thecr3w-dev/docs/DEPLOYMENT.md

THECR3W-DEV — STRATEGIA I PROCEDURA WDROŻENIA PRODUKCYJNEGO

Wersja: 1.0.0 | Data: 2026-10-31

---

1. Środowisko Docelowe (Potwierdzone w Audycie Stage 0)

• Host: Netcup VPS (Ubuntu 24.04.5 LTS, 15 GiB RAM, 476 GiB wolnego dysku NVMe).
• Docker Network: Zewnętrzna sieć proxy (wykorzystywana przez istniejący kontener caddy:2).
• Lokalizacja Caddyfile: /opt/proxy/Caddyfile.
• Domeny wdrożeniowe:
  • app.thecr3wnet.com -> Native Update API (.NET Core)
  • download.thecr3wnet.com -> The Cr3w Download Center (React + Nginx)
  • thecr3wnet.com -> POZOSTAJE NIENARUSZONA (obsługiwana przez app-app-1). Zakaz tworzenia strony WWW.

---

2. Architektura Docker Compose (infrastructure/docker/docker-compose.prod.yml)

Usługi TheCr3w-dev zostaną zgrupowane w dedykowanym projekcie Docker Compose:

• thecr3w-postgres (Postgres 16 Alpine, sieć thecr3w_internal).
• thecr3w-backend (Native Update API & Deployment Control API, sieci proxy + thecr3w_internal).
• thecr3w-download-center (The Cr3w Download Center Frontend, sieć proxy).
• thecr3w-agent (Deployment Agent, kontrolowany dostęp do Docker engine).

version: '3.8'

networks:
  proxy:
    external: true
  thecr3w_internal:
    driver: bridge
    internal: true

volumes:
  thecr3w_postgres_data:
    driver: local

services:
  thecr3w-postgres:
    image: postgres:16-alpine
    container_name: thecr3w-postgres
    restart: unless-stopped
    environment:
      POSTGRES_DB: thecr3w_db
      POSTGRES_USER: thecr3w_user
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
    volumes:
      - thecr3w_postgres_data:/var/lib/postgresql/data
      - ../postgres/init:/docker-entrypoint-initdb.d:ro
    networks:
      - thecr3w_internal
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U thecr3w_user -d thecr3w_db"]
      interval: 10s
      timeout: 5s
      retries: 5

  thecr3w-backend:
    image: git.thecr3wnet.com/thecr3w/backend:latest # Docelowo @sha256:...
    container_name: thecr3w-backend
    restart: unless-stopped
    depends_on:
      thecr3w-postgres:
        condition: service_healthy
    environment:
      ASPNETCORE_ENVIRONMENT: Production
      ConnectionStrings__DefaultConnection: Host=thecr3w-postgres;Port=5432;Database=thecr3w_db;Username=thecr3w_user;PasswordFile=/run/secrets/db_password
      Keycloak__Authority: https://login.thecr3wnet.com/realms/master
      Keycloak__Audience: thecr3w-backend
      R2__Endpoint: https://bf705752e38169fedb83efd5b747390e.r2.cloudflarestorage.com
      R2__Bucket: thecr3w-app
      R2__Region: auto
    networks:
      - proxy
      - thecr3w_internal
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5000/health"]
      interval: 10s
      timeout: 5s
      retries: 3

  thecr3w-download-center:
    image: git.thecr3wnet.com/thecr3w/download-center:latest
    container_name: thecr3w-download-center
    restart: unless-stopped
    networks:
      - proxy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:80/"]
      interval: 10s
      timeout: 5s
      retries: 3

---

3. Integracja z Caddyfile (/opt/proxy/Caddyfile)

Po uruchomieniu kontenerów do pliku /opt/proxy/Caddyfile dopisywane są wyłącznie nowe bloki domenowe:

app.thecr3wnet.com {
    reverse_proxy thecr3w-backend:5000 {
        header_up X-Forwarded-Proto {scheme}
        header_up X-Real-IP {remote_host}
    }
}

download.thecr3wnet.com {
    reverse_proxy thecr3w-download-center:80 {
        header_up X-Forwarded-Proto {scheme}
        header_up X-Real-IP {remote_host}
    }
}

Procedura bezpiecznego załadowania Caddy:

# 1. Kopia zapasowa
cp /opt/proxy/Caddyfile /opt/proxy/Caddyfile.bak_$(date +%Y%m%d_%H%M%S)

# 2. Walidacja składni wewnątrz kontenera caddy
docker exec caddy caddy validate --config /etc/caddy/Caddyfile

# 3. Przeładowanie bez przestojów (Zero-downtime reload)
docker exec caddy caddy reload --config /etc/caddy/Caddyfile