Platform Installation & Deployment Guide

apt update && apt upgrade -y
apt install -y curl wget git unzip software-properties-common

# Remove old Docker versions
apt remove -y docker docker-engine docker.io containerd runc 2>/dev/null

# Add Docker official GPG key and repository
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
chmod a+r /etc/apt/keyrings/docker.asc

echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] \
  https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \
  | tee /etc/apt/sources.list.d/docker.list > /dev/null

# Install Docker Engine + Compose
apt update
apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# Verify installation
docker --version
docker compose version

# Install nvm
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash
source ~/.bashrc

# Install Node.js 20 LTS
nvm install 20
nvm use 20
nvm alias default 20

# Verify
node --version  # v20.x.x
npm --version

apt install -y nginx
systemctl enable nginx
systemctl start nginx

apt install -y certbot python3-certbot-nginx

ufw allow OpenSSH
ufw allow 'Nginx Full'
ufw --force enable
ufw status

mkdir -p /opt/escenario
cd /opt/escenario
git clone https://github.com/YOUR_ORG/escenario-backend.git backend
cd backend

# ============================================
# EscenarioAI Backend Configuration
# ============================================

# --- Database (PostgreSQL) ---
DATABASE_URL=postgresql+asyncpg://escenario:YOUR_DB_PASSWORD@db:5432/escenario_db
DATABASE_URL_SYNC=postgresql://escenario:YOUR_DB_PASSWORD@db:5432/escenario_db

# --- Redis ---
REDIS_URL=redis://redis:6379/0

# --- Authentication ---
SECRET_KEY=GENERATE_A_64_CHAR_RANDOM_STRING_HERE
ALGORITHM=HS256
ACCESS_TOKEN_EXPIRE_MINUTES=1440

# --- Cloud Storage (Cloudflare R2) ---
R2_ENDPOINT_URL=https://YOUR_ACCOUNT_ID.r2.cloudflarestorage.com
R2_ACCESS_KEY_ID=YOUR_R2_ACCESS_KEY
R2_SECRET_ACCESS_KEY=YOUR_R2_SECRET_KEY
R2_BUCKET_NAME=escenario-audio

# --- GPU Processing (Optional) ---
RUNPOD_API_KEY=
RUNPOD_ENDPOINT_ID=
MODAL_WEBHOOK_URL=

# --- AI Services ---
OPENAI_API_KEY=sk-YOUR_OPENAI_API_KEY

# --- CORS (comma-separated origins) ---
ALLOWED_ORIGINS=https://yourdomain.com,https://studio.yourdomain.com,https://editor.yourdomain.com,https://admin.yourdomain.com,http://localhost:5173

# --- Upload Limits ---
MAX_UPLOAD_SIZE_MB=100
MAX_VST_UPLOAD_SIZE_MB=500

# --- VST Host ---
VST_HOST_URL=http://vst-host:9090

cd /opt/escenario/backend

# Build and start all services
docker compose up -d --build

# Monitor build progress
docker compose logs -f

# Verify all services are healthy
docker compose ps

# Test API health endpoint
curl http://localhost:8000/health

# Enter the backend container
docker compose exec backend bash

# Generate password hash
python3 -c "from passlib.context import CryptContext; \
  pwd = CryptContext(schemes=['bcrypt']); \
  print(pwd.hash('YOUR_ADMIN_PASSWORD'))"

# Insert admin user via psql
docker compose exec db psql -U escenario -d escenario_db -c \
  "INSERT INTO users (email, full_name, hashed_password, plan, is_active, is_admin) \
   VALUES ('admin@yourdomain.com', 'Admin', 'PASTE_HASH_HERE', 'PRO', true, true);"

# Clone the frontend repository
cd /opt/escenario
git clone https://github.com/YOUR_ORG/escenario-frontend.git frontend
cd frontend

# Ensure Node 20 is active
source ~/.nvm/nvm.sh && nvm use 20

# Install dependencies
npm install

# Update API proxy in vite.config.js to point to your server
# (only needed for local dev; production uses Nginx proxy)

# Build for production
npm run build

# Deploy build output
mkdir -p /var/www/escenario/frontend
cp -r dist/* /var/www/escenario/frontend/

# Clone and build the editor
cd /opt/escenario
git clone https://github.com/YOUR_ORG/escenario-editor.git editor
cd editor

# Build (if applicable) or copy directly
mkdir -p /var/www/escenario/editor
cp -r ./* /var/www/escenario/editor/

mkdir -p /var/www/escenario/admin
# Deploy the admin panel HTML file
cp /opt/escenario/admin-panel/index.html /var/www/escenario/admin/

mkdir -p /var/www/escenario/landing
# Deploy landing page files
cp /opt/escenario/escenario-landing/* /var/www/escenario/landing/

# /etc/nginx/sites-available/studio-escenario
server {
    listen 80;
    server_name studio.yourdomain.com;

    client_max_body_size 150M;
    root /var/www/escenario/frontend;
    index index.html;

    # API proxy
    location /api/ {
        proxy_pass http://127.0.0.1:8000/api/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 300s;
        proxy_connect_timeout 10s;
    }

    # WebSocket for collaboration
    location /ws/ {
        proxy_pass http://127.0.0.1:8000/ws/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_read_timeout 86400;
    }

    # Static file serving (audio workspace)
    location /static/ {
        proxy_pass http://127.0.0.1:8000/static/;
        proxy_set_header Host $host;
    }

    # Health check passthrough
    location /health {
        proxy_pass http://127.0.0.1:8000/health;
    }

    # SPA fallback
    location / {
        try_files $uri $uri/ /index.html;
    }

    # Compression
    gzip on;
    gzip_types text/plain text/css application/json application/javascript
               text/xml application/xml text/javascript audio/wav audio/mpeg;
    gzip_min_length 1000;
}

# /etc/nginx/sites-available/admin-escenario
server {
    listen 80;
    server_name admin.yourdomain.com;

    root /var/www/escenario/admin;
    index index.html;

    location /api/ {
        proxy_pass http://127.0.0.1:8000/api/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 300s;
    }

    location / {
        try_files $uri $uri/ /index.html;
    }
}

# /etc/nginx/sites-available/editor-escenario
server {
    listen 80;
    server_name editor.yourdomain.com;

    root /var/www/escenario/editor;
    index index.html;

    location / {
        try_files $uri $uri/ /index.html;
    }

    gzip on;
    gzip_types text/plain text/css application/json application/javascript;
}

# /etc/nginx/sites-available/landing-escenario
server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;

    root /var/www/escenario/landing;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

# Enable all sites
ln -sf /etc/nginx/sites-available/studio-escenario /etc/nginx/sites-enabled/
ln -sf /etc/nginx/sites-available/admin-escenario /etc/nginx/sites-enabled/
ln -sf /etc/nginx/sites-available/editor-escenario /etc/nginx/sites-enabled/
ln -sf /etc/nginx/sites-available/landing-escenario /etc/nginx/sites-enabled/

# Remove default site
rm -f /etc/nginx/sites-enabled/default

# Test configuration
nginx -t

# Reload Nginx
systemctl reload nginx

# Issue SSL certificates for all domains
certbot --nginx \
  -d yourdomain.com \
  -d www.yourdomain.com \
  -d studio.yourdomain.com \
  -d editor.yourdomain.com \
  -d admin.yourdomain.com \
  --non-interactive --agree-tos -m admin@yourdomain.com

# Verify auto-renewal
certbot renew --dry-run

R2_ENDPOINT_URL=https://YOUR_ACCOUNT_ID.r2.cloudflarestorage.com
R2_ACCESS_KEY_ID=your_access_key_id
R2_SECRET_ACCESS_KEY=your_secret_access_key
R2_BUCKET_NAME=escenario-audio

RUNPOD_API_KEY=your_runpod_api_key
RUNPOD_ENDPOINT_ID=your_endpoint_id

MODAL_WEBHOOK_URL=https://your-org--escenario-audio.modal.run

services:
  backend:
    volumes:
      - /opt/escenario/backend:/opt/escenario/backend    # Host source code
      - /var/run/docker.sock:/var/run/docker.sock        # Docker API access
      - /usr/bin/docker:/usr/bin/docker                  # Docker binary

cd /opt/escenario/backend
git remote -v  # Should show your GitHub repo

# If using SSH auth, ensure the host has a valid deploy key
# If using HTTPS, configure credential caching:
git config credential.helper store

ufw default deny incoming
ufw default allow outgoing
ufw allow ssh
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable

# All services
docker compose logs -f

# Specific service
docker compose logs -f backend
docker compose logs -f celery-worker
docker compose logs -f vst-host

# Last 100 lines
docker compose logs --tail=100 backend

# Nginx logs
tail -f /var/log/nginx/access.log
tail -f /var/log/nginx/error.log

# Manual backup
docker compose exec db pg_dump -U escenario escenario_db > backup_$(date +%Y%m%d).sql

# Automated daily backup (add to crontab)
0 3 * * * cd /opt/escenario/backend && docker compose exec -T db pg_dump -U escenario escenario_db | gzip > /opt/escenario/backups/db_$(date +\%Y\%m\%d).sql.gz

# Restore from backup
docker compose exec -T db psql -U escenario escenario_db < backup_20260522.sql

# Check workspace volume usage
docker system df

# Prune unused Docker resources
docker system prune -f

# Check audio workspace size
docker compose exec backend du -sh /var/workspace/

# PostgreSQL database size
docker compose exec db psql -U escenario -d escenario_db \
  -c "SELECT pg_size_pretty(pg_database_size('escenario_db'));"

# Restart a single service
docker compose restart backend

# Rebuild and restart (after code changes)
docker compose up -d --build backend celery-worker

# Full stack restart
docker compose down && docker compose up -d

# Reload Nginx (after config changes)
nginx -t && systemctl reload nginx