# WOWATER — развёртывание ipwhitelist-app (без воды)

> Для опытных DevOps. Минимум текста, только команды.

## 1. PostgreSQL

```bash
sudo apt install -y postgresql
DB_PASS=$(openssl rand -base64 24)
sudo -u postgres psql -c "CREATE USER ipwhitelist WITH PASSWORD '${DB_PASS}';"
sudo -u postgres psql -c "CREATE DATABASE ipwhitelist OWNER ipwhitelist;"
```

## 2. Node.js + код

```bash
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo bash -
sudo apt install -y nodejs
git clone https://gitea.services.ngcloud.ru/Nail/ipwhitelist-app.git /opt/ipwhitelist
cd /opt/ipwhitelist
npm install --production
sudo -u postgres psql -d ipwhitelist -f sql/schema.sql
```

## 3. .env

```bash
cp .env.example .env && chmod 600 .env
```

Заполнить: `DB_PASS`, `SESSION_SECRET`, `KC_CLIENT_ID`, `KC_CLIENT_SECRET`, `APP_URL`, `IAM_API_URL`.

`DEV_MODE` → `false`.

## 4. nginx + Let's Encrypt

```nginx
server {
    listen 443 ssl;
    server_name ваш-домен.ru;
    ssl_certificate /etc/letsencrypt/live/.../fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/.../privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}
```

## 5. PM2

```bash
npm i -g pm2
pm2 start server.js --name ipwhitelist
pm2 save && pm2 startup
```

## 6. Keycloak OIDC

Создать Confidential client в Keycloak (realm `cloud`):
- `Valid Redirect URIs`: `https://ваш-домен.ru/callback`
- `Client Authentication`: On
- Записать `KC_CLIENT_ID` и `KC_CLIENT_SECRET` в `.env`

Готово. `pm2 restart ipwhitelist`.