modstagram/modstagram-back
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add full project files

Browse Source
This commit is contained in:
root
2026-07-04 19:24:56 +03:30
parent d54f5441a3
commit b245e7b71a
835 changed files with 30149 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
scripts/cdn-ssl.sh Normal file
View File

@@ -0,0 +1,48 @@
#!/bin/bash
# فعال‌سازی SSL رایگان Let's Encrypt برای دامنه CDN
# استفاده: bash cdn-ssl.sh cdn.modstagram.com admin@modstagram.com
set -e
DOMAIN="$1"
EMAIL="$2"
if [ -z "$DOMAIN" ]; then
echo "ERROR: domain is required"
exit 1
fi
if [ -z "$EMAIL" ]; then
EMAIL="admin@modstagram.com"
fi
if ! command -v certbot &> /dev/null; then
echo "Installing certbot..."
apt-get update -y
apt-get install -y certbot python3-certbot-nginx
fi
echo "Requesting certificate for: $DOMAIN"
certbot certonly \
--nginx \
--non-interactive \
--agree-tos \
--email "$EMAIL" \
-d "$DOMAIN" \
--redirect
echo "Certificate issued successfully for $DOMAIN"
if command -v nginx &> /dev/null; then
nginx -t && systemctl reload nginx
echo "Nginx reloaded"
fi
if [ "$3" = "--setup-cron" ] || [ "${SSL_AUTO_RENEW:-true}" = "true" ]; then
CRON_CMD="0 3 * * * certbot renew --quiet --nginx && systemctl reload nginx"
(crontab -l 2>/dev/null | grep -v "certbot renew" ; echo "$CRON_CMD") | crontab -
echo "Auto-renew cron job configured"
fi
echo "SSL activation complete"

35
scripts/disable-cdn-settings.js Normal file
View File

@@ -0,0 +1,35 @@
#!/bin/bash
# غیرفعال کردن CDN در دیتابیس (MongoDB)
# اجرا: node /root/modstagram-back/scripts/disable-cdn-settings.js
const mongoose = require('mongoose')
require('dotenv').config({ path: require('path').join(__dirname, '../.env') })
const MONGO_URI =
process.env.MONGODB_URI ||
process.env.MONGO_URI ||
'mongodb://127.0.0.1:27017/modstagram'
const keys = {
cdn_enabled: 'false',
cdn_domain: 'cdn.modstagram.com',
cdn_origin_url: 'https://api.modstagram.com',
}
async function main() {
await mongoose.connect(MONGO_URI)
const col = mongoose.connection.collection('settings')
for (const [key, value] of Object.entries(keys)) {
await col.updateOne({ key }, { $set: { key, value: String(value) } }, { upsert: true })
console.log(` ${key} = ${value}`)
}
console.log('\nCDN disabled. image_base_url will be https://api.modstagram.com/storage')
await mongoose.disconnect()
}
main().catch((err) => {
console.error(err)
process.exit(1)
})

40
scripts/dns/db.modstagram.com Normal file
View File

@@ -0,0 +1,40 @@
$TTL 3600
@ IN SOA ns1.modstagram.com. admin.modstagram.com. (
2026061702 ; Serial — با هر تغییر +1 کنید
3600
1800
604800
86400 )
; ═══════════════════════════════════════
; Nameservers — سرور شما
; ═══════════════════════════════════════
@ IN NS ns1.modstagram.com.
@ IN NS ns2.modstagram.com.
ns1 IN A 185.164.73.197
ns2 IN A 185.164.73.197
; ═══════════════════════════════════════
; ساب‌دامین‌ها — همه به IP سرور
; ═══════════════════════════════════════
@ IN A 185.164.73.197
www IN A 185.164.73.197
api IN A 185.164.73.197
app IN A 185.164.73.197
panel IN A 185.164.73.197
blog IN A 185.164.73.197
pay IN A 185.164.73.197
cdn IN A 185.164.73.197
; ═══════════════════════════════════════
; SPF — ایمیل (همان مقادیر فعلی شما)
; ═══════════════════════════════════════
@ IN TXT "v=spf1 a mx ip4:185.164.73.197 ~all"
* IN TXT "v=spf1 a mx ip4:185.164.73.197 ~all"
; ═══════════════════════════════════════
; ایمیل (اختیاری)
; ═══════════════════════════════════════
@ IN MX 10 mail.modstagram.com.
mail IN A 185.164.73.197

21
scripts/dns/db.modstagram.ir Normal file
View File

@@ -0,0 +1,21 @@
$TTL 3600
@ IN SOA ns1.modstagram.com. admin.modstagram.com. (
2026061702
3600
1800
604800
86400 )
@ IN NS ns1.modstagram.com.
@ IN NS ns2.modstagram.com.
@ IN A 185.164.73.197
www IN A 185.164.73.197
api IN A 185.164.73.197
app IN A 185.164.73.197
panel IN A 185.164.73.197
blog IN A 185.164.73.197
pay IN A 185.164.73.197
cdn IN A 185.164.73.197
@ IN TXT "v=spf1 a mx ip4:185.164.73.197 ~all"

45
scripts/dns/install-bind9.sh Normal file
View File

@@ -0,0 +1,45 @@
#!/bin/bash
# نصب BIND9 و فعال‌سازی zone modstagram.com روی سرور Asiatech
# اجرا: bash install-bind9.sh
set -e
ZONE_FILE="/etc/bind/db.modstagram.com"
SOURCE="$(dirname "$0")/modstagram.com.zone"
apt-get update
apt-get install -y bind9 bind9utils
cp "$SOURCE" "$ZONE_FILE"
chown root:bind "$ZONE_FILE"
chmod 644 "$ZONE_FILE"
if ! grep -q 'zone "modstagram.com"' /etc/bind/named.conf.local 2>/dev/null; then
cat >> /etc/bind/named.conf.local << 'EOF'
zone "modstagram.com" {
type master;
file "/etc/bind/db.modstagram.com";
};
EOF
fi
# اجازه query از بیرون
OPTIONS_FILE="/etc/bind/named.conf.options"
if grep -q 'allow-query' "$OPTIONS_FILE"; then
sed -i 's/allow-query { any; };/allow-query { any; };/' "$OPTIONS_FILE" || true
else
sed -i '/recursion yes;/a \ allow-query { any; };' "$OPTIONS_FILE" || true
fi
named-checkconf
named-checkzone modstagram.com "$ZONE_FILE"
systemctl enable bind9
systemctl restart bind9
echo ""
echo "BIND9 OK. تست محلی:"
dig @127.0.0.1 api.modstagram.com +short
echo ""
echo "قدم بعد: در پنل رجیسترار NS را به ns1.modstagram.com و ns2.modstagram.com تغییر دهید + Glue records"

38
scripts/dns/modstagram.com.zone Normal file
View File

@@ -0,0 +1,38 @@
$TTL 3600
@ IN SOA ns1.modstagram.com. admin.modstagram.com. (
2026061901 ; Serial (YYYYMMDDnn — بعد از هر تغییر +1)
3600 ; Refresh
1800 ; Retry
604800 ; Expire
3600 ) ; Minimum TTL
; Nameservers (هر دو روی همین سرور — برای setup تک‌سروره OK است)
@ IN NS ns1.modstagram.com.
@ IN NS ns2.modstagram.com.
; Glue records (در رجیسترار هم باید ثبت شوند)
ns1 IN A 193.151.143.243
ns2 IN A 193.151.143.243
; --- سایت و ساب‌دامنه‌های اصلی ---
@ IN A 193.151.143.243
www IN A 193.151.143.243
api IN A 193.151.143.243
app IN A 193.151.143.243
panel IN A 193.151.143.243
pay IN A 193.151.143.243
; اختیاری — اگر nginx برای این‌ها فعال است
cdn IN A 193.151.143.243
blog IN A 193.151.143.243
; Wildcard (اختیاری — همه ساب‌دامنه‌های تعریف‌نشده)
; * IN A 193.151.143.243
; --- ایمیل (فقط اگر mail روی همین سرور است؛ وگرنه مقادیر قدیم را نگه دار) ---
; @ IN MX 10 mail.modstagram.com.
; mail IN A YOUR_MAIL_SERVER_IP
; --- SSL Let's Encrypt (HTTP-01 معمولاً کافی است؛ برای DNS-01) ---
; _acme-challenge IN TXT "..."

11
scripts/dns/named.conf.local.snippet Normal file
View File

@@ -0,0 +1,11 @@
// این بلوک‌ها را به /etc/bind/named.conf.local اضافه کنید
zone "modstagram.com" {
type master;
file "/etc/bind/db.modstagram.com";
};
zone "modstagram.ir" {
type master;
file "/etc/bind/db.modstagram.ir";
};

8
scripts/fix-crlf.sh Normal file
View File

@@ -0,0 +1,8 @@
#!/bin/bash
# Fix Windows line endings (CRLF -> LF) after FTP upload
# Run once: bash fix-crlf.sh
DIR="$(cd "$(dirname "$0")" && pwd)"
find "$DIR" -type f \( -name "*.sh" -o -name "*.conf" -o -name "db.*" -o -name "*.snippet" \) -exec sed -i 's/\r$//' {} \;
chmod +x "$DIR/server-setup.sh" "$DIR/cdn-ssl.sh" "$DIR/fix-crlf.sh" 2>/dev/null || true
echo "Fixed line endings in $DIR"

8
scripts/nginx-cdn.example.conf Normal file
View File

@@ -0,0 +1,8 @@
# نمونه کانفیگ Nginx برای CDN — به‌روز شده
# فایل‌های کامل در پوشه scripts/nginx/ هستند
# IP سرور: 185.164.73.197
#
# نصب خودکار:
# cd ~/modstagram-back/scripts
# chmod +x server-setup.sh
# bash server-setup.sh

2
scripts/nginx-redirects.example.conf Normal file
View File

@@ -0,0 +1,2 @@
# ریدایرکت .ir — فایل کامل در scripts/nginx/modstagram-redirects.conf
# IP سرور: 185.164.73.197

25
scripts/nginx/api.modstagram.com.conf Normal file
View File

@@ -0,0 +1,25 @@
# API — api.modstagram.com → Node.js port 3002
# مسیر: /etc/nginx/sites-available/api.modstagram.com
server {
listen 80;
server_name api.modstagram.com;
location /.well-known/acme-challenge/ {
root /var/www/certbot;
}
location / {
proxy_pass http://127.0.0.1:3002;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 300s;
proxy_send_timeout 300s;
client_max_body_size 100M;
}
}

13
scripts/nginx/app.modstagram.com.conf Normal file
View File

@@ -0,0 +1,13 @@
# app.modstagram.com → ریدایرکت به api.modstagram.com
# (جایگزین app.modstagram.ir قدیمی)
server {
listen 80;
listen 443 ssl;
server_name app.modstagram.com;
ssl_certificate /etc/letsencrypt/live/api.modstagram.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/api.modstagram.com/privkey.pem;
return 301 https://api.modstagram.com$request_uri;
}

27
scripts/nginx/blog.modstagram.com.conf Normal file
View File

@@ -0,0 +1,27 @@
# blog.modstagram.com — وردپرس / وبلاگ
# اگر وردپرس روی پورت دیگری است، proxy_pass را عوض کنید
server {
listen 80;
server_name blog.modstagram.com;
location /.well-known/acme-challenge/ {
root /var/www/certbot;
}
location / {
# وردپرس معمولاً روی 8080 یا همان nginx جدا است
# اگر مسیر فایل دارید:
root /var/www/blog;
index index.php index.html;
try_files $uri $uri/ /index.php?$args;
}
location ~ \.php$ {
root /var/www/blog;
fastcgi_pass unix:/var/run/php/php-fpm.sock;
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
}
}

46
scripts/nginx/cdn.modstagram.com.conf Normal file
View File

@@ -0,0 +1,46 @@
# CDN — cdn.modstagram.com → کش فایل‌های storage
# مسیر: /etc/nginx/sites-available/cdn.modstagram.com
# IP سرور: 185.164.73.197
proxy_cache_path /var/cache/nginx/cdn levels=1:2 keys_zone=cdn_cache:50m inactive=7d max_size=5g;
server {
listen 80;
server_name cdn.modstagram.com;
location /.well-known/acme-challenge/ {
root /var/www/certbot;
}
location / {
return 301 https://$host$request_uri;
}
}
server {
listen 443 ssl http2;
server_name cdn.modstagram.com;
ssl_certificate /etc/letsencrypt/live/cdn.modstagram.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/cdn.modstagram.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
location /storage/ {
proxy_pass http://127.0.0.1:3002/storage/;
proxy_set_header Host api.modstagram.com;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_cache cdn_cache;
proxy_cache_valid 200 1h;
proxy_cache_valid 404 1m;
add_header X-Cache-Status $upstream_cache_status;
add_header Access-Control-Allow-Origin *;
}
location /health {
return 200 "cdn-ok";
add_header Content-Type text/plain;
}
}

30
scripts/nginx/cdn.modstagram.com.http.conf Normal file
View File

@@ -0,0 +1,30 @@
# CDN — فقط HTTP (قبل از SSL)
# بعد از certbot فایل cdn.modstagram.com.conf را فعال کنید
proxy_cache_path /var/cache/nginx/cdn levels=1:2 keys_zone=cdn_cache:50m inactive=7d max_size=5g;
server {
listen 80;
server_name cdn.modstagram.com;
location /.well-known/acme-challenge/ {
root /var/www/certbot;
}
location /storage/ {
proxy_pass http://127.0.0.1:3002/storage/;
proxy_set_header Host api.modstagram.com;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_cache cdn_cache;
proxy_cache_valid 200 1h;
add_header X-Cache-Status $upstream_cache_status;
add_header Access-Control-Allow-Origin *;
}
location /health {
return 200 "cdn-ok";
add_header Content-Type text/plain;
}
}

50
scripts/nginx/modstagram-redirects.conf Normal file
View File

@@ -0,0 +1,50 @@
# ریدایرکت دامنه‌های .ir به .com
# مسیر: /etc/nginx/sites-available/modstagram-redirects.conf
# modstagram.ir → modstagram.com
server {
listen 80;
listen 443 ssl;
server_name modstagram.ir www.modstagram.ir;
ssl_certificate /etc/letsencrypt/live/modstagram.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/modstagram.com/privkey.pem;
return 301 https://modstagram.com$request_uri;
}
# app.modstagram.ir → api.modstagram.com
server {
listen 80;
listen 443 ssl;
server_name app.modstagram.ir;
ssl_certificate /etc/letsencrypt/live/api.modstagram.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/api.modstagram.com/privkey.pem;
return 301 https://api.modstagram.com$request_uri;
}
# api.modstagram.ir → api.modstagram.com
server {
listen 80;
listen 443 ssl;
server_name api.modstagram.ir;
ssl_certificate /etc/letsencrypt/live/api.modstagram.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/api.modstagram.com/privkey.pem;
return 301 https://api.modstagram.com$request_uri;
}
# panel.modstagram.ir → panel.modstagram.com
server {
listen 80;
listen 443 ssl;
server_name panel.modstagram.ir www.panel.modstagram.ir;
ssl_certificate /etc/letsencrypt/live/panel.modstagram.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/panel.modstagram.com/privkey.pem;
return 301 https://panel.modstagram.com$request_uri;
}

23
scripts/nginx/modstagram.com.conf Normal file
View File

@@ -0,0 +1,23 @@
# فرانت — modstagram.com → Next.js port 3001
# مسیر: /etc/nginx/sites-available/modstagram.com
server {
listen 80;
server_name modstagram.com www.modstagram.com;
location /.well-known/acme-challenge/ {
root /var/www/certbot;
}
location / {
proxy_pass http://127.0.0.1:3001;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# Cloudflare Flexible: origin sees HTTP but users use HTTPS — force proto for Next.js assets
proxy_set_header X-Forwarded-Proto https;
}
}

24
scripts/nginx/panel.modstagram.com.conf Normal file
View File

@@ -0,0 +1,24 @@
# پنل ادمین — panel.modstagram.com
# مسیر: /etc/nginx/sites-available/panel.modstagram.com
# قبل از فعال‌سازی: npm run build در modstagram_panel
server {
listen 80;
server_name panel.modstagram.com;
root /root/modstagram_panel/build;
index index.html;
location /.well-known/acme-challenge/ {
root /var/www/certbot;
}
location / {
try_files $uri $uri/ /index.html;
}
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
expires 30d;
add_header Cache-Control "public, immutable";
}
}

19
scripts/nginx/pay.modstagram.com.conf Normal file
View File

@@ -0,0 +1,19 @@
# pay.modstagram.com — درگاه پرداخت
# فعلاً به API هدایت می‌شود (مسیرهای payment در بک‌اند)
server {
listen 80;
server_name pay.modstagram.com;
location /.well-known/acme-challenge/ {
root /var/www/certbot;
}
location / {
proxy_pass http://127.0.0.1:3002;
proxy_set_header Host api.modstagram.com;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}

80
scripts/revert-cdn-server.sh Normal file
View File

@@ -0,0 +1,80 @@
#!/bin/bash
# بازگردانی سرور به حالت قبل از CDN — بدون ParsPack
# اجرا: bash /root/modstagram-back/scripts/revert-cdn-server.sh
set -e
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
SERVER_IP="${SERVER_IP:-185.164.73.197}"
echo "=========================================="
echo " Revert CDN / restore direct API storage"
echo " Server IP: $SERVER_IP"
echo "=========================================="
echo ""
echo ">>> [1/5] Disable CDN nginx site..."
rm -f /etc/nginx/sites-enabled/cdn.modstagram.com.conf
rm -f /etc/nginx/sites-enabled/cdn.modstagram.com.http.conf 2>/dev/null || true
echo ""
echo ">>> [2/5] Restore API nginx (proxy to Node 3002)..."
if [ -f "$SCRIPT_DIR/nginx/api.modstagram.com.conf" ]; then
cp "$SCRIPT_DIR/nginx/api.modstagram.com.conf" /etc/nginx/sites-available/api.modstagram.com.conf
ln -sf /etc/nginx/sites-available/api.modstagram.com.conf /etc/nginx/sites-enabled/api.modstagram.com.conf
fi
echo ""
echo ">>> [3/5] Stop local BIND9 (optional — if it conflicts with registrar DNS)..."
if systemctl is-active --quiet bind9 2>/dev/null; then
systemctl stop bind9 2>/dev/null || true
systemctl disable bind9 2>/dev/null || true
echo " BIND9 stopped (DNS now from registrar only)"
else
echo " BIND9 not running"
fi
echo ""
echo ">>> [4/5] Test nginx and reload..."
nginx -t
systemctl reload nginx
echo ""
echo ">>> [5/5] Restart backend + check local storage..."
if command -v pm2 >/dev/null 2>&1; then
pm2 restart modstagram-back || pm2 restart all || true
fi
sleep 2
echo ""
echo "--- Local diagnostics (no curl needed) ---"
echo -n "API version: "
wget -qO- --timeout=5 http://127.0.0.1:3002/api/v1/version 2>/dev/null || echo "FAILED"
SAMPLE_IMG=$(find /root/modstagram-back/storage/posts/images -type f 2>/dev/null | head -1)
if [ -n "$SAMPLE_IMG" ]; then
REL="/storage/posts/images/$(basename "$SAMPLE_IMG")"
echo "Sample file: $SAMPLE_IMG"
echo "Testing: http://127.0.0.1:3002$REL"
wget -S --spider --timeout=5 "http://127.0.0.1:3002$REL" 2>&1 | head -8
else
echo "WARN: no images in storage/posts/images"
fi
echo ""
echo "=========================================="
echo " DONE"
echo "=========================================="
echo ""
echo " Apps must use:"
echo " NEXT_PUBLIC_IMAGE_BASE_URL=https://api.modstagram.com/storage"
echo ""
echo " In ParsPack panel (when ready):"
echo " - Disable WCDN for api.modstagram.com"
echo " - A record api -> $SERVER_IP"
echo ""
echo " Rebuild frontends:"
echo " cd /root/modstagram-next && npm run build && pm2 restart modstagram-next"
echo " cd /root/modstagram_panel && npm run build && pm2 restart modstagram_panel"
echo ""

125
scripts/server-setup.sh Normal file
View File

@@ -0,0 +1,125 @@
#!/bin/bash
# Modstagram Server Setup - IP: 185.164.73.197
# Run: bash server-setup.sh
set -e
SERVER_IP="185.164.73.197"
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
ADMIN_EMAIL="${SSL_ADMIN_EMAIL:-admin@modstagram.com}"
echo "=========================================="
echo " Modstagram Server Setup"
echo " IP: $SERVER_IP"
echo "=========================================="
echo ""
echo ">>> [1/6] Install BIND9, Nginx, Certbot..."
apt-get update -y
apt-get install -y bind9 bind9utils nginx certbot python3-certbot-nginx
mkdir -p /var/www/certbot
mkdir -p /var/cache/nginx/cdn
echo ""
echo ">>> [2/6] Configure DNS..."
cp "$SCRIPT_DIR/dns/db.modstagram.com" /etc/bind/db.modstagram.com
cp "$SCRIPT_DIR/dns/db.modstagram.ir" /etc/bind/db.modstagram.ir
if ! grep -q 'zone "modstagram.com"' /etc/bind/named.conf.local 2>/dev/null; then
cat "$SCRIPT_DIR/dns/named.conf.local.snippet" >> /etc/bind/named.conf.local
fi
if ! grep -q 'allow-query' /etc/bind/named.conf.options; then
sed -i '/options {/a \ allow-query { any; };\n listen-on { any; };' /etc/bind/named.conf.options
fi
named-checkconf
systemctl restart bind9
systemctl enable bind9
echo " DNS active (port 53)"
echo ""
echo ">>> [3/6] Configure Nginx..."
for conf in api.modstagram.com modstagram.com panel.modstagram.com app.modstagram.com blog.modstagram.com pay.modstagram.com cdn.modstagram.com.http; do
src="$SCRIPT_DIR/nginx/${conf}.conf"
dst_name="${conf/.http/}.conf"
dst="/etc/nginx/sites-available/${dst_name}"
cp "$src" "$dst"
ln -sf "$dst" "/etc/nginx/sites-enabled/${dst_name}"
done
rm -f /etc/nginx/sites-enabled/default 2>/dev/null || true
nginx -t
systemctl reload nginx
systemctl enable nginx
echo " Nginx active"
echo ""
echo ">>> [4/6] Firewall (optional)..."
if command -v ufw >/dev/null 2>&1; then
ufw allow 22/tcp 2>/dev/null || true
ufw allow 53/tcp 2>/dev/null || true
ufw allow 53/udp 2>/dev/null || true
ufw allow 80/tcp 2>/dev/null || true
ufw allow 443/tcp 2>/dev/null || true
ufw --force enable 2>/dev/null || true
else
echo " ufw not installed, skipping"
fi
echo ""
echo ">>> [5/6] SSL (Let's Encrypt)..."
echo " DNS must point to $SERVER_IP"
certbot --nginx --non-interactive --agree-tos --email "$ADMIN_EMAIL" \
-d modstagram.com -d www.modstagram.com || echo " WARN: modstagram.com SSL failed"
certbot --nginx --non-interactive --agree-tos --email "$ADMIN_EMAIL" \
-d api.modstagram.com || echo " WARN: api SSL failed"
certbot --nginx --non-interactive --agree-tos --email "$ADMIN_EMAIL" \
-d panel.modstagram.com || echo " WARN: panel SSL failed"
certbot --nginx --non-interactive --agree-tos --email "$ADMIN_EMAIL" \
-d blog.modstagram.com || echo " WARN: blog SSL failed"
certbot --nginx --non-interactive --agree-tos --email "$ADMIN_EMAIL" \
-d pay.modstagram.com || echo " WARN: pay SSL failed"
certbot --nginx --non-interactive --agree-tos --email "$ADMIN_EMAIL" \
-d cdn.modstagram.com || echo " WARN: cdn SSL failed"
cp "$SCRIPT_DIR/nginx/cdn.modstagram.com.conf" /etc/nginx/sites-available/cdn.modstagram.com.conf
ln -sf /etc/nginx/sites-available/cdn.modstagram.com.conf /etc/nginx/sites-enabled/cdn.modstagram.com.conf
nginx -t && systemctl reload nginx
cp "$SCRIPT_DIR/nginx/modstagram-redirects.conf" /etc/nginx/sites-available/modstagram-redirects.conf
ln -sf /etc/nginx/sites-available/modstagram-redirects.conf /etc/nginx/sites-enabled/modstagram-redirects.conf
nginx -t && systemctl reload nginx 2>/dev/null || echo " WARN: redirects need SSL first"
(crontab -l 2>/dev/null | grep -v "certbot renew"; echo "0 3 * * * certbot renew --quiet --nginx && systemctl reload nginx") | crontab -
echo ""
echo ">>> [6/6] Restart apps..."
if command -v pm2 >/dev/null 2>&1; then
pm2 restart all || true
fi
echo ""
echo "=========================================="
echo " DONE!"
echo "=========================================="
echo ""
echo " Registrar panel:"
echo " 1) Glue: ns1.modstagram.com -> $SERVER_IP"
echo " 2) Glue: ns2.modstagram.com -> $SERVER_IP"
echo " 3) NS: ns1.modstagram.com, ns2.modstagram.com"
echo " 4) Remove ParsPack CDN"
echo ""
echo " Test:"
echo " dig @127.0.0.1 api.modstagram.com +short"
echo " wget -qO- http://127.0.0.1:3002/api/v1/version"
echo ""