add deploy

deploy/README.md

@@ -0,0 +1,31 @@
+# Deploy — spaceshell.ru
+
+Front nginx (`proxy`) → landing container, plus `/download/spacesh.dmg`.
+
+## Layout on the server (`$SSH_REMOTE_DIR`, e.g. `/opt/spacesh`)
+
+```
+docker-compose.yaml   # synced by CI
+proxy.conf            # synced by CI
+download/spacesh.dmg  # uploaded locally via `make deploy-dmg`
+```
+
+## One-time server setup
+
+```bash
+# The landing image lives in a private registry — log the server in once:
+docker login git.realmanual.ru
+mkdir -p $SSH_REMOTE_DIR/download
+```
+
+## What runs where
+
+- **Landing image + compose deploy** → automatic in `.gitea/workflows/build.yaml`
+  on push to `landing/**`. CI builds/pushes the image, scps `deploy/*` to the
+  server, then `docker compose pull && up -d`.
+- **DMG** → built on macOS, uploaded by hand: `make deploy-dmg`
+  (sets the stable `download/spacesh.dmg`). Tauri can't build a macOS bundle in CI.
+
+## Gitea secrets required
+
+`SSH_HOST`, `SSH_USER`, `SSH_REMOTE_DIR`, `SSH_KEY` (private key, key-based auth).

deploy/docker-compose.yaml

@@ -0,0 +1,32 @@
+# spacesh prod — front nginx proxies to the landing container and serves the DMG.
+# Deployed by .gitea/workflows/build.yaml (image + this file); the DMG is uploaded
+# separately via `make deploy-dmg` (Tauri can't cross-compile a macOS bundle in CI).
+services:
+  landing:
+    # LANDING_IMAGE is written to .env by the CI deploy job (exact registry path + tag).
+    image: ${LANDING_IMAGE:-git.realmanual.ru/spacesh/spacesh-landing:latest}
+    restart: unless-stopped
+    expose:
+      - "80"
+
+  proxy:
+    image: nginx:1.27-alpine
+    restart: unless-stopped
+    depends_on:
+      - landing
+    ports:
+      - "80:80"
+    volumes:
+      - ./proxy.conf:/etc/nginx/conf.d/default.conf:ro
+      - ./download:/srv/download:ro
+    networks:
+      spaceshell-network:
+      webproxy:
+        ipv4_address: 172.18.0.28
+  
+networks:
+  spaceshell-network:
+    driver: bridge
+  webproxy:
+    name: webproxy
+    external: true

deploy/proxy.conf

@@ -0,0 +1,30 @@
+# Front nginx for spaceshell.ru — reverse-proxies the landing container and
+# serves macOS .dmg downloads from the host-mounted ./download volume.
+upstream landing_upstream {
+    server landing:80;
+}
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name spaceshell.ru www.spaceshell.ru;
+
+    # Stable download URL: /download/spacesh.dmg → ./download/spacesh.dmg on host.
+    location /download/ {
+        alias /srv/download/;
+        autoindex off;
+        default_type application/octet-stream;
+        add_header Content-Disposition "attachment";
+        types {
+            application/x-apple-diskimage dmg;
+        }
+    }
+
+    location / {
+        proxy_pass http://landing_upstream;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}