Yakuniy loyiha — ilovani noldan serverga chiqarish

# root sifatida
apt update && apt upgrade -y
apt install -y curl git ufw fail2ban unattended-upgrades nginx
timedatectl set-timezone Asia/Tashkent

adduser otabek && usermod -aG sudo otabek
adduser --disabled-password --gecos "" deploy

Lokal kompyuterda:

ssh-copy-id otabek@SERVER_IP
ssh-copy-id deploy@SERVER_IP     # yoki kalitni qo'lda deploy ning authorized_keys iga

Serverda (otabek sifatida, yangi terminalda tekshirgandan keyin):

sudo tee /etc/ssh/sshd_config.d/99-xavfsiz.conf > /dev/null << 'EOF'
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
EOF
sudo sshd -t && sudo systemctl restart ssh

sudo ufw default deny incoming
sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw enable

sudo systemctl enable --now fail2ban
sudo dpkg-reconfigure -plow unattended-upgrades

deploy uchun cheklangan sudo (19-dars):

sudo visudo -f /etc/sudoers.d/deploy

deploy ALL=(root) NOPASSWD: /usr/bin/systemctl restart dokon, /usr/bin/systemctl reload nginx

curl -fsSL https://deb.nodesource.com/setup_22.x | sudo bash -
sudo apt install -y nodejs
node -v

sudo useradd --system --no-create-home --shell /usr/sbin/nologin dokon
sudo usermod -aG dokon deploy               # deploy dokon guruhida

sudo mkdir -p /opt/dokon/{releases,shared/uploads}
sudo chown -R deploy:dokon /opt/dokon
sudo chmod -R 750 /opt/dokon
sudo chown dokon:dokon /opt/dokon/shared/uploads
sudo chmod 770 /opt/dokon/shared/uploads

sudo tee /opt/dokon/shared/.env > /dev/null << 'EOF'
PORT=3000
NODE_ENV=production
JWT_SECRET=bu-yerga-uzun-tasodifiy-qator
EOF
sudo chown dokon:dokon /opt/dokon/shared/.env
sudo chmod 600 /opt/dokon/shared/.env

Tasodifiy sir yaratish: openssl rand -hex 32.

.env ni systemd o'zi (root sifatida) o'qiydi va ilovaga uzatadi — shuning uchun 600 yetarli.

[Unit]
Description=Dokon API
After=network.target

[Service]
Type=simple
User=dokon
Group=dokon
WorkingDirectory=/opt/dokon/current
EnvironmentFile=/opt/dokon/shared/.env
ExecStart=/usr/bin/node /opt/dokon/current/server.js
Restart=on-failure
RestartSec=5
MemoryMax=512M

NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/opt/dokon/shared/uploads

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable dokon        # hozircha start emas — kod hali yo'q

Ilova current symlink orqali ishga tushadi — deploy da faqat symlink almashadi, xizmat fayli o'zgarmaydi.

#!/usr/bin/env bash
# deploy.sh — Dokon ni serverga chiqarish
set -euo pipefail

readonly SERVER="deploy@dokon"           # ~/.ssh/config dagi nom
readonly ILOVA="/opt/dokon"
readonly RELIZ="$(date +%F_%H%M%S)"
readonly YOL="$ILOVA/releases/$RELIZ"

log() { echo -e "\033[0;32m[$(date +%T)]\033[0m $*"; }

log "Frontend build..."
(cd frontend && npm ci && npm run build)

log "Yuklanmoqda: $RELIZ"
ssh "$SERVER" "mkdir -p '$YOL/public'"
rsync -az --delete --exclude node_modules --exclude .git --exclude .env \
  api/ "$SERVER:$YOL/"
rsync -az --delete frontend/dist/ "$SERVER:$YOL/public/"

log "Serverda o'rnatilmoqda..."
ssh "$SERVER" bash -s << EOF
set -euo pipefail
cd '$YOL'
npm ci --omit=dev --silent
ln -sfn '$ILOVA/shared/.env' .env
ln -sfn '$ILOVA/shared/uploads' uploads

OLDINGI=\$(readlink -f '$ILOVA/current' || true)
ln -sfn '$YOL' '$ILOVA/current'
sudo /usr/bin/systemctl restart dokon

for i in \$(seq 1 15); do
  if curl -sf localhost:3000/api/health > /dev/null; then
    echo "✓ Ilova ishlayapti"
    ls -1dt '$ILOVA'/releases/* | tail -n +6 | xargs -r rm -rf
    exit 0
  fi
  sleep 1
done

echo "✗ Health check muvaffaqiyatsiz — orqaga qaytarilmoqda"
if [[ -n "\$OLDINGI" ]]; then
  ln -sfn "\$OLDINGI" '$ILOVA/current'
  sudo /usr/bin/systemctl restart dokon
fi
exit 1
EOF

log "Deploy tugadi: https://dokon.uz"

Nozik joylar:

• ssh ... bash -s << EOF — butun skriptni serverda bajarish. $YOL — lokal o'zgaruvchi (heredoc da almashtiriladi); \$OLDINGI — serverdagi o'zgaruvchi (\$ — almashtirilmasin)
• readlink -f current — oldingi reliz yo'li (rollback uchun)
• ls -1dt ... | tail -n +6 — eng yangi 5 tadan keyingilari; xargs -r — bo'sh bo'lsa ishlamaslik
• deploy sudoers da faqat shu buyruqqa ruxsat — shuning uchun to'liq yo'l /usr/bin/systemctl

chmod +x deploy.sh
./deploy.sh

sudo usermod -aG dokon www-data      # Nginx public/ ni o'qiy olsin

/etc/nginx/sites-available/dokon:

server {
    listen 80;
    server_name dokon.uz www.dokon.uz;

    root /opt/dokon/current/public;
    index index.html;

    server_tokens off;
    client_max_body_size 20M;

    gzip on;
    gzip_types text/css application/javascript application/json image/svg+xml;

    location / {
        try_files $uri $uri/ /index.html;
    }

    location /assets/ {
        expires 1y;
        add_header Cache-Control "public, immutable";
    }

    location /api/ {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location ~ /\.(?!well-known) {
        deny all;
    }
}

sudo ln -sfn /etc/nginx/sites-available/dokon /etc/nginx/sites-enabled/dokon
sudo rm -f /etc/nginx/sites-enabled/default
sudo nginx -t && sudo systemctl reload nginx

dig dokon.uz +short                  # server IP siga ko'rsatishi kerak
sudo apt install -y certbot python3-certbot-nginx
sudo certbot --nginx -d dokon.uz -d www.dokon.uz

www-data ni dokon guruhiga qo'shish — 750 ruxsatli papkalarni o'qishi uchun. Qo'shgandan keyin sudo systemctl restart nginx (guruh o'zgarishi jarayon qayta ishga tushganda kuchga kiradi).

41-darsdagi zaxira.sh va tekshir.sh ni /opt/scripts/ ga joylang.

/etc/systemd/system/dokon-zaxira.service:

[Unit]
Description=Dokon zaxira

[Service]
Type=oneshot
ExecStart=/opt/scripts/zaxira.sh /opt/dokon/shared 14

/etc/systemd/system/dokon-zaxira.timer:

[Unit]
Description=Har kecha Dokon zaxirasi

[Timer]
OnCalendar=*-*-* 03:00:00
Persistent=true

[Install]
WantedBy=timers.target

/etc/systemd/system/dokon-tekshir.service:

[Unit]
Description=Dokon sog'liq tekshiruvi

[Service]
Type=oneshot
EnvironmentFile=/etc/dokon-tekshir.env
ExecStart=/opt/scripts/tekshir.sh https://dokon.uz/api/health

/etc/systemd/system/dokon-tekshir.timer:

[Timer]
OnBootSec=2min
OnUnitActiveSec=5min

[Install]
WantedBy=timers.target

sudo chmod 600 /etc/dokon-tekshir.env       # TG_TOKEN, TG_CHAT
sudo systemctl daemon-reload
sudo systemctl enable --now dokon-zaxira.timer dokon-tekshir.timer
systemctl list-timers | grep dokon
sudo systemctl start dokon-zaxira.service && journalctl -u dokon-zaxira -n 5

Lokal kompyuterda (yoki boshqa serverda) — zaxirani tortib olish:

rsync -avz dokon:/var/backups/dokon/ ~/dokon-zaxiralar/

41-darsdagi zaxira.sh da MANZIL va LOG ni server yo'llariga o'zgartiring: MANZIL="/var/backups/dokon", LOG="/var/log/dokon-zaxira.log". /var/backups/dokon ni otabek o'qiy olishi uchun: sudo chown root:otabek /var/backups/dokon && sudo chmod 750 /var/backups/dokon.