# 🚀 Deploy Web Application

┌─────────────────┐    ┌─────────────────┐    ┌─────────────────┐
│      Nginx      │    │     Web App     │    │     Certbot     │
│   Container     │    │   Container     │    │   Container     │
├─────────────────┤    ├─────────────────┤    ├─────────────────┤
│ • Reverse Proxy │    │ • React App     │    │ • SSL Certs     │
│ • SSL Handling  │    │ • Built Assets  │    │ • Auto Renewal  │
│ • Port 80/443   │    │ • Static Files  │    │ • Background    │
└─────────────────┘    └─────────────────┘    └─────────────────┘

Internet → Cloudflare → Nginx Container → Web App Container
                      ↗
               Certbot Container (SSL Certs)

web-app/
├── .deployment/                 # ไฟล์สำหรับ deployment
│   ├── nginx/
│   │   ├── web-app.conf         # Nginx config สำหรับ container ภายใน
│   │   └── web-app-nginx.conf   # Nginx config สำหรับ main server
│   ├── certbot-init.sh          # Script สำหรับขอ SSL ครั้งแรก
│   └── certbot-renew.sh         # Script สำหรับต่ออายุ SSL (Manual)
├── docker-compose.yml           # กำหนดค่า containers
├── Dockerfile                   # สร้าง Docker image
└── .gitlab-ci.yml               # CI/CD pipeline configuration

# Build Stage - สร้าง application
FROM node:18-alpine as build

# ติดตั้ง pnpm package manager
RUN npm install -g pnpm

WORKDIR /app

# กำหนด environment variable สำหรับ API URL
ARG VITE_API_URL
ENV VITE_API_URL=${VITE_API_URL:-http://localhost/api}

# Copy dependency files และติดตั้ง packages
COPY package.json pnpm-lock.yaml ./
RUN pnpm install --frozen-lockfile

# Copy source code และ build application
COPY . .
RUN pnpm build

# Production Stage - สร้าง production container
FROM nginx:alpine

# Copy built files ไปยัง nginx directory
COPY --from=build /app/dist /usr/share/nginx/html

# Copy nginx configuration
COPY .deployment/nginx/web-app.conf /etc/nginx/conf.d/default.conf

EXPOSE 80
CMD ["nginx", "-g", "daemon off;"]

version: '3.8'

services:
  # Main Nginx Server - รับ traffic จาก internet
  nginx:
    image: nginx:latest
    container_name: web-app-nginx
    ports:
      - '80:80' # HTTP
      - '443:443' # HTTPS
    volumes:
      - ./.deployment/nginx/web-app-nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - ./.deployment/ssl:/etc/nginx/ssl:ro
      - certbot-webroot:/var/www/certbot:ro
    networks:
      - web-app-network
    restart: unless-stopped
    depends_on:
      - web-app
      - certbot

  # Web Application Container
  web-app:
    image: ${IMAGE_TAG:-your-registry/web-app:latest}
    container_name: web-app
    networks:
      - web-app-network
    environment:
      - VITE_API_URL=${VITE_API_URL}
    restart: unless-stopped
    depends_on:
      - certbot

  # SSL Certificate Management
  certbot:
    image: certbot/certbot:latest
    container_name: web-app-certbot
    volumes:
      - ./ssl:/etc/letsencrypt
      - certbot-webroot:/var/www/certbot
      - ./certbot-logs:/var/log/letsencrypt
    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew --webroot -w /var/www/certbot --quiet; sleep 12h & wait $${!}; done;'"
    networks:
      - web-app-network
    restart: unless-stopped

volumes:
  certbot-webroot:
    driver: local

networks:
  web-app-network:
    driver: bridge

server {
    listen 80;
    server_name _;

    # กำหนดตำแหน่งไฟล์ static
    root /usr/share/nginx/html;
    index index.html index.htm;

    # กำหนดการจัดการ routing สำหรับ SPA
    location / {
        # พยายามหาไฟล์ตามลำดับ ถ้าไม่มีให้ fallback ไปที่ index.html
        try_files $uri $uri/ /index.html;
    }
}

# HTTP Server - Redirect ไป HTTPS
server {
    listen 80;
    server_name your-domain.com;

    # ให้ Certbot ใช้สำหรับ verification
    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

    # Redirect HTTP traffic ไป HTTPS
    location / {
        return 301 https://$host$request_uri;
    }
}

# HTTPS Server - Main Application
server {
    listen 443 ssl http2;
    server_name your-domain.com;

    # SSL Certificate Configuration
    ssl_certificate /etc/nginx/ssl/live/your-domain.com/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/live/your-domain.com/privkey.pem;

    # SSL Security Settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_session_tickets off;

    # Proxy Headers สำหรับ backend communication
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # Forward requests ไปยัง web-app container
    location / {
        proxy_pass http://web-app;
    }

    # Error Page Handling
    error_page 404 /index.html;
    error_page 500 502 503 504 /index.html;

    # Security Headers
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
}

#!/bin/sh

# รับ parameters จาก command line
DOMAIN=$1
EMAIL=$2

# ✅ ตรวจสอบว่ามี parameters ครบหรือไม่
if [ -z "$DOMAIN" ] || [ -z "$EMAIL" ]; then
    echo "Usage: ./certbot-init.sh <domain> <email>"
    echo "Example: ./certbot-init.sh example.com [email protected]"
    exit 1
fi

echo "🔐 Obtaining SSL certificate for $DOMAIN..."
echo "📧 Notification email: $EMAIL"

echo "⚠️  Make sure to stop any services using port 80 first"
echo "    Run: docker compose down"
echo ""

# 🚀 รัน Certbot เพื่อขอใบรับรอง SSL
docker run -it --rm --name certbot \
        -v "$(pwd)/ssl:/etc/letsencrypt" \
        -v "$(pwd)/ssl-var:/var/lib/letsencrypt" \
        -p 80:80 \
        certbot/certbot certonly \
        --standalone \
        --email $EMAIL \
        --agree-tos \
        --no-eff-email \
        -d $DOMAIN

# ✅ ตรวจสอบผลการทำงาน
if [ $? -eq 0 ]; then
    echo "✅ SSL certificate obtained successfully!"
    echo "📁 Certificate location: ./ssl/live/$DOMAIN/"
    echo ""
    echo "🚀 Now you can start the services:"
    echo "    docker compose up -d"
else
    echo "❌ Failed to obtain SSL certificate"
    echo "💡 Make sure:"
    echo "   - Domain $DOMAIN points to this server"
    echo "   - Port 80 is accessible from internet"
    echo "   - No other service is using port 80"
    exit 1
fi

#!/bin/sh

echo "🔄 Manually renewing SSL certificates..."

# 🔄 สั่งต่ออายุใบรับรอง SSL
docker compose run --rm certbot renew

# ✅ ตรวจสอบผลการทำงาน
if [ $? -eq 0 ]; then
    echo "✅ Certificate renewal successful!"
    echo "🔄 Restarting nginx to apply changes..."
    # รีสตาร์ท nginx เพื่อใช้ใบรับรองใหม่
    docker compose restart bacc-web-ui
else
    echo "❌ Certificate renewal failed"
    exit 1
fi

stages:
  - build
  - deploy

variables:
  DOCKER_DRIVER: overlay2
  DOCKER_TLS_CERTDIR: '/certs'
  DOCKER_IMAGE_TAG: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG-$CI_COMMIT_SHORT_SHA
  DOCKER_IMAGE_LATEST: $CI_REGISTRY_IMAGE:latest

# 🔨 Build Stage - สร้าง Docker Image
build:docker:
  stage: build
  image: docker:24.0.5
  services:
    - docker:24.0.5-dind
  before_script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
  script:
    - |
      echo "Building Docker image: $DOCKER_IMAGE_TAG"
      docker build --tag $DOCKER_IMAGE_TAG --tag $DOCKER_IMAGE_LATEST .
      echo "Pushing Docker image..."
      docker push $DOCKER_IMAGE_TAG
      if [ "$CI_COMMIT_BRANCH" == "main" ]; then
        echo "Pushing latest tag..."
        docker push $DOCKER_IMAGE_LATEST
      fi
  after_script:
    - docker logout
  only:
    - main
    - tags

# 🚀 Deploy Stage - Deploy ไปยัง Production
deploy:production:
  stage: deploy
  image: docker:24.0.5
  services:
    - docker:24.0.5-dind
  environment:
    name: production
    url: $PRODUCTION_URL
  before_script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - |
      # ติดตั้ง SSH client
      apk add --no-cache openssh-client
      mkdir -p ~/.ssh
      echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
      chmod 600 ~/.ssh/id_rsa
      ssh-keyscan -H $DEPLOY_HOST >> ~/.ssh/known_hosts
  script:
    - |
      echo "Deploying $DOCKER_IMAGE_TAG to production..."
      echo "Image: $DOCKER_IMAGE_TAG"

      # Copy docker-compose.yml ไปยัง server
      echo "Copying docker-compose.yml to $DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_PATH..."
      scp docker-compose.yml $DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_PATH/docker-compose.yml

      # Copy .deployment directory ไปยัง server
      if [ -d ".deployment" ]; then
        echo "Copying .deployment directory to $DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_PATH/.deployment..."
        ssh $DEPLOY_USER@$DEPLOY_HOST "mkdir -p $DEPLOY_PATH/.deployment"
        scp -r .deployment/* $DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_PATH/.deployment/
      fi

      # ตั้งค่า permissions สำหรับไฟล์ deployment
      echo "Setting permissions for .deployment files..."
      ssh $DEPLOY_USER@$DEPLOY_HOST "
        cd $DEPLOY_PATH && \
        chmod +x .deployment/certbot-init.sh .deployment/certbot-renew.sh && \
        for file in .deployment/certbot-init.sh .deployment/nginx/web-app-nginx.conf .deployment/nginx/web-app.conf; do
          if [ ! -f \"\$file\" ]; then
            echo \"ERROR: \$file is not a regular file!\"
            exit 1
          fi
        done && \
        echo '✓ All .deployment files verified as regular files'
      "

      # Deploy application บน server
      ssh $DEPLOY_USER@$DEPLOY_HOST "
        cd $DEPLOY_PATH && \
        echo 'Logging into Docker registry...' && \
        echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER --password-stdin $CI_REGISTRY && \
        export IMAGE_TAG=$DOCKER_IMAGE_TAG && \
        export DOMAIN=${DOMAIN:-localhost} && \
        echo 'Pulling Docker images...' && \
        docker compose -f docker-compose.yml pull && \
        echo 'Starting containers...' && \
        docker compose -f docker-compose.yml up -d && \
        docker compose -f docker-compose.yml restart nginx && \
        docker compose -f docker-compose.yml ps && \
        docker logout $CI_REGISTRY
      "

      echo "✓ Deployment completed successfully"
  after_script:
    - docker logout
  only:
    - main
    - tags
  when: manual # ต้องกดปุ่ม Deploy ด้วยตนเอง