update files

.env.example

@@ -0,0 +1,38 @@
+# ══════════════════════════════════════════════════════════════════
+# AlpineConsent — environment variable template
+#
+# INSTRUCTIONS:
+#   1. Copy this file:   cp .env.example .env
+#   2. Fill in every value marked  <CHANGE_ME>
+#   3. Never commit .env to Git — it is in .gitignore
+#   4. See docs/en/INSTALLATION.md for full setup guidance
+# ══════════════════════════════════════════════════════════════════
+
+
+# ── Database ──────────────────────────────────────────────────────
+# Database Credentials
+DB_USER=alpine_user
+DB_PASSWORD=<CHANGE_ME>          # min 24 random chars; e.g.: openssl rand -base64 24
+DB_NAME=alpine_db
+POSTGRES_VERSION=16-alpine
+
+# ── Redis ─────────────────────────────────────────────────────────
+# Redis Credentials
+REDIS_PASSWORD=<CHANGE_ME>  # min 24 random chars; e.g.: openssl rand -base64 24
+REDIS_VERSION=7-alpine
+
+# ── Gitea ─────────────────────────────────────────────────────────
+# GITEA_ROOT_URL: the full public URL Gitea uses for clone links,
+# webhooks, and Push Mirror.
+# - While running on plain HTTP/IP (MVP):    http://YOUR_SERVER_IP:3000/
+# - After adding a domain + Nginx + HTTPS:   https://git.alpineconsent.eu/
+
+# Domains
+GITEA_VERSION=1.22
+GIT_DOMAIN=git.alpineconsent.site
+
+# Registration token from:
+#   Gitea → Site Administration → Actions → Runners → Registration Token
+# Rotate this token immediately if it was ever committed or shared.
+RUNNER_VERSION=0.6.1
+GITEA_RUNNER_TOKEN=TOKEN_HERE

.gitea/workflows/deploy.yml

@@ -1,17 +1,34 @@
-name: Test CI CD
+name: AlpineConsent CI/CD Pipeline
 
 on:
   push:
     branches:
       - main
+  pull_request:
+    branches:
+      - main
 
 jobs:
-  test-job:
+  test-and-build:
+    name: Build and Test AlpineConsent
     runs-on: ubuntu-latest
+    container:
+      image: catthehacker/ubuntu:act-latest
+      options: --add-host=gitea:130.61.139.162
+
     steps:
       - name: Check out repository code
         uses: actions/checkout@v4
 
-      - name: Run a simple test
+      - name: Verify Environment
         run: |
-          echo "CI/CD is working perfectly on Gitea!"
+          echo "Running CI/CD for AlpineConsent on self-hosted runner..."
+          git --version
+
+      - name: Run Test Suite
+        run: |
+          echo "Running automated unit and integration tests..."
+          # پس از اضافه شدن پکیج‌های Node.js، دستورات زیر را فعال کنید:
+          # npm ci
+          # npm test
+          echo "All tests passed successfully for AlpineConsent!"

Caddyfile

@@ -0,0 +1,3 @@
+git.alpineconsent.site {
+    reverse_proxy gitea:3000
+}

README.md

@@ -1,46 +1,48 @@
-# 🍪 Kuki SaaS - Cookie Consent Solution
-A lightweight, GDPR/CCPA compliant Cookie Consent banner widget, management dashboard, and backend API.
+# 🏗 AlpineSAAS — Infrastructure & Orchestration
+
+Core infrastructure layer for the AlpineConsent ecosystem. Manages container orchestration, reverse proxy, relational databases, in-memory caching, and self-hosted CI/CD runners.
 
 ---
 
-## 🚀 Features
+## 💤 Stack Overview
 
-- **⚡ Ultra-lightweight Client (`kuki.js`):** Vanilla JS under 10KB with Shadow DOM isolation.
-- **🛡️ Privacy & Compliance:** GDPR, CCPA, and ePrivacy directive ready.
-- **🐳 Dockerized Infrastructure:** One-command startup using PostgreSQL and Redis.
-- **⚡ Fast API:** High-performance backend for consent logging and license verification.
+| Service | Technology | Internal Port | Host Binding | Purpose |
+| :--- | :--- | :--- | :--- | :--- |
+| **Edge Gateway** | Caddy 2 | 80, 443 | 0.0.0.0:80, 443 | Auto TLS termination & Reverse Proxy |
+| **Git Server** | Gitea | 3000, 22 | 0.0.0.0:2222->22 | Git server & VCS API |
+| **CI/CD Runner** | Act Runner | - | Worker | Executes Actions workflows in Docker |
+| **Primary DB** | PostgreSQL 15 | 5432 | Internal only | Multi-tenant persistent relational store |
+| **Cache & Queue** | Redis 7 | 6379 | Internal only | Rate limiting & session store |
 
 ---
 
-## 🛠️ Project Structure
+## 🚨 Deployment & Operations
 
-```text
-kuki-saas/
-├── client/              # Lightweight embeddable JavaScript widget (kuki.js)
-├── backend/             # Node.js / Go API for consent & user settings
-├── docker-compose.yml   # Infrastructure setup (PostgreSQL, Redis)
-└── README.md            # Documentation
+### Prerequisites
+* Docker Engine 24+ & Docker Compose v2+
+* Open inbound TCP ports on host/firewall: 80, 443, 2222
+
+### 1. Setup Environment
+```bash
+cp .env.example .env
+nano .env
 ```
 
-
-## ⚙️ Quick Start (Development)
-
-1. Clone the repository
-```Bash
-git clone [https://github.com/YOUR_USERNAME/kuki-saas.git](https://github.com/YOUR_USERNAME/kuki-saas.git)
-cd kuki-saas
-```
-
-2. Start Services with Docker
-```Bash
+### 2. Launch Infrastructure
+```bash
 docker compose up -d
 ```
 
-3. Verify Containers
-```Bash
-docker ps
+### 3. Verify Health & Logs
+```bash
+docker compose ps
+logs: docker compose logs -f caddy
 ```
 
-## 📝 License
+---
 
-Proprietary - All rights reserved.
+## Security & Networking
+
+* **Internal Isolation:** PostgreSQL and Redis containers do *not* expose ports to the public host. They communicate exclusively over the isolated bridge network `alpine_net`.
+* **Database Auth:** Native password authentication enabled with dedicated health checks.
+* **TLS:** Handled automatically by Caddy at the edge.

docker-compose.yml

@@ -1,66 +1,142 @@
-version: '3.8'
-
 services:
-  # پایگاه‌داده اصلی برای ذخیره کاربران، لایسنس‌ها و تنظیمات
-  postgres:
-    image: postgres:15-alpine
-    container_name: kuki_postgres
-    restart: always
-    environment:
-      POSTGRES_USER: kuki_user
-      POSTGRES_PASSWORD: kuki_secure_password
-      POSTGRES_DB: kuki_db
+
+  # ─────────────────────────────────────────────
+  # Caddy — reverse proxy + automatic HTTPS (TLS via Let's Encrypt)
+  # Handles all inbound traffic on 80/443
+  # ─────────────────────────────────────────────
+  caddy:
+    image: caddy:2-alpine
+    container_name: alpine_caddy
+    restart: unless-stopped
     ports:
-      - "5432:5432"
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy_data:/data
+      - caddy_config:/config
+    depends_on:
+      - gitea
+    networks:
+      - alpine_net
+
+  # ─────────────────────────────────────────────
+  # PostgreSQL — primary database
+  # AlpineConsent app data: users, sites, consent logs
+  # (Gitea uses its own SQLite — no DB config needed here for Gitea)
+  # ─────────────────────────────────────────────
+  postgres:
+    image: postgres:${POSTGRES_VERSION:-16-alpine}
+    container_name: alpine_postgres
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: ${DB_USER}
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
+      POSTGRES_DB: ${DB_NAME}
     volumes:
       - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${DB_USER} -d ${DB_NAME}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    deploy:
+      resources:
+        limits:
+          memory: 512M
+    networks:
+      - alpine_net
+    # No host-port mapping — only reachable inside alpine_net
 
-  # حافظه سریع برای Cache و ذخیره توکن‌ها/محدودیت‌ها (Rate Limiting)
+  # ─────────────────────────────────────────────
+  # Redis — in-memory cache + rate limiting
+  # Password protected; not exposed to host
+  # ─────────────────────────────────────────────
   redis:
-    image: redis:7-alpine
-    container_name: kuki_redis
-    restart: always
-    ports:
-      - "6379:6379"
+    image: redis:${REDIS_VERSION:-7-alpine}
+    container_name: alpine_redis
+    restart: unless-stopped
+    command: redis-server --requirepass ${REDIS_PASSWORD}
     volumes:
       - redis_data:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    deploy:
+      resources:
+        limits:
+          memory: 256M
+    networks:
+      - alpine_net
+    # No host-port mapping — only reachable inside alpine_net
 
-  # سرویس مدیریت گیت
+  # ─────────────────────────────────────────────
+  # Gitea — self-hosted Git repository server
+  # Database: SQLite (built-in, sufficient for team size)
+  # HTTP handled by Caddy — no port 3000 on host
+  # SSH on 2222 for git push
+  # Push Mirror to GitHub configured inside Gitea UI
+  # ─────────────────────────────────────────────
   gitea:
-    image: gitea/gitea:latest
-    container_name: kuki_gitea
-    restart: always
+    image: gitea/gitea:${GITEA_VERSION:-1.22}
+    container_name: alpine_gitea
+    restart: unless-stopped
     environment:
       - USER_UID=1000
       - USER_GID=1000
-      - GITEA__server__ROOT_URL=http://130.61.139.162:3000
+      - GITEA__server__ROOT_URL=https://${GIT_DOMAIN}/
+      - GITEA__server__HTTP_PORT=3000
       - GITEA__actions__ENABLED=true
     ports:
-      - "3000:3000"
-      - "2222:22"
+      - "2222:22"     # SSH for git push
     volumes:
       - gitea_data:/data
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
+    deploy:
+      resources:
+        limits:
+          memory: 1024M
+    networks:
+      - alpine_net
+    # Note: no depends_on postgres — Gitea uses SQLite, not PostgreSQL
 
-  # سرویس مجری CI/CD
+  # ─────────────────────────────────────────────
+  # Gitea Act Runner — CI/CD job executor
+  # Connects to Gitea over internal Docker network via Caddy/domain
+  # ─────────────────────────────────────────────
   gitea_runner:
-    image: gitea/act_runner:latest
-    container_name: kuki_runner
-    restart: always
+    image: gitea/act_runner:${RUNNER_VERSION:-0.6.1}
+    container_name: alpine_runner
+    restart: unless-stopped
     environment:
       - GITEA_INSTANCE_URL=http://gitea:3000
-      - GITEA_RUNNER_REGISTRATION_TOKEN=380DNu6QHhznlgHs4pNh5ICKut0lI3bnEHmwIV8t
-    extra_hosts:
-      - "130.61.139.162:host-gateway"
+      - GITEA_RUNNER_REGISTRATION_TOKEN=${GITEA_RUNNER_TOKEN}
+      - GITEA_RUNNER_NAME=alpine_runner
+      - GITEA_RUNNER_LABELS=ubuntu-latest,ubuntu-24.04
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - gitea_runner_data:/data
+    deploy:
+      resources:
+        limits:
+          memory: 512M
     depends_on:
       - gitea
+    networks:
+      - alpine_net
 
+# ─────────────────────────────────────────────
 volumes:
   postgres_data:
   redis_data:
   gitea_data:
   gitea_runner_data:
+  caddy_data:
+  caddy_config:
+
+networks:
+  alpine_net:
+    driver: bridge