diff --git a/docs/OPS_MONITORING.md b/docs/OPS_MONITORING.md
index 8bd25ec..e4a0a68 100644
--- a/docs/OPS_MONITORING.md
+++ b/docs/OPS_MONITORING.md
@@ -107,19 +107,27 @@ Watchdog esterno se Rails è completamente giù:
## Workflow rilascio
-1. `cd backend && bundle exec rspec`
+1. `cd backend && bundle exec rspec` (o equivalente in Docker dev)
2. Ciclo patch/test fino a 0 failure
3. `git commit` → `git push`
-4. `bash scripts/deploy/sync_to_server.sh`
-5. Rebuild: `docker compose -f docker-compose.prod.yml up -d --build rails sidekiq`
-6. Migrate: `docker compose exec -T rails bundle exec rails db:migrate`
-7. Cron: `bash scripts/install_production_cron.sh`
-8. (Opzionale) `bash scripts/cleanup_obsolete_volumes.sh` — rimuove volumi Docker migrati
-9. Smoke test:
+4. **`bash scripts/deploy/release_production.sh`** (sync + deploy con pagina di cortesia)
+ - In alternativa manuale: sync → sul server `bash scripts/deploy/release_production.sh --local`
+5. Smoke test:
- `curl -sf https://www.matchlivetv.it/up`
- `bundle exec rails ops:health_check` (nel container)
- Apri `/admin/ops`
+### Downtime durante il rilascio
+
+| Componente | Comportamento |
+|------------|---------------|
+| `edge` (nginx :3000) | Resta sempre su — NPM non vede mai connection refused |
+| Rails in restart | Pagina di cortesia HTML (auto-refresh 15s), non 502 NPM |
+| RTMP :1935 / replay | Non toccati dal rilascio web |
+| `/up` | Pass-through diretto (monitoraggio ops vede il breve gap) |
+
+Config edge: [`infra/nginx-edge/`](../infra/nginx-edge/). Script: [`scripts/deploy/release_production.sh`](../scripts/deploy/release_production.sh).
+
## Sentry (opzionale)
Imposta `SENTRY_DSN` dopo `bundle install`. Gli errori creano anche incidenti ops.
diff --git a/docs/infrastructure/SERVER_DEPLOYMENT.md b/docs/infrastructure/SERVER_DEPLOYMENT.md
index 729aa16..913d426 100644
--- a/docs/infrastructure/SERVER_DEPLOYMENT.md
+++ b/docs/infrastructure/SERVER_DEPLOYMENT.md
@@ -63,6 +63,10 @@ Il flusso video **non passa da Rails**: telefono → RTMP :1935 → MediaMTX →
## Nginx Proxy Manager (HTTPS)
1. **Proxy Host** → Forward Hostname: `http://192.168.1.146:3000` (dominio principale `www.matchlivetv.it`, redirect apex `matchlivetv.it` → `www`)
+
+ La porta **3000** è servita dal container **`edge`** (nginx locale), non da Rails direttamente.
+ Durante i rilasci Rails viene mostrata una **pagina di cortesia** invece del 502 bianco di NPM.
+
2. **Websockets:** ON (obbligatorio per `/cable`)
3. **Custom location HLS** (spettatori):
- Location: `/hls`
@@ -154,17 +158,10 @@ curl -X POST http://192.168.1.146:3000/api/v1/auth/login \
Dalla macchina di sviluppo:
```bash
-# Tar + scp (rsync non installato sul server)
-tar -C /path/to/MatchLiveTV/src -czf /tmp/matchlivetv-deploy.tar.gz \
- --exclude='./native/android/build' --exclude='./backend/log' --exclude='./.git' .
-scp /tmp/matchlivetv-deploy.tar.gz eminux@192.168.1.146:~/
-ssh eminux@192.168.1.146 'tar -xzf ~/matchlivetv-deploy.tar.gz -C ~/matchlivetv'
-
-# Sul server
-cd ~/matchlivetv/infra && docker compose -f docker-compose.prod.yml up -d --build
+bash scripts/deploy/release_production.sh
```
-Script: [`scripts/deploy/sync_to_server.sh`](../../scripts/deploy/sync_to_server.sh) (richiede rsync sul server).
+Oppure sync manuale: [`scripts/deploy/sync_to_server.sh`](../../scripts/deploy/sync_to_server.sh), poi sul server `bash scripts/deploy/release_production.sh --local`.
---
diff --git a/infra/docker-compose.prod.yml b/infra/docker-compose.prod.yml
index f2940de..a4c29de 100644
--- a/infra/docker-compose.prod.yml
+++ b/infra/docker-compose.prod.yml
@@ -52,9 +52,7 @@ services:
context: ../backend
dockerfile: Dockerfile
restart: unless-stopped
- command: >
- bash -c "bundle exec rails db:prepare &&
- bundle exec rails server -b 0.0.0.0 -p 3000 -e production"
+ command: bundle exec rails server -b 0.0.0.0 -p 3000 -e production
environment:
RAILS_ENV: production
DATABASE_URL: postgresql://postgres:${POSTGRES_PASSWORD}@postgres:5432/matchlivetv
@@ -117,8 +115,6 @@ services:
OPS_SIDEKIQ_STALE_SECS: ${OPS_SIDEKIQ_STALE_SECS:-300}
OPS_LOG_SUBSCRIBER: ${OPS_LOG_SUBSCRIBER:-false}
SENTRY_DSN: ${SENTRY_DSN:-}
- ports:
- - "3000:3000" # Solo LAN — NPM proxy HTTPS
depends_on:
postgres:
condition: service_healthy
@@ -139,6 +135,20 @@ services:
retries: 10
start_period: 90s
+ edge:
+ image: nginx:alpine
+ restart: unless-stopped
+ ports:
+ - "3000:80" # Solo LAN — NPM proxy HTTPS (pagina cortesia se Rails è in restart)
+ volumes:
+ - ./nginx-edge/nginx.conf:/etc/nginx/nginx.conf:ro
+ - ./nginx-edge/maintenance.html:/usr/share/nginx/maintenance/index.html:ro
+ healthcheck:
+ test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:80/edge-health"]
+ interval: 15s
+ timeout: 5s
+ retries: 3
+
sidekiq:
build:
context: ../backend
diff --git a/infra/nginx-edge/maintenance.html b/infra/nginx-edge/maintenance.html
new file mode 100644
index 0000000..1756502
--- /dev/null
+++ b/infra/nginx-edge/maintenance.html
@@ -0,0 +1,102 @@
+
+
+
+
+
+
+
+ Aggiornamento in corso — Match Live TV
+
+
+
+
+ Manutenzione rapida
+ Stiamo aggiornando la piattaforma
+
+ Il servizio torna online tra pochi secondi. Le dirette RTMP e i replay già pubblicati
+ non sono interessati da questo aggiornamento.
+
+
+ Questa pagina si aggiorna automaticamente.
+ Match Live TV
+
+
+
diff --git a/infra/nginx-edge/nginx.conf b/infra/nginx-edge/nginx.conf
new file mode 100644
index 0000000..a37407f
--- /dev/null
+++ b/infra/nginx-edge/nginx.conf
@@ -0,0 +1,85 @@
+events {
+ worker_connections 1024;
+}
+
+http {
+ include /etc/nginx/mime.types;
+ default_type application/octet-stream;
+
+ # DNS Docker: risolve di nuovo l'IP di rails dopo ogni recreate container.
+ resolver 127.0.0.11 valid=5s ipv6=off;
+
+ map $http_upgrade $connection_upgrade {
+ default upgrade;
+ '' close;
+ }
+
+ server {
+ listen 80;
+ server_name _;
+
+ client_max_body_size 20M;
+
+ set $rails_backend rails:3000;
+
+ location = /edge-health {
+ access_log off;
+ add_header Content-Type text/plain;
+ return 200 "ok\n";
+ }
+
+ # Health check ops: pass-through senza pagina di cortesia.
+ location = /up {
+ proxy_pass http://$rails_backend;
+ proxy_connect_timeout 2s;
+ proxy_read_timeout 10s;
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header X-Forwarded-Proto $scheme;
+ }
+
+ location = /up/deep {
+ proxy_pass http://$rails_backend;
+ proxy_connect_timeout 2s;
+ proxy_read_timeout 30s;
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header X-Forwarded-Proto $scheme;
+ }
+
+ location /cable {
+ proxy_pass http://$rails_backend;
+ proxy_http_version 1.1;
+ proxy_set_header Upgrade $http_upgrade;
+ proxy_set_header Connection $connection_upgrade;
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header X-Forwarded-Proto $scheme;
+ proxy_read_timeout 86400;
+ proxy_connect_timeout 2s;
+ error_page 502 503 504 = @maintenance;
+ }
+
+ location / {
+ proxy_pass http://$rails_backend;
+ proxy_connect_timeout 2s;
+ proxy_read_timeout 120s;
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header X-Forwarded-Proto $scheme;
+ error_page 502 503 504 = @maintenance;
+ }
+
+ location @maintenance {
+ internal;
+ root /usr/share/nginx/maintenance;
+ try_files /index.html =503;
+ add_header Retry-After 15 always;
+ add_header Cache-Control "no-store" always;
+ }
+ }
+}
diff --git a/scripts/deploy/release_production.sh b/scripts/deploy/release_production.sh
new file mode 100755
index 0000000..718636f
--- /dev/null
+++ b/scripts/deploy/release_production.sh
@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+# Rilascio produzione con downtime minimo e pagina di cortesia durante il restart Rails.
+#
+# Uso dalla macchina di sviluppo (sync + deploy remoto):
+# bash scripts/deploy/release_production.sh
+#
+# Solo sul server (dopo sync manuale):
+# bash scripts/deploy/release_production.sh --local
+#
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+SERVER="${DEPLOY_SERVER:-eminux@192.168.1.146}"
+REMOTE_INFRA="${DEPLOY_PATH:-/opt/matchlivetv}/infra"
+LOCAL_INFRA="${ROOT}/infra"
+COMPOSE_FILE="${COMPOSE_FILE:-docker-compose.prod.yml}"
+WAIT_SECS="${RELEASE_WAIT_SECS:-180}"
+LOCAL_ONLY=false
+
+for arg in "$@"; do
+ case "$arg" in
+ --local) LOCAL_ONLY=true ;;
+ esac
+done
+
+if [ "$LOCAL_ONLY" = false ]; then
+ bash "${ROOT}/scripts/deploy/sync_to_server.sh"
+ ssh "$SERVER" "bash ${REMOTE_INFRA%/infra}/scripts/deploy/release_production.sh --local"
+ exit 0
+fi
+
+INFRA="${MATCHLIVETV_INFRA:-$LOCAL_INFRA}"
+if [ -d "/opt/matchlivetv/infra" ]; then
+ INFRA="/opt/matchlivetv/infra"
+fi
+
+ENV_FILE="${ENV_FILE:-${INFRA}/.env}"
+
+compose() {
+ docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" "$@"
+}
+
+wait_for_rails() {
+ local i=0
+ local max=$((WAIT_SECS / 2))
+ echo "Attendo Rails (max ${WAIT_SECS}s)..."
+ while [ "$i" -lt "$max" ]; do
+ if compose exec -T rails curl -sf http://127.0.0.1:3000/up >/dev/null 2>&1; then
+ echo "Rails pronto."
+ return 0
+ fi
+ sleep 2
+ i=$((i + 1))
+ done
+ echo "ERRORE: Rails non healthy entro ${WAIT_SECS}s"
+ compose ps
+ return 1
+}
+
+cd "$INFRA"
+
+echo "==> Build immagini (senza fermare i servizi)"
+compose build rails sidekiq
+
+echo "==> Migrazioni DB"
+if compose ps --status running rails 2>/dev/null | grep -q rails; then
+ compose exec -T rails bundle exec rails db:migrate
+else
+ compose run --rm --no-deps rails bundle exec rails db:prepare
+fi
+
+echo "==> Proxy edge (pagina di cortesia su :3000)"
+compose up -d edge
+
+echo "==> Deploy Rails"
+compose up -d --no-deps --build rails
+wait_for_rails
+
+echo "==> Deploy Sidekiq"
+compose up -d --no-deps --build sidekiq
+
+echo "==> Cron"
+bash scripts/install_production_cron.sh
+
+if command -v curl >/dev/null 2>&1; then
+ if curl -sf http://127.0.0.1:3000/up >/dev/null 2>&1; then
+ echo "Smoke test /up via edge: OK"
+ else
+ echo "ATTENZIONE: /up non risponde via edge"
+ fi
+fi
+
+echo "Rilascio completato."