# Production deployment

Production is intended for `95.161.2.141`. The existing Apache listens on internal ports `80/40443` and reverse-proxies to the Next.js container through `127.0.0.1:3100` (the container itself listens on port 3000). The router forwards external `80 -> 80` and `443 -> 40443`; the existing `43850 -> 443` rule is left untouched. Certbot obtains and renews one certificate covering all four domains: `kiln.spb.ru`, `kiln.beer`, `kiln.bar` and `килн.спб.рф`.

The delivery bot runs directly on the server at port `8383`, outside Docker. Set `BOT_API_BASE_URL=http://host.docker.internal:8383` in `.env.production` and keep the `extra_hosts` entry from `docker-compose.production.yml`. Do not set this variable to `https://kiln.spb.ru`: the website must call the bot over the local Docker-host connection, while the browser continues to call the public website endpoint `/api/booking`.

The DNS A record must point to `95.161.2.141`, and inbound TCP ports 80 and 443 must be open.

First start the application container:

```bash
git clone https://github.com/qwantru/kiln.git
cd kiln
git checkout feat/menu-postgres-yandex-feed
cp .env.production.example .env.production
nano .env.production
chmod 600 .env.production
docker compose --env-file .env.production -f docker-compose.production.yml up -d --build
docker compose --env-file .env.production -f docker-compose.production.yml logs -f app
```

Enable the Apache proxy modules and HTTPS listener:

```bash
sudo a2enmod proxy proxy_http headers ssl rewrite
sudo mkdir -p /var/www/kiln-acme/.well-known/acme-challenge
sudo chown -R www-data:www-data /var/www/kiln-acme
grep -qxF 'Listen 40443' /etc/apache2/ports.conf || echo 'Listen 40443' | sudo tee -a /etc/apache2/ports.conf
sudo cp deploy/apache/kiln.conf /etc/apache2/sites-available/kiln.conf
sudo a2ensite kiln.conf
sudo apachectl configtest
sudo systemctl reload apache2
```

Then obtain the certificate:

```bash
sudo apt update
sudo apt install -y certbot python3-certbot-apache
sudo certbot certonly --webroot -w /var/www/kiln-acme \
  --cert-name kiln.spb.ru \
  -d kiln.spb.ru \
  -d kiln.beer \
  -d kiln.bar \
  -d xn--h1adei.xn--90a1af.xn--p1ai
sudo certbot renew --dry-run
```

The Cyrillic domain is passed to Certbot in its Punycode form: `xn--h1adei.xn--90a1af.xn--p1ai`.

After the certificate is issued, enable HTTPS on internal port 40443:

```bash
sudo cp deploy/apache/kiln-ssl.conf /etc/apache2/sites-available/kiln-ssl.conf
sudo a2ensite kiln-ssl.conf
sudo apachectl configtest
sudo systemctl reload apache2
```

Set unique production values for `POSTGRES_PASSWORD`, `DATABASE_URL` and `ADMIN_MENU_TOKEN`. `ACME_EMAIL` is no longer needed by the Apache setup and may be removed from `.env.production`. The database persists in the `kiln_postgres` volume. The first app start applies the checked-in migration before starting Next.js.

Updates:

```bash
git pull
docker compose --env-file .env.production -f docker-compose.production.yml up -d --build
```

Local development remains independent: use `.env.local`, the existing local `docker-compose.yml` PostgreSQL service, and `npm run dev:3001`.