$ git add requirements.txt app/database.py
$ git commit -m "Production: disable SQL echo, add gunicorn"
$ git push origin main

# Update package list and install required tools
root@server:~# apt update && apt upgrade -y
root@server:~# apt install -y python3 python3-pip python3-venv git nginx certbot python3-certbot-nginx

# Verify Python version — needs 3.10+ for SQLAlchemy 2.0 annotated types
root@server:~# python3 --version
Python 3.11.2

# Create a system user with no login shell for running the app
# This limits the blast radius if the app is ever compromised
root@server:~# useradd --system --no-create-home --shell /usr/sbin/nologin osztromok

# Create the app directory and give the app user ownership
root@server:~# mkdir -p /var/www/osztromok
root@server:~# chown osztromok:osztromok /var/www/osztromok

root@server:~# cd /var/www/osztromok

# Clone from git (use your real repo URL)
root@server:/var/www/osztromok# git clone https://github.com/yourname/osztromok.git .

# Create a virtualenv for the app
root@server:/var/www/osztromok# python3 -m venv venv

# Install all dependencies
root@server:/var/www/osztromok# venv/bin/pip install -r requirements.txt

# Move the existing kanji resource files into the app's resources/ folder
# (they were previously at /var/www/html/japan/ or similar on the old site)
root@server:/var/www/osztromok# mkdir -p resources/japanese/kanji
root@server:/var/www/osztromok# cp /var/www/html/resources/japanese/kanji/*.html resources/japanese/kanji/

# Fix ownership — the app user needs to read all files
root@server:/var/www/osztromok# chown -R osztromok:osztromok /var/www/osztromok

root@server:/var/www/osztromok# nano .env

# Only the app user and root should read the .env
root@server:/var/www/osztromok# chmod 640 .env
root@server:/var/www/osztromok# chown osztromok:osztromok .env

root@server:/var/www/osztromok# sudo -u osztromok venv/bin/gunicorn \
    --workers 4 \
    --worker-class uvicorn.workers.UvicornWorker \
    --bind 127.0.0.1:8000 \
    --chdir /var/www/osztromok \
    app.main:app

# Expected output (truncated):
# [INFO] Starting gunicorn 21.x.x
# [INFO] Listening at: http://127.0.0.1:8000
# [INFO] Using worker: uvicorn.workers.UvicornWorker
# [INFO] Booting worker with pid: 12345
# [INFO] Booting worker with pid: 12346
# ... (4 workers total)

# In a second terminal on the server — verify it responds
root@server:~# curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:8000/
200

# Ctrl+C to stop the manual test

root@server:~# nano /etc/systemd/system/osztromok.service

# Create log directory
root@server:~# mkdir -p /var/log/osztromok
root@server:~# chown osztromok:osztromok /var/log/osztromok

# Reload systemd, enable the service (starts on boot), start it now
root@server:~# systemctl daemon-reload
root@server:~# systemctl enable osztromok
root@server:~# systemctl start osztromok

# Check it started cleanly
root@server:~# systemctl status osztromok
# ● osztromok.service — Osztromok.com FastAPI application
#      Active: active (running) since ...
#    Main PID: 14321 (gunicorn)

# Confirm the socket file was created
root@server:~# ls -la /run/osztromok.sock
# srw-rw---- 1 osztromok osztromok 0 ... /run/osztromok.sock

root@server:~# nano /etc/nginx/sites-available/osztromok.com

# Enable the site (creates a symlink in sites-enabled/)
root@server:~# ln -s /etc/nginx/sites-available/osztromok.com /etc/nginx/sites-enabled/
root@server:~# rm -f /etc/nginx/sites-enabled/default   # remove the default placeholder

# Test the config before reloading
root@server:~# nginx -t
# nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
# nginx: configuration file /etc/nginx/nginx.conf test is successful

root@server:~# systemctl reload nginx

root@server:~# certbot --nginx -d osztromok.com -d www.osztromok.com

# Certbot will ask for:
#   Email address (for renewal reminders)
#   Agree to TOS: Y
#   Share email with EFF: optional
#
# It then automatically:
#   1. Obtains certificate
#   2. Edits /etc/nginx/sites-available/osztromok.com to add ssl_certificate lines
#   3. Reloads nginx
#
# Final output:
# Congratulations! Your certificate and chain have been saved at:
#   /etc/letsencrypt/live/osztromok.com/fullchain.pem

# Test auto-renewal (dry run — no actual renewal)
root@server:~# certbot renew --dry-run

# Check Apache is running (to confirm it's the current server)
root@server:~# systemctl status apache2

# Stop Apache and disable it from starting on boot
root@server:~# systemctl stop apache2
root@server:~# systemctl disable apache2

# Start nginx (if not already running after certbot)
root@server:~# systemctl start nginx
root@server:~# systemctl enable nginx

# Immediately verify the live site responds
root@server:~# curl -s -o /dev/null -w "%{http_code}\n" https://osztromok.com/
200

# Check that HTTP redirects to HTTPS
root@server:~# curl -s -o /dev/null -w "%{http_code}\n" http://osztromok.com/
301

root@server:~# chmod +x /var/www/osztromok/deploy.sh

# Future deploys are one command (run as root or with sudo):
root@server:~# /var/www/osztromok/deploy.sh

# Gunicorn service logs (Python exceptions land here)
root@server:~# journalctl -u osztromok -f          # live tail
root@server:~# journalctl -u osztromok --since "1 hour ago"

# Gunicorn access log (all HTTP requests to the app)
root@server:~# tail -f /var/log/osztromok/access.log

# Gunicorn error log (Python tracebacks)
root@server:~# tail -f /var/log/osztromok/error.log

# nginx access log (all requests including static files)
root@server:~# tail -f /var/log/nginx/access.log

# nginx error log (connection refused, bad gateway etc.)
root@server:~# tail -f /var/log/nginx/error.log

# Check service status at a glance
root@server:~# systemctl status osztromok nginx