From 4e59f6e25cdde6b02735d4e4c9a9a07cb96db95a Mon Sep 17 00:00:00 2001 From: "reza.g" Date: Tue, 15 Sep 2026 16:57:28 +0330 Subject: [PATCH] docs(readme): add server section with MinIO tunnel; refresh stale sections MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit New section 'Working with the deployed system (server)': public app and Casdoor panel URLs (aramesh / casdoor .bennu-api-bahrestan.ir) and step-by-step MinIO console access via an SSH tunnel (ssh -L 9001:127.0.0.1:9001 root@171.22.25.75 -> http://localhost:9001), including the aramesh-minio credentials, the procurement-files bucket, why the console is loopback-only (port 9000 is reserved for the deploy-webhook receiver), the secret-handling warning and the tunnel teardown. Also refreshed sections that went stale this session: the login form description no longer mentions the removed optional organization field; the restore section now documents the committed admin-only seed dumps in backups/علی محقق/ (the old restore.ps1/sh scripts and demo dumps were deleted) with the current login and the still-available demo seeders. --- README.md | 102 ++++++++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 88 insertions(+), 14 deletions(-) diff --git a/README.md b/README.md index db1ebf1..dea85e2 100644 --- a/README.md +++ b/README.md @@ -81,7 +81,7 @@ v1.3/ ## 🔐 Login The whole system is behind a login page (`/login`). Login is **in-page**: -the form (username / password / optional organization) is sent to +the form (username / password) is sent to `POST /api/v1/auth/login`; the backend exchanges it with Casdoor (password grant), verifies the returned JWT, and starts the session — no browser redirect to Casdoor. @@ -113,6 +113,71 @@ Casdoor organization, application and users (idempotent). Full details — addresses, credentials, role model, failure scenarios and the checklist — are in [`docs/casdoor-auth.md`](docs/casdoor-auth.md). +> The **currently committed seed** (`backups/علی محقق/`) instead ships a +> single admin — `ali.mohaghegh` («علی محقق») — see +> [Restoring the committed seed data](#restoring-the-committed-seed-data). + +--- + +## 🌐 Working with the deployed system (server) + +The production deployment of this stack runs on the server and is reachable +at these public addresses (HTTPS): + +| What | Address | +|---|---| +| **App (ERP)** | https://aramesh.bennu-api-bahrestan.ir/ | +| **Casdoor admin panel** | https://casdoor.bennu-api-bahrestan.ir/ | + +Log in to the app with your Casdoor account (org `inventory`); the role is +assigned inside the app (`users.role` — see «Login» above and +[`docs/casdoor-auth.md`](docs/casdoor-auth.md)). + +### MinIO console on the server (SSH tunnel) + +The MinIO console is deliberately **loopback-only** on the server +(`127.0.0.1:9001`) — verified unreachable from the internet — so the way in +is an SSH tunnel from your machine: + +1. Open PowerShell and start the tunnel (**keep the window open** while you + use the panel): + + ```powershell + ssh -L 9001:127.0.0.1:9001 root@171.22.25.75 + ``` + + You will also land in a normal SSH session — that is fine; the tunnel + lives as long as the window stays open. + +2. In your browser, open: **http://localhost:9001** + +3. Log in with: + + | Username | Password | + |---|---| + | `aramesh-minio` | `feb10fadb5441019dfc33bf12a9b0f74e7b6c478` | + +You will see the **`procurement-files`** bucket — the invoices/proformas the +ERP stores, browsable and downloadable from there. + +⚠️ These credentials are **full admin access to the file storage**. Treat +them as a production secret (this README is inside the repo, so anyone with +repo access can read them — rotate them on the server if they ever leak). + +Close the PowerShell window (or `Ctrl+C`) when you are done to drop the +tunnel. + +Notes from the server setup: + +- The panel is published only on the server's loopback, so the internet + cannot reach it at all — the tunnel is what carries it to your browser. +- Host port `9000` stays reserved for the deploy-webhook receiver, which is + why the console uses `9001`. +- If you ever need the raw S3 API from your machine, or a clickable URL for + the console (e.g. `storage.aramesh.bennu-api-bahrestan.ir` behind Traefik + with a password prompt on top), that can be arranged on request — the + tunnel remains the safer default. + --- ## Prerequisites (target machine) @@ -197,26 +262,35 @@ docker exec -it procurement-postgres psql -U postgres -d procurement --- -## Restoring the demo data (for the team) +## Restoring the committed seed data -The databases are **not** in git — Docker volumes hold the data. To let -everyone see the same system state, the repo ships exact database dumps in -`backups/`. After a fresh boot: +The databases are **not** in git — Docker volumes hold the data. The repo +ships recovery dumps in `backups/علی محقق/`: + +| File | Contents | +|---|---| +| `casdoor.dump` | Casdoor schema + console admin (`admin` / `123`), org `inventory`, app `inventory-app`, the JWT signing cert, and the single org user `ali.mohaghegh` | +| `procurement.dump` | Procurement schema + the single `users` row «علی محقق» with role `admin`; all other tables empty (categories/units re-seed at API startup) | + +⚠️ This **replaces all data** in the `procurement` and `casdoor` databases. +On a running stack: ```powershell -powershell -ExecutionPolicy Bypass -File .\backups\restore.ps1 # Windows -bash backups/restore.sh # Linux / Git Bash +docker compose stop api casdoor +docker cp "backups/علی محقق/procurement.dump" procurement-postgres:/tmp/ +docker cp "backups/علی محقق/casdoor.dump" procurement-postgres:/tmp/ +docker exec procurement-postgres pg_restore -U postgres -d procurement --clean --if-exists /tmp/procurement.dump +docker exec procurement-postgres pg_restore -U postgres -d casdoor --clean --if-exists /tmp/casdoor.dump +docker compose start casdoor api ``` -This **replaces all data** in the `procurement` and `casdoor` databases with -the committed state — a clean, realistic demo: 3 projects × 2 warehouses, -4 suppliers, 12 materials across all 8 categories, and 4 quotes covering -every lifecycle state (offered / in-transit / partially received / -completed) with matching stock. +Login afterwards: `ali.mohaghegh` / `hulkfuck002` (Casdoor rejects spaces +in usernames, so «ali mohaghegh» is not a valid login name). -Two alternative ways to get a clean state: +Want demo data instead? Two seeders are still available (they create +different users — see the Login table above): -1. **App seeder** (realistic demo data, keeps the Casdoor org as-is): +1. **App seeder** (realistic demo dataset; keeps the Casdoor org as-is): ```powershell docker exec procurement-api sh -c "cd /srv/backend && python -m tools.seed" ```