infra: prod realities — port 3002, system Node v22, additive Redis/Postgres

Author: 711web

deploy/nginx/partner.711web.com.conf

@@ -1,5 +1,5 @@
 upstream partner_app {
-    server 127.0.0.1:3000 fail_timeout=0;
+    server 127.0.0.1:3002 fail_timeout=0;
     keepalive 16;
 }
 

deploy/pm2/ecosystem.config.cjs

@@ -4,14 +4,14 @@ module.exports = {
       name: 'partner-app',
       cwd: '/srv/referral-platform',
       script: 'node_modules/next/dist/bin/next',
-      args: 'start -p 3000',
+      args: 'start -p 3002',
       instances: 1,
       exec_mode: 'fork',
       autorestart: true,
       max_memory_restart: '600M',
       env: {
         NODE_ENV: 'production',
-        PORT: '3000',
+        PORT: '3002',
       },
       env_file: '/srv/referral-platform/.env',
     },

deploy/scripts/bootstrap-server.sh

@@ -1,22 +1,24 @@
 #!/usr/bin/env bash
 # Bootstrap script for partner.711web.com on the UK box (18.134.35.3).
-# Idempotent: safe to re-run. Run AS THE APP USER (ubuntu) with sudo available.
+# This box is SHARED with ClaimPilot, 711web.com, fitpanda, jnews, policychecker,
+# systempulse — so this script is deliberately additive and uses existing services
+# where possible. It will NOT install Node, Postgres, or nginx if already present.
 #
-# Prerequisites:
-#   - You've already cloned this repo to /srv/referral-platform (chown ubuntu:ubuntu)
-#   - DNS A record partner.711web.com -> 18.134.35.3 is INSYNC (it is)
-#   - nginx + certbot are already installed on the box (from existing 711web.com setup)
+# Idempotent: safe to re-run.
 #
-# This script will:
-#   1. Install Node 20 (via nvm), pnpm, PM2 for the current user
-#   2. Install Postgres 16 + Redis 7 via apt (idempotent)
-#   3. Create the `referral` Postgres role + database with a freshly generated random password
-#   4. Write /srv/referral-platform/.env with that password
-#   5. Install the nginx vhost for partner.711web.com
-#   6. Obtain a TLS certificate via certbot (webroot)
-#   7. Reload nginx
+# Run as the app user (ubuntu) from /srv/referral-platform. The user needs sudo.
 #
-# After this script: run `bash deploy/scripts/deploy.sh` to do the first deploy.
+# What this script does:
+#   1. Verifies Node + pnpm + PM2 are present (does NOT install nvm — uses system Node)
+#   2. Installs Redis ONLY if missing, configures it with maxmemory=128M for safety
+#   3. Adds Postgres role `referral` + database `referral` to the existing cluster
+#      (does NOT install postgres — assumes it's already running)
+#   4. Writes /srv/referral-platform/.env with a freshly generated DB password
+#   5. Installs nginx vhost for partner.711web.com
+#   6. Obtains a TLS cert via certbot --webroot
+#   7. Reloads nginx
+#
+# After this: run `bash deploy/scripts/deploy.sh` to do the first deploy.
 
 set -euo pipefail
 
@@ -25,78 +27,64 @@ APP_USER=${USER}
 ENV_FILE=$APP_DIR/.env
 CERT_EMAIL=711webservices@gmail.com
 DOMAIN=partner.711web.com
+APP_PORT=3002
 
 if [ ! -d "$APP_DIR/.git" ]; then
   echo "ERROR: $APP_DIR is not a git checkout. Clone the repo there first:"
   echo "  sudo mkdir -p $APP_DIR"
   echo "  sudo chown $APP_USER:$APP_USER $APP_DIR"
   echo "  git clone https://github.com/711web/referral-platform $APP_DIR"
-  echo "Then re-run this script."
   exit 1
 fi
 
 cd "$APP_DIR"
 
-# 1. Node + pnpm + PM2 (for current user)
-if [ ! -d "$HOME/.nvm" ]; then
-  echo ">> installing nvm"
-  curl -fsSL https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash
-fi
-export NVM_DIR="$HOME/.nvm"
-# shellcheck disable=SC1091
-. "$NVM_DIR/nvm.sh"
-if ! nvm ls 20 >/dev/null 2>&1; then
-  echo ">> installing node 20"
-  nvm install 20
-fi
-nvm alias default 20 >/dev/null
-nvm use 20 >/dev/null
-corepack enable
-corepack prepare pnpm@9.12.3 --activate
-if ! command -v pm2 >/dev/null; then
-  echo ">> installing pm2"
-  npm install -g pm2
-fi
-
-# 2. System packages (idempotent)
-echo ">> ensuring postgres-16 + redis-server are installed"
-if ! command -v psql >/dev/null || ! dpkg -l postgresql-16 >/dev/null 2>&1; then
-  # Postgres 16 isn't in default Ubuntu repos before 24.04 — add PGDG repo
-  if [ ! -f /etc/apt/sources.list.d/pgdg.list ]; then
-    echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" \
-      | sudo tee /etc/apt/sources.list.d/pgdg.list
-    curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc \
-      | sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/postgresql.gpg
+# 1. Verify Node + pnpm + PM2 (DO NOT install if missing — flag instead)
+for tool in node pnpm pm2 nginx psql certbot; do
+  if ! command -v "$tool" >/dev/null; then
+    echo "ERROR: $tool not found. This is a shared box — install $tool manually before re-running this script."
+    exit 1
   fi
-  sudo apt-get update
-  sudo DEBIAN_FRONTEND=noninteractive apt-get install -y postgresql-16
-fi
+done
+echo ">> node $(node -v), pnpm $(pnpm -v), pm2 $(pm2 -v) detected"
+
+# 2. Install Redis only if missing
 if ! command -v redis-cli >/dev/null; then
+  echo ">> installing redis-server (not present on box)"
+  sudo DEBIAN_FRONTEND=noninteractive apt-get update -qq
   sudo DEBIAN_FRONTEND=noninteractive apt-get install -y redis-server
+  # Cap memory at 128MB so we can't OOM the shared box
+  sudo sed -i 's/^# *maxmemory .*/maxmemory 128mb/' /etc/redis/redis.conf
+  sudo sed -i 's/^# *maxmemory-policy .*/maxmemory-policy allkeys-lru/' /etc/redis/redis.conf
+  grep -q '^maxmemory ' /etc/redis/redis.conf || echo 'maxmemory 128mb' | sudo tee -a /etc/redis/redis.conf >/dev/null
+  grep -q '^maxmemory-policy ' /etc/redis/redis.conf || echo 'maxmemory-policy allkeys-lru' | sudo tee -a /etc/redis/redis.conf >/dev/null
+  sudo systemctl enable --now redis-server
+  sudo systemctl restart redis-server
+else
+  echo ">> redis already installed"
 fi
-sudo systemctl enable --now postgresql redis-server
+redis-cli ping >/dev/null || { echo "ERROR: redis didn't respond"; exit 1; }
 
-# 3. DB role + database
-echo ">> ensuring postgres role + database"
-DB_PW=$(sudo -u postgres psql -tA -c "SELECT 'EXISTS' FROM pg_roles WHERE rolname='referral'" || echo "")
-if [ "$DB_PW" != "EXISTS" ]; then
+# 3. DB role + database (additive — checks if already exists)
+echo ">> ensuring postgres role + database (additive)"
+ROLE_EXISTS=$(sudo -u postgres psql -tA -c "SELECT 1 FROM pg_roles WHERE rolname='referral'" 2>/dev/null || echo "")
+if [ -z "$ROLE_EXISTS" ]; then
   NEW_PW=$(openssl rand -base64 32 | tr -d '=+/')
   sudo -u postgres psql <<SQL
 CREATE ROLE referral LOGIN PASSWORD '$NEW_PW';
 CREATE DATABASE referral OWNER referral;
 SQL
   EFFECTIVE_PW=$NEW_PW
-  echo ">> generated new DB password (saved in .env below)"
+  echo ">> created role + db with new random password"
 else
-  # Role already exists — keep existing pw if .env already has it, otherwise rotate
   if [ -f "$ENV_FILE" ] && grep -q '^DATABASE_URL=' "$ENV_FILE"; then
-    echo ">> role exists and .env already has DATABASE_URL — keeping current password"
+    echo ">> role exists and .env has DATABASE_URL — keeping current password"
     EFFECTIVE_PW=$(grep '^DATABASE_URL=' "$ENV_FILE" | sed -n 's|.*://referral:\([^@]*\)@.*|\1|p')
   else
     NEW_PW=$(openssl rand -base64 32 | tr -d '=+/')
     sudo -u postgres psql -c "ALTER ROLE referral PASSWORD '$NEW_PW';"
     EFFECTIVE_PW=$NEW_PW
-    echo ">> rotated DB password"
+    echo ">> rotated DB password (role existed without .env)"
   fi
 fi
 
@@ -107,6 +95,7 @@ DATABASE_URL=postgres://referral:${EFFECTIVE_PW}@localhost:5432/referral
 REDIS_URL=redis://localhost:6379
 SHORT_DOMAIN=partner.711web.com
 NODE_ENV=production
+PORT=${APP_PORT}
 EOF
 chmod 600 "$ENV_FILE"
 
@@ -124,19 +113,22 @@ if [ ! -d "/etc/letsencrypt/live/$DOMAIN" ]; then
   sudo nginx -t && sudo systemctl reload nginx
   sudo certbot certonly --webroot -w /var/www/certbot -d "$DOMAIN" \
     --non-interactive --agree-tos -m "$CERT_EMAIL"
-  # Uncomment the 443 server block
   sudo sed -i 's/^#TLS_TEMP#//' "/etc/nginx/sites-available/$DOMAIN.conf"
 fi
 sudo nginx -t && sudo systemctl reload nginx
 
-# PM2 systemd startup hook (run once)
-if ! systemctl list-unit-files | grep -q "^pm2-${APP_USER}\.service"; then
+# PM2 systemd startup hook (run once per user)
+if ! systemctl list-unit-files 2>/dev/null | grep -q "^pm2-${APP_USER}\.service"; then
   echo ">> setting up pm2 systemd hook"
-  pm2 startup systemd -u "$APP_USER" --hp "$HOME" | tail -1 | sudo bash || true
+  STARTUP_CMD=$(pm2 startup systemd -u "$APP_USER" --hp "$HOME" 2>&1 | tail -1)
+  if [[ "$STARTUP_CMD" == sudo* ]]; then
+    eval "$STARTUP_CMD" || true
+  fi
 fi
 
 echo ""
 echo "=========================================="
 echo "Bootstrap complete."
+echo "App will listen on 127.0.0.1:${APP_PORT} (proxied by nginx for $DOMAIN)."
 echo "Next: bash deploy/scripts/deploy.sh"
 echo "=========================================="

deploy/scripts/deploy.sh

@@ -8,10 +8,7 @@ set -euo pipefail
 APP_DIR=/srv/referral-platform
 cd "$APP_DIR"
 
-export NVM_DIR="$HOME/.nvm"
-# shellcheck disable=SC1091
-. "$NVM_DIR/nvm.sh"
-nvm use 20 >/dev/null
+echo ">> using system node $(node -v) and pnpm $(pnpm -v)"
 
 echo ">> git pull"
 git fetch --all --prune