first init

be/docker/production/docker-compose.production.yml

@@ -0,0 +1,77 @@
+services:
+  app:
+    build:
+      context: .
+      dockerfile: ./SUTERA-backend/docker/common/unified/Dockerfile
+      platforms:
+        - linux/amd64
+        - linux/arm64
+    image: git.ismailmasseran.com/topaz/sutera:v3.0.1b
+    container_name: sutera-app-production
+    restart: unless-stopped
+    ports:
+      - "${APP_PORT:-80}:80"
+    environment:
+      - APP_ENV=production
+      - APP_DEBUG=true
+      - REDIS_HOST=redis
+      - REDIS_PASSWORD=${REDIS_PASSWORD}
+      - CACHE_DRIVER=redis
+      - SESSION_DRIVER=redis
+      - QUEUE_CONNECTION=redis
+    volumes:
+      - app-storage-production:/var/www/storage
+      - app-logs-production:/var/www/storage/logs
+      - ./.env.production:/var/www/.env:ro
+      - ./SUTERA-backend/docker/production/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
+    networks:
+      - sutera-production-network
+    depends_on:
+      redis:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+  # Redis for caching and sessions
+  redis:
+    image: redis:8
+    container_name: sutera-redis-production
+    restart: unless-stopped
+    volumes:
+      - redis-data-production:/data
+      - ./redis-config/redis.conf:/usr/local/etc/redis/redis.conf:ro
+    command: redis-server /usr/local/etc/redis/redis.conf
+    networks:
+      - sutera-production-network
+    healthcheck:
+      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+networks:
+  sutera-production-network:
+    driver: bridge
+
+volumes:
+  app-storage-production:
+    driver: local
+  app-logs-production:
+    driver: local
+  redis-data-production:
+    driver: local

be/docker/production/nginx/nginx.conf

@@ -0,0 +1,100 @@
+events {
+    worker_connections  1024;
+}
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    sendfile        on;
+    keepalive_timeout  65;
+
+    # Logging
+    access_log /var/log/nginx/access.log;
+    error_log /var/log/nginx/error.log;
+
+    # Production HTTP server
+    server {
+        listen 80;
+        server_name _;
+        root /var/www/public;
+        index index.php index.html;
+
+        # Security headers
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-referrer-when-downgrade" always;
+
+        # API routes - pass directly to Laravel with original REQUEST_URI
+        location / {
+            fastcgi_pass 127.0.0.1:9000;
+            fastcgi_index index.php;
+            fastcgi_param SCRIPT_FILENAME $document_root/index.php;
+            include fastcgi_params;
+            fastcgi_param HTTP_PROXY "";
+            fastcgi_param HTTPS $https if_not_empty;
+            fastcgi_read_timeout 300;
+            fastcgi_send_timeout 300;
+        }
+
+        # PRODUCTION: /training/ path is disabled - return 404
+        location ^~ /training/ {
+            return 404;
+        }
+
+        # Serve frontend assets
+        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+            expires 1y;
+            add_header Cache-Control "public, immutable";
+            add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
+            try_files $uri =404;
+        }
+
+        # Handle all other routes - serve Vue app or Laravel
+        location / {
+            add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
+            try_files $uri $uri/ /index.html /index.php?$query_string;
+        }
+
+        # Handle PHP files - connect to localhost PHP-FPM
+        location ~ \.php$ {
+            fastcgi_pass 127.0.0.1:9000;
+            fastcgi_index index.php;
+            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+            include fastcgi_params;
+            
+            # Additional FastCGI parameters
+            fastcgi_param HTTP_PROXY "";
+            fastcgi_param HTTPS $https if_not_empty;
+            fastcgi_read_timeout 300;
+            fastcgi_send_timeout 300;
+        }
+
+        # Deny access to hidden files
+        location ~ /\. {
+            deny all;
+        }
+
+        # Health check endpoint for Docker
+        location = /health {
+            fastcgi_pass 127.0.0.1:9000;
+            fastcgi_index index.php;
+            fastcgi_param SCRIPT_FILENAME $document_root/index.php;
+            include fastcgi_params;
+            fastcgi_param HTTP_PROXY "";
+        }
+
+        location ^~ /horizon {
+            add_header Content-Security-Policy "default-src 'self' http: https: data: blob 'unsafe-inline' 'unsafe-eval'" always;
+            fastcgi_pass 127.0.0.1:9000;
+            fastcgi_index index.php;
+            fastcgi_param SCRIPT_FILENAME $document_root/index.php;
+            include fastcgi_params;
+            fastcgi_param HTTP_PROXY "";
+            fastcgi_param HTTPS $https if_not_empty;
+            fastcgi_read_timeout 300;
+            fastcgi_send_timeout 300;
+        }
+    }
+}

be/docker/production/redis/redis.conf

@@ -0,0 +1,3 @@
+port 6379
+bind 0.0.0.0
+requirepass sutera_redis@2025