99 lines
3.2 KiB
Markdown
99 lines
3.2 KiB
Markdown
# Oracle Always Free Docker Deployment
|
|
|
|
## 1. Create VM
|
|
- Use Ubuntu Always Free.
|
|
- Prefer Ampere A1 if available.
|
|
- Keep boot/block volume within Always Free limits.
|
|
|
|
## 2. Keep the VM private first
|
|
- Do not open `80/tcp`, `443/tcp`, or public DNS yet.
|
|
- Restrict `22/tcp` to your IP.
|
|
- The initial account is `admin` / `admin`; change it before the panel is reachable from the internet.
|
|
|
|
## 3. Install Docker
|
|
```bash
|
|
sudo apt-get update
|
|
sudo apt-get install -y ca-certificates curl gnupg
|
|
curl -fsSL https://get.docker.com | sh
|
|
sudo usermod -aG docker $USER
|
|
```
|
|
|
|
## 4. Configure app
|
|
```bash
|
|
cp .env.production.example .env.production
|
|
nano .env.production
|
|
cp Caddyfile.example Caddyfile
|
|
nano Caddyfile
|
|
```
|
|
|
|
For Telegram alerts:
|
|
- Create a bot with BotFather and copy the bot token into `TELEGRAM_BOT_TOKEN`.
|
|
- Send a message to the bot from the operator account or group.
|
|
- Get the destination `TELEGRAM_CHAT_ID` from the Telegram API or your preferred bot admin tool.
|
|
- Keep `TELEGRAM_ALERTS_ENABLED=true` only when both values are configured.
|
|
- To disable alerts safely, set `TELEGRAM_ALERTS_ENABLED=false` and leave token/chat fields blank.
|
|
- Never commit `.env.production` or share bot tokens, chat IDs, databases, logs, or WhatsApp auth data.
|
|
|
|
## 5. First startup on SSH-only access
|
|
- Keep OCI ingress for `80/tcp` and `443/tcp` closed for this first run.
|
|
- Do not start Caddy yet. Start only the app with a temporary localhost-only host port:
|
|
|
|
```bash
|
|
cat > docker-compose.local-first.yml <<'YAML'
|
|
services:
|
|
app:
|
|
ports:
|
|
- "127.0.0.1:3910:3910"
|
|
YAML
|
|
|
|
docker compose -f docker-compose.yml -f docker-compose.local-first.yml up -d --build app
|
|
docker compose ps
|
|
docker compose logs -f app
|
|
```
|
|
|
|
From your workstation, create an SSH tunnel and change the default password before exposing the stack:
|
|
|
|
```bash
|
|
ssh -L 3910:127.0.0.1:3910 ubuntu@YOUR_VM_PUBLIC_IP
|
|
```
|
|
|
|
- Open `http://127.0.0.1:3910` through the tunnel.
|
|
- Log in with `admin` / `admin`.
|
|
- Open **Configuracoes > Alterar minha senha** and set a strong unique password with at least 8 characters.
|
|
- Log out and log back in with the new password.
|
|
|
|
## 6. Expose HTTPS after password change
|
|
- Only after the admin password is changed, update `Caddyfile` to the public domain and point public DNS at the VM.
|
|
- Remove the temporary local-only override and start the public stack:
|
|
|
|
```bash
|
|
rm docker-compose.local-first.yml
|
|
docker compose up -d --build
|
|
```
|
|
|
|
- Only after the public stack is ready, open OCI ingress for `80/tcp` and `443/tcp` from the internet.
|
|
|
|
## 7. Smoke test safely
|
|
- Keep campaigns paused during deployment validation.
|
|
- Do not start real campaigns during smoke tests.
|
|
- Keep Google Places and Telegram tokens blank or fake unless intentionally testing those external services.
|
|
- Do not connect a real WhatsApp account or send real WhatsApp messages during smoke tests.
|
|
- Confirm health without sending:
|
|
|
|
```bash
|
|
curl -i http://127.0.0.1/api/health
|
|
docker compose restart app
|
|
docker compose ps
|
|
docker compose logs --tail=100 app
|
|
```
|
|
|
|
Expected: health is 200, the app container is healthy after restart, data remains in `/app/data`, and no outreach sends are created.
|
|
|
|
## 8. Backup
|
|
```bash
|
|
docker compose exec app npm run backup:data
|
|
```
|
|
|
|
## 9. QR recovery
|
|
When Telegram says QR is required, open the panel and reconnect WhatsApp.
|