Deployment (Laravel Forge + Hetzner)

                    ┌─────────────────────────────────────────────┐
                    │           Hetzner VPS (Forge)                │
                    │                                             │
  hatched.live ────►│  Nginx (:443)                               │
                    │    ├── /              → Dashboard (:3001)    │
                    │    ├── /api/v1/*      → API (:3000)          │
                    │    └── /docs          → Swagger (:3000)      │
                    │                                             │
                    │  Daemons:                                    │
                    │    ├── API Server     (node dist/main.js)    │
                    │    ├── Worker         (node dist/worker.js)  │
                    │    └── Dashboard      (next start :3001)     │
                    │                                             │
                    │  PostgreSQL 16  (:5432)                      │
                    │  Redis 7        (:6379)                      │
                    └─────────────────────────────────────────────┘

  cdn.hatched.live ──► Cloudflare R2 (Widget JS bundles)

ssh forge@SERVER_IP

# Forge doesn't ship Node by default; install via NVM
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash
source ~/.bashrc
nvm install 20
nvm alias default 20
node -v  # v20.x.x

corepack enable
corepack prepare pnpm@9.15.4 --activate
pnpm -v  # 9.15.4

psql -U hatched -d hatched -h localhost -c "SELECT 1;"

# ─── Node ──────────────────────────────────
NODE_ENV=production

# ─── Database ──────────────────────────────
DB_HOST=127.0.0.1
DB_PORT=5432
DB_NAME=hatched
DB_USER=hatched
DB_PASSWORD=PASSWORD_YOU_SET_IN_FORGE
DATABASE_URL=postgresql://hatched:PASSWORD@127.0.0.1:5432/hatched

# ─── Redis ─────────────────────────────────
REDIS_URL=redis://127.0.0.1:6379
REDIS_HOST=127.0.0.1
REDIS_PORT=6379

# ─── API ───────────────────────────────────
API_PORT=3000
API_PREFIX=/api/v1
CORS_ORIGINS=https://hatched.live,https://www.hatched.live

# ─── Dashboard ─────────────────────────────
DASHBOARD_PORT=3001
NEXT_PUBLIC_API_URL=https://hatched.live/api/v1

# ─── JWT & Auth ────────────────────────────
JWT_SECRET=PUT_A_LONG_64_CHAR_RANDOM_STRING_HERE
JWT_EXPIRES_IN=24h
EMBED_TOKEN_SECRET=ANOTHER_64_CHAR_RANDOM_STRING
INTERNAL_SERVICE_TOKEN=ANOTHER_64_CHAR_RANDOM_STRING
WIDGET_CORS_ORIGINS=https://hatched.live,https://www.flalingo.com

# ─── Image Generation ─────────────────────
FAL_KEY=fal_key_xxxxxxxxxxxx
REPLICATE_API_TOKEN=r8_xxxxxxxxxxxx
IMAGE_PRIMARY_PROVIDER=fal
IMAGE_FALLBACK_PROVIDER=replicate
IMAGE_GENERATE_MODEL=fal-ai/nano-banana-2
IMAGE_EDIT_MODEL=fal-ai/flux-kontext/pro
IMAGE_EVOLVE_MODEL=fal-ai/nano-banana-2

# ─── Storage (Cloudflare R2) ──────────────
R2_ACCOUNT_ID=xxxxxxxxxxxx
R2_ACCESS_KEY_ID=xxxxxxxxxxxx
R2_SECRET_ACCESS_KEY=xxxxxxxxxxxx
R2_BUCKET_NAME=hatched-images
CDN_BASE_URL=https://cdn.hatched.live

# ─── Stripe ────────────────────────────────
STRIPE_SECRET_KEY=sk_live_xxxxxxxxxxxx
STRIPE_WEBHOOK_SECRET=whsec_xxxxxxxxxxxx
STRIPE_GROWTH_PRICE_ID=price_xxxxxxxxxxxx
STRIPE_PRO_PRICE_ID=price_xxxxxxxxxxxx
STRIPE_SUCCESS_URL=https://hatched.live/dashboard/settings?billing=success
STRIPE_CANCEL_URL=https://hatched.live/dashboard/settings?billing=cancelled
STRIPE_RETURN_URL=https://hatched.live/dashboard/settings

cd /home/forge/hatched.live

# ─── Load env ──────────────────────────────
set -a
source .env
set +a

# ─── Fetch source ──────────────────────────
git pull origin $FORGE_SITE_BRANCH

# ─── Install deps ──────────────────────────
export PATH="$HOME/.nvm/versions/node/$(ls $HOME/.nvm/versions/node/ | tail -1)/bin:$PATH"
pnpm install --frozen-lockfile

# ─── Build shared package first (others depend on it) ───
pnpm --filter @hatched/shared build

# ─── Build API ─────────────────────────────
pnpm --filter @hatched/api build

# ─── Build Dashboard ──────────────────────
pnpm --filter @hatched/dashboard build

# ─── Build Widgets ────────────────────────
pnpm --filter @hatched/widgets build

# ─── DB migrations ────────────────────────
cd apps/api
pnpm db:migrate
cd /home/forge/hatched.live

# ─── Restart daemons ──────────────────────
# Forge restarts daemons automatically (see Step 6).
# On the first deploy, daemons may not exist yet, so this is best-effort.

sudo supervisorctl restart hatched-api 2>/dev/null || true
sudo supervisorctl restart hatched-worker 2>/dev/null || true
sudo supervisorctl restart hatched-dashboard 2>/dev/null || true

echo "✓ Deploy finished"

# API wrapper
cat > /home/forge/hatched.live/start-api.sh << 'EOF'
#!/bin/bash
set -a
source /home/forge/hatched.live/.env
set +a
export PATH="$HOME/.nvm/versions/node/$(ls $HOME/.nvm/versions/node/ | tail -1)/bin:$PATH"
cd /home/forge/hatched.live/apps/api
exec node dist/main.js
EOF

# Worker wrapper
cat > /home/forge/hatched.live/start-worker.sh << 'EOF'
#!/bin/bash
set -a
source /home/forge/hatched.live/.env
set +a
export PATH="$HOME/.nvm/versions/node/$(ls $HOME/.nvm/versions/node/ | tail -1)/bin:$PATH"
cd /home/forge/hatched.live/apps/api
exec node dist/worker.js
EOF

# Dashboard wrapper
cat > /home/forge/hatched.live/start-dashboard.sh << 'EOF'
#!/bin/bash
set -a
source /home/forge/hatched.live/.env
set +a
export PATH="$HOME/.nvm/versions/node/$(ls $HOME/.nvm/versions/node/ | tail -1)/bin:$PATH"
cd /home/forge/hatched.live/apps/dashboard
exec node node_modules/.bin/next start --port 3001
EOF

chmod +x /home/forge/hatched.live/start-*.sh

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name hatched.live www.hatched.live;

    # SSL — managed by Forge
    ssl_certificate /etc/nginx/ssl/hatched.live/server.crt;
    ssl_certificate_key /etc/nginx/ssl/hatched.live/server.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # Gzip
    gzip on;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml text/javascript;
    gzip_min_length 1000;

    # ─── API Proxy (:3000) ─────────────────────
    location /api/ {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 120s;
        proxy_send_timeout 120s;

        # Large bodies (image upload)
        client_max_body_size 5m;
    }

    # Swagger docs
    location /docs {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # OpenAPI JSON/YAML
    location ~ ^/openapi\.(json|yaml)$ {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
    }

    # ─── Dashboard Proxy (:3001) ───────────────
    location / {
        proxy_pass http://127.0.0.1:3001;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    # Next.js static assets
    location /_next/static/ {
        proxy_pass http://127.0.0.1:3001;
        expires 365d;
        add_header Cache-Control "public, immutable";
    }
}

# HTTP → HTTPS redirect
server {
    listen 80;
    listen [::]:80;
    server_name hatched.live www.hatched.live;
    return 301 https://$host$request_uri;
}

# On the server
cd /home/forge/hatched.live
export R2_WIDGET_BUCKET=hatched-widgets
pnpm --filter @hatched/widgets deploy:cdn

# Upload widgets to the CDN
export R2_WIDGET_BUCKET=hatched-widgets
cd /home/forge/hatched.live
pnpm --filter @hatched/widgets deploy:cdn 2>/dev/null || echo "⚠ Widget CDN deploy skipped (wrangler login may be required)"

# On the server
npx wrangler login
# OR use an API token:
export CLOUDFLARE_API_TOKEN=xxxxxxxxxxxx

ssh forge@SERVER_IP
cd /home/forge/hatched.live
source .env
cd apps/api
pnpm db:migrate

cd /home/forge/hatched.live/apps/api
pnpm db:seed

# API health check
curl https://hatched.live/api/v1/health

# Swagger
# In a browser: https://hatched.live/docs

# Dashboard
# In a browser: https://hatched.live/login

# Inspect processes
sudo supervisorctl status

hatched-api                RUNNING   pid 12345, uptime 0:05:00
hatched-worker             RUNNING   pid 12346, uptime 0:05:00
hatched-dashboard          RUNNING   pid 12347, uptime 0:05:00

# Supervisor logs (daemon stdout/stderr)
tail -f /home/forge/.forge/daemon-*.log

# Nginx access/error logs
tail -f /var/log/nginx/hatched.live-access.log
tail -f /var/log/nginx/hatched.live-error.log

# PostgreSQL logs
sudo tail -f /var/log/postgresql/postgresql-16-main.log

curl -sf https://hatched.live/api/v1/health > /dev/null || echo "API DOWN" | mail -s "Hatched Alert" admin@hatched.live

# Check logs
sudo supervisorctl tail -f hatched-api stderr

# Try running manually
bash /home/forge/hatched.live/start-api.sh

# Which process is bound to which port
sudo lsof -i :3000
sudo lsof -i :3001

redis-cli ping  # should return PONG

psql -U hatched -d hatched -h 127.0.0.1 -c "SELECT 1;"

cd /home/forge/hatched.live/apps/api
# Run individually
psql -U hatched -d hatched -h 127.0.0.1 -f src/database/migrations/001_initial_schema.sql

ls /home/forge/.nvm/versions/node/
# v20.x.x should be listed

ssh forge@SERVER_IP
cd /home/forge/hatched.live
git log --oneline -5           # find a previous commit
git checkout COMMIT_HASH       # roll back to it
pnpm install --frozen-lockfile
pnpm --filter @hatched/shared build
pnpm --filter @hatched/api build
pnpm --filter @hatched/dashboard build
sudo supervisorctl restart all