgres;Port=5432;Database=thecr3w_db;Username=thecr3w_user;PasswordFile=/run/secrets/db_password
      Keycloak__Authority: https://login.thecr3wnet.com/realms/master
      Keycloak__Audience: thecr3w-backend
      R2__Endpoint: https://bf705752e38169fedb83efd5b747390e.r2.cloudflarestorage.com
      R2__Bucket: thecr3w-app
      R2__Region: auto
    networks:
      - proxy
      - thecr3w_internal
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5000/health"]
      interval: 10s
      timeout: 5s
      retries: 3

  thecr3w-download-center:
    image: git.thecr3wnet.com/thecr3w/download-center:latest
    container_name: thecr3w-download-center
    restart: unless-stopped
    networks:
      - proxy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:80/"]
      interval: 10s
      timeout: 5s
      retries: 3
```

---

## 3. Integracja z Caddyfile (`/opt/proxy/Caddyfile`)

Po uruchomieniu kontenerów do pliku `/opt/proxy/Caddyfile` dopisywane są wyłącznie nowe bloki domenowe:

```caddy
app.thecr3wnet.com {
    reverse_proxy thecr3w-backend:5000 {
        header_up X-Forwarded-Proto {scheme}
        header_up X-Real-IP {remote_host}
    }
}

download.thecr3wnet.com {
    reverse_proxy thecr3w-download-center:80 {
        header_up X-Forwarded-Proto {scheme}
        header_up X-Real-IP {remote_host}
    }
}
```

Procedura bezpiecznego załadowania Caddy:
```bash
# 1. Kopia zapasowa
cp /opt/proxy/Caddyfile /opt/proxy/Caddyfile.bak_$(date +%Y%m%d_%H%M%S)

# 2. Walidacja składni wewnątrz kontenera caddy
docker exec caddy caddy validate --config /etc/caddy/Caddyfile

# 3. Przeładowanie bez przestojów (Zero-downtime reload)
docker exec caddy caddy reload --config /etc/caddy/Caddyfile
```