Установка сервера
через Docker Compose

curl -fsSL https://get.docker.com | sh

services:
  backend:
    image: ghcr.io/fresh-donate/backend:latest
    pull_policy: always
    restart: unless-stopped
    env_file: [.env]
    volumes:
      - uploads_data:/app/uploads
    depends_on:
      postgres: { condition: service_healthy }
    networks: [fresh-network]

  panel:
    image: ghcr.io/fresh-donate/panel:latest
    pull_policy: always
    restart: unless-stopped
    env_file: [.env]
    depends_on: [backend]
    networks: [fresh-network]

  shop:
    image: ghcr.io/fresh-donate/shop:latest
    pull_policy: always
    restart: unless-stopped
    env_file: [.env]
    depends_on: [backend]
    networks: [fresh-network]

  postgres:
    image: postgres:17-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${DB_NAME:-fresh_donate}
      POSTGRES_USER: ${DB_USER:-postgres}
      POSTGRES_PASSWORD: ${DB_PASSWORD:-postgres}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER:-postgres} -d ${DB_NAME:-fresh_donate}"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks: [fresh-network]

volumes:
  postgres_data:
  uploads_data:

networks:
  fresh-network:
    driver: bridge

# === Frontend (panel + shop) ===
# Куда фронтенды ходят за API. Домен на котором стоит бекенд.
NUXT_PUBLIC_API_BASE=https://api.your-domain.com

# === Backend Server ===
HOST=0.0.0.0
PORT=3001
SERVER_PORT=3001

# === Database ===
DB_HOST=postgres
DB_PORT=5432
DB_NAME=fresh_donate
DB_USER=postgres
DB_PASSWORD=сложный-пароль-postgres

# === Admin Panel Credentials ===
ADMIN_LOGIN=admin
ADMIN_PASSWORD=сильный-пароль-минимум-16-символов

# === JWT ===
# Любая случайная строка ≥32 символов. Сгенерировать: openssl rand -hex 32
JWT_SECRET=замени-на-длинную-случайную-строку
JWT_EXPIRES_IN=24h

# === Rate Limiting ===
RATE_LIMIT_MAX=100
RATE_LIMIT_TIMEWINDOW=60000

# === Payment ===
# Куда возвращается игрок после оплаты (фронтенд магазина)
PAYMENT_RETURN_URL=https://shop.your-domain.com
# Публичный URL backend для вебхуков платёжных шлюзов
WEBHOOK_BASE_URL=https://api.your-domain.com
# Раскомментируй, если backend за прокси без x-forwarded-for или в тестовом режиме
# YOOKASSA_SKIP_IP_CHECK=true

# === CORS (через запятую) ===
CORS_ORIGIN=https://panel.your-domain.com,https://shop.your-domain.com

docker compose up -d

docker compose ps

docker compose logs -f backend

# API
server {
    listen 80;
    server_name api.your-domain.com;

    location / {
        proxy_pass http://backend:3001;
        proxy_http_version 1.1;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# Админ-панель
server {
    listen 80;
    server_name panel.your-domain.com;

    location / {
        proxy_pass http://panel:3000;
        proxy_http_version 1.1;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# Магазин
server {
    listen 80;
    server_name shop.your-domain.com;

    location / {
        proxy_pass http://shop:3002;
        proxy_http_version 1.1;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

ln -s /etc/nginx/sites-available/fresh-donate.conf /etc/nginx/sites-enabled/

nginx -t # проверка конфига

systemctl reload nginx

certbot --nginx -d api.your-domain.com -d panel.your-domain.com -d shop.your-domain.com