inshallah last

Debian apt repos are unreachable on Iran servers during docker build.

Co-authored-by: Cursor <cursoragent@cursor.com>

.dockerignore

@@ -1,5 +1,6 @@
 .git
 .github
+.pnpm-store
 node_modules
 .next
 .turbo

.gitignore

@@ -2,6 +2,7 @@
 
 # dependencies
 /node_modules
+.pnpm-store
 /.pnp
 .pnp.*
 .yarn/*

DEPLOY.md

@@ -157,14 +157,20 @@ ln -sf /etc/nginx/sites-available/biztaghavi /etc/nginx/sites-enabled/biztaghavi
 nginx -t && systemctl reload nginx
 ```
 
-Then issue SSL with Certbot (HTTP must be working first):
+**SSL (ArvanCloud CDN — recommended):** The repo nginx config listens on **80 and 443** with the shared NODE Cloud self-signed cert (same as khanehbaan.ir). ArvanCloud terminates public HTTPS.
+
+```bash
+bash scripts/nginx-ssl-setup.sh
+```
+
+In **ArvanCloud dashboard**: SSL mode = **Full**, origin = `193.105.234.35`, purge cache.
+
+**SSL (direct DNS only):** If the domain does *not* use ArvanCloud, use certbot instead of the self-signed block:
 
 ```bash
 certbot --nginx -d biztaghavi.com -d www.biztaghavi.com
 ```
 
-In **ArvanCloud dashboard**: SSL mode = "Full (strict)", origin = `193.105.234.35`, purge cache.
-
 > Port **3009** must match the `ports` binding in `docker-compose.yml` — verify it's `"127.0.0.1:3009:3000"`.
 
 ---

Dockerfile

@@ -29,7 +29,7 @@ ENV DATABASE_URL="mysql://build:build@localhost:3306/build"
 RUN ./node_modules/.bin/next build && ./node_modules/.bin/next-sitemap
 
 # ── runner ────────────────────────────────────────────────────────────────────
-FROM docker.arvancloud.ir/library/node:20-slim AS runner
+FROM docker.arvancloud.ir/library/node:20-bookworm AS runner
 WORKDIR /app
 ENV NODE_ENV=production
 ENV PORT=3000

Dockerfile.prebuilt

@@ -1,5 +1,6 @@
 # Server-side image — NO npm/pnpm/network. Requires iran-bundle/ from scripts/bundle-for-iran.sh (run on Mac).
-FROM docker.arvancloud.ir/library/node:20-slim AS runner
+# Use full bookworm image (not slim): includes libssl.so.3 for Prisma; apt-get is blocked on Iran servers.
+FROM docker.arvancloud.ir/library/node:20-bookworm AS runner
 WORKDIR /app
 
 ENV NODE_ENV=production
@@ -16,8 +17,12 @@ COPY iran-bundle/standalone ./
 COPY iran-bundle/static ./.next/static
 COPY iran-bundle/public ./public
 COPY iran-bundle/prisma-binaries ./prisma-binaries
-COPY iran-bundle/node_modules/.prisma ./node_modules/.prisma
-COPY iran-bundle/node_modules/@prisma ./node_modules/@prisma
+# Standalone ships a stub @prisma/client; replace with full Prisma runtime from the bundle.
+COPY iran-bundle/node_modules /tmp/prisma-nm
+RUN rm -rf ./node_modules/@prisma ./node_modules/.prisma && \
+    cp -a /tmp/prisma-nm/.prisma ./node_modules/ && \
+    cp -a /tmp/prisma-nm/@prisma ./node_modules/@prisma && \
+    rm -rf /tmp/prisma-nm
 
 RUN mkdir -p /app/public/uploads && chown -R nextjs:nodejs /app/public/uploads
 

nginx/biztaghavi.conf

@@ -1,3 +1,7 @@
+# biztaghavi.com — NODE Cloud origin (ArvanCloud CDN in front)
+# Public SSL: ArvanCloud dashboard → SSL mode "Full", origin 193.105.234.35
+# Origin SSL: shared self-signed cert (required so nginx does not serve Gitea on :443)
+
 gzip on;
 gzip_vary on;
 gzip_proxied any;
@@ -8,11 +12,12 @@ gzip_types text/plain text/css text/xml application/json application/javascript
 server {
     listen 80;
     listen [::]:80;
+    listen 443 ssl;
+    listen [::]:443 ssl;
     server_name biztaghavi.com www.biztaghavi.com;
 
-    # Certbot will insert HTTPS redirect and SSL block here automatically.
-    # After first HTTP deploy, run:
-    #   certbot --nginx -d biztaghavi.com -d www.biztaghavi.com
+    ssl_certificate     /etc/ssl/certs/nodecloud-selfsigned.crt;
+    ssl_certificate_key /etc/ssl/private/nodecloud-selfsigned.key;
 
     client_max_body_size 50M;
 
@@ -32,7 +37,7 @@ server {
         access_log off;
     }
 
-    # Next.js HMR / WebSocket (needed for dev; harmless in prod)
+    # Next.js HMR / WebSocket (dev only; harmless in prod)
     location /_next/webpack-hmr {
         proxy_pass http://127.0.0.1:3009;
         proxy_http_version 1.1;
@@ -50,7 +55,6 @@ server {
         proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
 
-        # WebSocket support
         proxy_set_header Upgrade    $http_upgrade;
         proxy_set_header Connection "upgrade";
 

package.json

@@ -44,7 +44,7 @@
     "@tiptap/extension-character-count": "^2.11.0"
   },
   "pnpm": {
-    "onlyBuiltDependencies": ["@parcel/watcher", "@swc/core"],
+    "onlyBuiltDependencies": ["@parcel/watcher", "@swc/core", "@prisma/client", "@prisma/engines", "prisma"],
     "ignoredBuiltDependencies": ["sharp", "unrs-resolver"]
   },
   "devDependencies": {

scripts/bundle-for-iran.sh

@@ -45,8 +45,11 @@ docker run --rm --platform linux/amd64 \
     cp -a .next/static iran-bundle/static
     cp -a public iran-bundle/public
     cp -a prisma-binaries iran-bundle/prisma-binaries
-    cp -a node_modules/.prisma iran-bundle/node_modules/.prisma
-    cp -a node_modules/@prisma iran-bundle/node_modules/@prisma
+    # pnpm stores @prisma under .pnpm — resolve real paths
+    PRISMA_CLIENT="$(node -e "console.log(require.resolve(\"@prisma/client/package.json\"))")"
+    PRISMA_NM="$(dirname "$(dirname "$(dirname "$PRISMA_CLIENT")")")"
+    cp -a "$PRISMA_NM/.prisma" iran-bundle/node_modules/
+    cp -a "$PRISMA_NM/@prisma" iran-bundle/node_modules/
   '
 
 echo "==> Packing archive..."

scripts/nginx-ssl-setup.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Install nginx site + origin SSL for ArvanCloud CDN. Run on server as root.
+set -euo pipefail
+
+APP_DIR="/srv/nodecloud/apps/biztaghavisite"
+CONF_SRC="$APP_DIR/nginx/biztaghavi.conf"
+CONF_DST="/etc/nginx/sites-available/biztaghavi"
+
+if [[ ! -f "$CONF_SRC" ]]; then
+  echo "ERROR: $CONF_SRC not found. git pull first."
+  exit 1
+fi
+
+if [[ ! -f /etc/ssl/certs/nodecloud-selfsigned.crt ]]; then
+  echo "ERROR: /etc/ssl/certs/nodecloud-selfsigned.crt missing (NODE Cloud self-signed cert)."
+  exit 1
+fi
+
+echo "==> Install nginx config"
+cp "$CONF_SRC" "$CONF_DST"
+ln -sf "$CONF_DST" /etc/nginx/sites-enabled/biztaghavi
+
+echo "==> Test and reload nginx"
+nginx -t
+systemctl reload nginx
+
+echo "==> Origin checks"
+curl -sf -o /dev/null -w "HTTP :80  → %{http_code}\n" -H "Host: biztaghavi.com" http://127.0.0.1/
+curl -skf -o /dev/null -w "HTTPS :443 → %{http_code}\n" -H "Host: biztaghavi.com" https://127.0.0.1/
+
+echo ""
+echo "Done. In ArvanCloud: SSL = Full, origin = 193.105.234.35, then purge cache."
+echo "Test: curl -sI https://biztaghavi.com/admin/login"

scripts/server-deploy.sh

@@ -10,6 +10,8 @@ cd "$APP_DIR"
 
 echo "==> Pull latest code"
 git pull origin main
+# Accidental commit cleanup — never version the pnpm store
+rm -rf .pnpm-store 2>/dev/null || true
 
 echo "==> Ensure Docker network"
 docker network inspect nodecloud-net >/dev/null 2>&1 || docker network create nodecloud-net
@@ -75,6 +77,11 @@ else
 fi
 
 curl -sI -H "Host: biztaghavi.com" "http://127.0.0.1/" | head -5
+if curl -sf -H "Host: biztaghavi.com" "http://127.0.0.1:${PORT}/admin/login" -o /dev/null; then
+  echo "OK: /admin/login responds"
+else
+  echo "WARN: /admin/login not OK — rebuild after proxy.ts excludes /admin"
+fi
 docker compose -f "$COMPOSE_FILE" ps
 echo ""
 echo "Done. Test https://biztaghavi.com (purge ArvanCloud cache if needed)."

src/proxy.ts

@@ -4,5 +4,6 @@ import { routing } from "./lib/i18n/routing";
 export default createMiddleware(routing);
 
 export const config = {
-  matcher: ["/((?!_next|_vercel|studio|api|.*\\..*).*)"],
+  // Exclude admin panel and APIs — they live outside [locale] routes
+  matcher: ["/((?!_next|_vercel|studio|api|admin|.*\\..*).*)"],
 };