docs: wowater.md + README 0.5.23

2026-06-04 16:36:45 +03:00
parent e9bd94cea3
commit a0b66bb602
2 changed files with 72 additions and 3 deletions
@@ -0,0 +1,69 @@
+# WOWATER — развёртывание ipwhitelist-app (без воды)
+
+> Для опытных DevOps. Минимум текста, только команды.
+
+## 1. PostgreSQL
+
+```bash
+sudo apt install -y postgresql
+DB_PASS=$(openssl rand -base64 24)
+sudo -u postgres psql -c "CREATE USER ipwhitelist WITH PASSWORD '${DB_PASS}';"
+sudo -u postgres psql -c "CREATE DATABASE ipwhitelist OWNER ipwhitelist;"
+```
+
+## 2. Node.js + код
+
+```bash
+curl -fsSL https://deb.nodesource.com/setup_20.x | sudo bash -
+sudo apt install -y nodejs
+git clone https://gitea.services.ngcloud.ru/Nail/ipwhitelist-app.git /opt/ipwhitelist
+cd /opt/ipwhitelist
+npm install --production
+sudo -u postgres psql -d ipwhitelist -f sql/schema.sql
+```
+
+## 3. .env
+
+```bash
+cp .env.example .env && chmod 600 .env
+```
+
+Заполнить: `DB_PASS`, `SESSION_SECRET`, `KC_CLIENT_ID`, `KC_CLIENT_SECRET`, `APP_URL`, `IAM_API_URL`.
+
+`DEV_MODE` → `false`.
+
+## 4. nginx + Let's Encrypt
+
+```nginx
+server {
+    listen 443 ssl;
+    server_name ваш-домен.ru;
+    ssl_certificate /etc/letsencrypt/live/.../fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/.../privkey.pem;
+
+    location / {
+        proxy_pass http://127.0.0.1:3000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+}
+```
+
+## 5. PM2
+
+```bash
+npm i -g pm2
+pm2 start server.js --name ipwhitelist
+pm2 save && pm2 startup
+```
+
+## 6. Keycloak OIDC
+
+Создать Confidential client в Keycloak (realm `cloud`):
+- `Valid Redirect URIs`: `https://ваш-домен.ru/callback`
+- `Client Authentication`: On
+- Записать `KC_CLIENT_ID` и `KC_CLIENT_SECRET` в `.env`
+
+Готово. `pm2 restart ipwhitelist`.