nobswebdev/nullcart
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

init

Browse Source
This commit is contained in:
nobswebdev
2026-08-28 17:31:02 +02:00
commit 2b30e8bd39
694 changed files with 49243 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/DEPLOYMENT_GUIDE.md
+166
View File
@@ -0,0 +1,166 @@
# Deployment guide
## 1. Requirements
- Ubuntu 22.04+ (or similar Linux)
- Docker Engine and Compose plugin — follow [Install Docker Engine on Ubuntu](https://docs.docker.com/engine/install/ubuntu/#install-using-the-repository)
- A domain name pointing at your server (A record for clearnet HTTPS)
## 2. Server setup
Deploy as **root** on the VPS. Docker Engine and Compose plugin must be installed — [Install Docker Engine on Ubuntu](https://docs.docker.com/engine/install/ubuntu/#install-using-the-repository).
Verify:
```bash
docker compose version
```
## 3. Clone the repository
```bash
cd /root
git clone https://github.com/<org>/nullcart.git nullcart
cd nullcart
```
Replace `<org>/nullcart` with your actual repository URL once published.
## 4. Configure environment
```bash
cd /root/nullcart
cp .env.example .env.prod
chmod 600 .env.prod
```
Edit `.env.prod`. Mandatory configuration:
| Variable | Production value |
| ---------------------------- | ------------------------------------------- |
| `COMPOSE_PROJECT_NAME` | `nullcart_prod` |
| `POSTGRES_PASSWORD` | strong random password |
| `POSTGRES_MIGRATIONS_RUN` | `true` |
| `PGADMIN_DEFAULT_PASSWORD` | strong random password |
| `NODE_ENV` | `production` |
| `CORS_ORIGINS` | `https://your-domain.com` |
| `CLEARNET_DOMAIN` | `your-domain.com` |
| `JWT_SECRET` | strong random secret |
| `CMS_PASSWORD` | strong admin password |
| `SHOP_NAME` | your shop name |
| `SHOP_FIAT_CURRENCY` | `USD`, `EUR`, `GBP`, `CAD`, `AUD`, or `CHF` |
| `SIGNED_COOKIE_JWT_SECRET` | strong random secret |
| `BASE64_ENCRYPTION_KEY` | generate with `openssl rand -base64 32` |
| `MONERO_NETWORK` | `mainnet` |
| `MONERO_DAEMON_ADDRESS` | mainnet node `host:port` |
| `MONERO_WALLET_RPC_USERNAME` | strong random username |
| `MONERO_WALLET_RPC_PASSWORD` | strong random password |
| `MONERO_WALLET_PASSWORD` | strong wallet password |
| `VITE_API_BASE_URL` | `/api` |
| `VITE_SHOP_FIAT_CURRENCY` | same as `SHOP_FIAT_CURRENCY` |
Optional — adjust Monero payment confirmation rules:
**`MONERO_CONFIRMATION_TIERS`** — JSON array. For each order, the shop uses `minConfirmations` from the first tier where the order total (in `SHOP_FIAT_CURRENCY`) is `<= upToTotalFiat`. The last tier is a catch-all and must omit `upToTotalFiat`. At most one tier may use `minConfirmations: 0` (accept on mempool); that tier cannot be the catch-all.
Example (default in `.env.example`):
```json
[
{ "upToTotalFiat": "30", "minConfirmations": 0 },
{ "upToTotalFiat": "100", "minConfirmations": 3 },
{ "upToTotalFiat": "300", "minConfirmations": 5 },
{ "minConfirmations": 10 }
]
```
Orders up to 30 → 0 confirmations; up to 100 → 3; up to 300 → 5; above 300 → 10. Tiers are shown read-only in CMS shop settings.
## 5. Create the Monero wallet
```bash
./monero-wallet-rpc/setup-monero-wallet.sh --env-file .env.prod
```
## 6. Bootstrap TLS certificates
Nginx needs certificate files before it can start on port 443. For the **first** deploy, create a temporary self-signed pair (replaced after Let's Encrypt):
```bash
./deploy/scripts/bootstrap-certs.sh
```
After the stack is running, obtain real certificates (step 8).
## 7. Start the stack
```bash
./deploy/scripts/deploy.sh
```
Wait until `backend` and `nginx` are healthy:
```bash
docker compose --env-file .env.prod -f docker-compose.prod.yml ps
```
## 8. Issue Let's Encrypt certificates
Remove the temporary bootstrap certificates under `deploy/certs/live/` (Certbot cannot issue into the layout created by `bootstrap-certs.sh`):
```bash
rm -rf deploy/certs/live/*
```
Request the real certificate:
```bash
./deploy/scripts/issue-certs.sh --email you@example.com
```
Reload nginx:
```bash
docker compose --env-file .env.prod -f docker-compose.prod.yml exec nginx nginx -s reload
```
### Automatic renewal
Open root's crontab:
```bash
crontab -e
```
Add a weekly job (`/root/nullcart` is the standard deploy path):
```cron
0 3 * * 0 /root/nullcart/deploy/scripts/renew-certs.sh >> /var/log/nullcart-cert-renew.log 2>&1
```
Save and exit the editor. Optional — run once manually to verify:
```bash
/root/nullcart/deploy/scripts/renew-certs.sh
```
## 9. Tor onion address
```bash
./deploy/scripts/show-onion.sh
```
## 10. Complete shop setup
1. Open the CMS on clearnet or onion (`/cms`).
2. Log in with `CMS_PASSWORD` from `.env.prod`.
3. Finish the setup checklist in settings.
4. Connect SimpleX notifications in shop settings.
## 11. Updates
```bash
./deploy/scripts/update.sh
```
This pulls the latest code and rebuilds the stack (`deploy.sh`).
deploy/scripts/bootstrap-certs.sh
Executable
+38
View File
@@ -0,0 +1,38 @@
#!/usr/bin/env bash
set -euo pipefail
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
ENV_FILE="${ROOT_DIR}/.env.prod"
cd "$ROOT_DIR"
if [[ ! -f "$ENV_FILE" ]]; then
echo "Missing ${ENV_FILE}. Copy .env.example to .env.prod and configure it." >&2
exit 1
fi
# shellcheck disable=SC1090
set -a
source "$ENV_FILE"
set +a
if [[ -z "${CLEARNET_DOMAIN:-}" ]]; then
echo "CLEARNET_DOMAIN is not set in .env.prod" >&2
exit 1
fi
LIVE_DIR="${ROOT_DIR}/deploy/certs/live/${CLEARNET_DOMAIN}"
if [[ -f "${LIVE_DIR}/fullchain.pem" ]]; then
echo "Certificates already exist at deploy/certs/live/${CLEARNET_DOMAIN}" >&2
exit 1
fi
mkdir -p "$LIVE_DIR"
openssl req -x509 -nodes -newkey rsa:2048 -days 1 \
-keyout "${LIVE_DIR}/privkey.pem" \
-out "${LIVE_DIR}/fullchain.pem" \
-subj "/CN=${CLEARNET_DOMAIN}"
echo "Temporary self-signed certificates created at deploy/certs/live/${CLEARNET_DOMAIN}"
deploy/scripts/deploy.sh
Executable
+17
View File
@@ -0,0 +1,17 @@
#!/usr/bin/env bash
set -euo pipefail
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
ENV_FILE="${ROOT_DIR}/.env.prod"
cd "$ROOT_DIR"
if [[ ! -f "$ENV_FILE" ]]; then
echo "Missing ${ENV_FILE}. Copy .env.example to .env.prod and configure it." >&2
exit 1
fi
docker compose --env-file "$ENV_FILE" -f docker-compose.prod.yml up -d --build
echo "Pruning unused Docker data older than 24h..."
docker system prune -af --filter "until=24h"
deploy/scripts/issue-certs.sh
Executable
+78
View File
@@ -0,0 +1,78 @@
#!/usr/bin/env bash
set -euo pipefail
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
ENV_FILE="${ROOT_DIR}/.env.prod"
CERTBOT_EMAIL=""
usage() {
cat <<EOF
Usage: $(basename "$0") --email you@example.com
Obtain or renew Let's Encrypt certificates for CLEARNET_DOMAIN using the webroot
challenge. Nginx must be running and serving /.well-known/acme-challenge/ from
deploy/certbot/www.
Environment is read from .env.prod (CLEARNET_DOMAIN).
EOF
}
while [[ $# -gt 0 ]]; do
case "$1" in
--email)
CERTBOT_EMAIL="$2"
shift 2
;;
-h | --help)
usage
exit 0
;;
*)
echo "Unknown option: $1" >&2
usage >&2
exit 1
;;
esac
done
if [[ ! -f "$ENV_FILE" ]]; then
echo "Missing ${ENV_FILE}" >&2
exit 1
fi
# shellcheck disable=SC1090
set -a
source "$ENV_FILE"
set +a
if [[ -z "${CLEARNET_DOMAIN:-}" ]]; then
echo "CLEARNET_DOMAIN is not set in .env.prod" >&2
exit 1
fi
if [[ -z "$CERTBOT_EMAIL" ]]; then
echo "Pass --email for Let's Encrypt registration." >&2
usage >&2
exit 1
fi
mkdir -p "${ROOT_DIR}/deploy/certbot/www" "${ROOT_DIR}/deploy/certs"
docker run --rm \
-v "${ROOT_DIR}/deploy/certbot/www:/var/www/certbot" \
-v "${ROOT_DIR}/deploy/certs:/etc/letsencrypt" \
certbot/certbot certonly \
--webroot \
-w /var/www/certbot \
-d "$CLEARNET_DOMAIN" \
--email "$CERTBOT_EMAIL" \
--agree-tos \
--non-interactive
if [[ ! -f "${ROOT_DIR}/deploy/certs/live/${CLEARNET_DOMAIN}/fullchain.pem" ]]; then
echo "Expected certificates at deploy/certs/live/${CLEARNET_DOMAIN}" >&2
exit 1
fi
echo "Certificates issued at deploy/certs/live/${CLEARNET_DOMAIN}"
echo "Reload nginx: docker compose --env-file .env.prod -f docker-compose.prod.yml exec nginx nginx -s reload"
deploy/scripts/renew-certs.sh
Executable
+25
View File
@@ -0,0 +1,25 @@
#!/usr/bin/env bash
set -euo pipefail
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
ENV_FILE="${ROOT_DIR}/.env.prod"
cd "$ROOT_DIR"
if [[ ! -f "$ENV_FILE" ]]; then
echo "Missing ${ENV_FILE}" >&2
exit 1
fi
mkdir -p "${ROOT_DIR}/deploy/certbot/www" "${ROOT_DIR}/deploy/certs"
docker run --rm \
-v "${ROOT_DIR}/deploy/certbot/www:/var/www/certbot" \
-v "${ROOT_DIR}/deploy/certs:/etc/letsencrypt" \
certbot/certbot renew \
--webroot \
-w /var/www/certbot
docker compose --env-file "$ENV_FILE" -f docker-compose.prod.yml exec nginx nginx -s reload
echo "Certificate renewal complete; nginx reloaded."
deploy/scripts/show-onion.sh
Executable
+15
View File
@@ -0,0 +1,15 @@
#!/usr/bin/env bash
set -euo pipefail
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
ENV_FILE="${ROOT_DIR}/.env.prod"
cd "$ROOT_DIR"
if [[ ! -f "$ENV_FILE" ]]; then
echo "Missing ${ENV_FILE}" >&2
exit 1
fi
docker compose --env-file "$ENV_FILE" -f docker-compose.prod.yml exec tor \
cat /var/lib/tor/hs/hostname
deploy/scripts/update.sh
Executable
+10
View File
@@ -0,0 +1,10 @@
#!/usr/bin/env bash
set -euo pipefail
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
cd "$ROOT_DIR"
git pull
"${ROOT_DIR}/deploy/scripts/deploy.sh"
deploy/tor/Dockerfile
+7
View File
@@ -0,0 +1,7 @@
FROM alpine:3.20
RUN apk add --no-cache tor
COPY torrc /etc/tor/torrc
CMD ["tor", "-f", "/etc/tor/torrc"]
deploy/tor/torrc
+5
View File
@@ -0,0 +1,5 @@
SocksPort 0
Log notice stdout
HiddenServiceDir /var/lib/tor/hs/
HiddenServicePort 80 nginx:8080