Порты 3000/3001 закрыты для интернета (ufw allow только с IP VPS данных —
Prometheus). Публичный вход только netrunner-vpn.com через nginx: "/" на
сам лендинг, "/cms-api/" на PocketBase (со сменой префикса на "/api"),
"/api/" на proxy-ws (comments/speedtest, уже с этим префиксом внутри).
Тот же принцип, что и в netrunner-backend/netrunner-data — deploy-dev
пишет .env из vars.DEV_BOT_USERNAME перед docker compose up, руками на
сервере создавать больше не нужно. Прод по-прежнему без .env — все
значения там хардкожены в docker-compose.yml.
Auth: drop localStorage session token entirely, talk to netrunner-backend
via credentials:"include" HttpOnly cookies shared over the common parent
domain, and redirect to the account subdomain (ЛК) after login instead of
a dead local /profile route.
Config: NEXT_PUBLIC_* values used by client components (API_URL,
ACCOUNT_ORIGIN, BOT_USERNAME, PB_URL) get inlined into the JS bundle at
image build time and can't be overridden by docker-compose environment at
container start. Moved these reads into server components (page.tsx) and
thread them down as props, so one built image can genuinely serve both
prod and dev by config alone.
CI/CD: split the old single auto-deploy-to-prod workflow into build.yml
(build+push on every push to main) and deploy.yml with deploy-dev (auto,
same VPS as netrunner-backend's dev environment) and deploy-prod (manual
dispatch only) — mirrors netrunner-backend's pipeline shape. Added
docker-compose.dev-remote.yml pointing at the dev backend.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
nineap