# /deploy — Falah OS Deployment Command

Deploy Falah OS CE to the production Docker host at 192.168.0.17 via SSH.

## Context

- **Docker host:** 192.168.0.17 (LAN only, not reachable from internet)
- **Portainer UI:** http://192.168.0.17:9000 (credentials: Admin / bizgEh-xirgyh-3mowta)
- **Repo:** https://github.com/falah-consultancy-limited/falah-os-master (branch: main)
- **Deploy method:** SSH into host → clone repo → docker compose up --build
- **Deploy script:** `scripts/deploy-ssh.sh` (already committed to main)

## Pre-generated secrets (already embedded in deploy-ssh.sh)

```
JWT_SECRET=iLlAXxewIvlPlqv0pj7ITk0dFV0FNi0gVDE5sliX8AwjjxQC
ENCRYPTION_KEY=usYw2LCmKmOpWFuhiAw7X0DVCqRlK9h8oF4bJ4mWqPYiZKdM
ADMIN_SECRET=dd8GU158UJaL4krWWlxWq4uey1AhzmSzNolT10e4lXtC3rBT
POSTGRES_PASSWORD=vjeDTUdeBpMms3rZINwY4zlDVlDnz6vE
REDIS_PASSWORD=BrQkdok11Zfdyu1cCRSGSZYwRk33o20s
```

## What to do

1. Ensure you are on a machine on the same LAN as 192.168.0.17.
2. Make sure your SSH key is accepted by the host (try `ssh root@192.168.0.17 echo ok`).
3. Ensure this repo is up to date: `git pull origin main`
4. Run the deployment:
   ```bash
   bash scripts/deploy-ssh.sh root@192.168.0.17
   ```
   If the SSH user is not root, pass it as an argument:
   ```bash
   bash scripts/deploy-ssh.sh ubuntu@192.168.0.17
   ```
5. After deployment, verify all 7 services are healthy:
   | Service | URL |
   |---------|-----|
   | Desktop UI | http://192.168.0.17:3005 |
   | API Gateway | http://192.168.0.17:3000/health |
   | Ummah ID | http://192.168.0.17:3001/health |
   | Wallet | http://192.168.0.17:3002/health |
   | RAMZ | http://192.168.0.17:3003/health |
   | Mock-Net | http://192.168.0.17:3004/health |
   | falahd | http://192.168.0.17:3006/health |

## Troubleshooting

- **SSH key refused:** Add your public key to `~/.ssh/authorized_keys` on the host, or use password auth (`ssh -o PasswordAuthentication=yes`).
- **git clone fails on host:** The host has no internet. Use `docker context create remote --docker "host=ssh://root@192.168.0.17"` on your local machine and run `docker compose up --build` locally pointing at the remote daemon.
- **Port 3005 not responding:** Likely the React app container failed to build. Check logs: `ssh root@192.168.0.17 "cd /opt/falah-os && docker compose logs app --tail=50"`.
- **Port 3006 not responding:** falahd TypeScript build failed. Check: `ssh root@192.168.0.17 "cd /opt/falah-os && docker compose logs falahd --tail=50"`.
- **api-gateway not healthy:** It depends on all 6 upstream services being healthy. Fix the failing upstream first.

## Services architecture

```
:3000  api-gateway (nginx) — routes all /ummahid /wallet /ramz /mocknet /falahd traffic
:3001  ummahid  — identity, ZK proof, JWT auth
:3002  wallet   — FLH token, transfers, 1.5% fee
:3003  ramz     — Shariah contracts (6 templates, 7 rules)
:3004  mocknet  — sandbox / chaos testnet
:3005  app      — React 18 desktop UI (Vite build)
:3006  falahd   — tRPC daemon: system metrics, app lifecycle
:5432  postgres — reserved for v1.4 persistence
:6379  redis    — reserved for v1.4 persistence
```

## Admin access

All `/api/admin/*` routes require header: `x-admin-secret: dd8GU158UJaL4krWWlxWq4uey1AhzmSzNolT10e4lXtC3rBT`

```bash
# Example: list all wallets
curl http://192.168.0.17:3002/api/admin/wallets \
  -H "x-admin-secret: dd8GU158UJaL4krWWlxWq4uey1AhzmSzNolT10e4lXtC3rBT"

# Example: system metrics via falahd tRPC
curl http://192.168.0.17:3006/trpc/system.metrics
```