# Production Deployment Guide - sales.globalerc.pt

## Your Information
- **Public IP Address**: `78.137.202.90`
- **Local IP Address**: `192.168.10.67`
- **Flask Port**: `5000`
- **Domain**: `sales.globalerc.pt`

---

## Step 1: Update DNS Records (CRITICAL)

1. Go to your domain registrar (where you bought globalerc.pt)
2. Find **DNS Management** or **Domain Settings**
3. Update the **A Record** for `sales.globalerc.pt`:
   - **Name/Host**: `sales`
   - **Type**: `A`
   - **Value/Target**: `78.137.202.90` (your public IP)
   - **TTL**: 300 seconds
4. **Remove** or update the old record pointing to `94.46.169.199`
5. Wait 5-15 minutes for DNS propagation

**Test DNS:**
```powershell
nslookup sales.globalerc.pt
# Should show: 78.137.202.90
```

---

## Step 2: Configure Router Port Forwarding

1. Access your router admin panel (usually `192.168.1.1` or `192.168.0.1`)
2. Find **Port Forwarding** settings
3. Create these forwarding rules:

| External Port | Internal IP | Internal Port | Protocol |
|--------------|-------------|---------------|----------|
| 80 | 192.168.10.67 | 80 | TCP |
| 443 | 192.168.10.67 | 443 | TCP |

This makes your PC accessible from the internet.

**Test port forwarding:**
```powershell
# From another network/device
curl http://78.137.202.90
```

---

## Step 3: Install Nginx (Windows)

Nginx will:
- Listen on ports 80 & 443 (public internet)
- Forward traffic to Flask on port 5000
- Handle HTTPS certificates

### Option A: Chocolatey (Recommended)
```powershell
choco install nginx
```

### Option B: Manual Download
1. Download from https://nginx.org/en/download.html
2. Extract to `C:\nginx`
3. Run `nginx.exe` or use the batch file

**Verify installation:**
```powershell
nginx -v
```

---

## Step 4: Create Nginx Configuration

Replace `C:\nginx\conf\nginx.conf` with this:

```nginx
worker_processes 1;

events {
    worker_connections 1024;
}

http {
    include mime.types;
    default_type application/octet-stream;

    sendfile on;
    keepalive_timeout 65;

    # HTTP to HTTPS redirect
    server {
        listen 80;
        server_name sales.globalerc.pt;
        return 301 https://$server_name$request_uri;
    }

    # HTTPS Server
    server {
        listen 443 ssl http2;
        server_name sales.globalerc.pt;

        # SSL Certificate (from Let's Encrypt via Certbot)
        ssl_certificate C:\certbot\live\sales.globalerc.pt\fullchain.pem;
        ssl_certificate_key C:\certbot\live\sales.globalerc.pt\privkey.pem;

        # Security headers
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;

        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

        # Proxy to Flask
        location / {
            proxy_pass http://127.0.0.1:5000;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_redirect off;

            # WebSocket support (if needed)
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
        }
    }
}
```

---

## Step 5: Install SSL Certificate (Let's Encrypt)

### Option A: Using Windows Subsystem for Linux (WSL2)
```bash
# In WSL2 terminal
sudo apt update && sudo apt install certbot python3-certbot-nginx
sudo certbot certonly --standalone -d sales.globalerc.pt
# Copy certificates to C:\certbot\live\sales.globalerc.pt\
```

### Option B: Using Manual Certificate
1. Visit https://zerossl.com
2. Create free certificate for `sales.globalerc.pt`
3. Place in `C:\certbot\live\sales.globalerc.pt\`
   - `fullchain.pem`
   - `privkey.pem`

---

## Step 6: Start Services

```powershell
# 1. Start Flask in PROD mode
.\run_prod.ps1

# 2. Start Nginx (in separate PowerShell window)
cd C:\nginx
.\nginx.exe

# 3. Verify services
Get-NetTCPConnection -LocalPort 5000 | Select-Object LocalAddress, State
Get-NetTCPConnection -LocalPort 443 | Select-Object LocalAddress, State
```

---

## Step 7: Update Google OAuth

1. Go to Google Cloud Console
2. Navigate to **APIs & Services** → **Credentials**
3. Edit your OAuth 2.0 credentials
4. Add authorized redirect URIs:
   - `https://sales.globalerc.pt/oauth2callback`
   - `http://localhost:5000/oauth2callback` (keep for dev)

---

## Step 8: Test Everything

```powershell
# Test DNS
nslookup sales.globalerc.pt

# Test HTTP → HTTPS redirect
curl -iL http://sales.globalerc.pt

# Test HTTPS
curl -v https://sales.globalerc.pt

# Test from browser
# https://sales.globalerc.pt/dashboard
```

---

## Troubleshooting

### "Connection refused"
- Check firewall: `netsh advfirewall show allprofiles`
- Verify port forwarding in router
- Restart Nginx: `nginx -s stop` then `.\nginx.exe`

### DNS not resolving
- Wait 15+ minutes for propagation
- Flush DNS cache: `ipconfig /flushdns`
- Use Google DNS: `nslookup sales.globalerc.pt 8.8.8.8`

### SSL Certificate issues
- Check certificate path in nginx.conf
- Verify certificate is valid: `openssl x509 -in fullchain.pem -text -noout`

### Flask not responding
- Check `.\run_prod.ps1` is running
- Verify port 5000: `Get-NetTCPConnection -LocalPort 5000`

---

## Monitoring

Create a keep-alive script to restart services if they crash:

```powershell
# save as keep-services-alive.ps1
while ($true) {
    if (-not (Get-Process python -ErrorAction SilentlyContinue)) {
        Write-Host "Flask crashed, restarting..."
        .\run_prod.ps1
    }
    if (-not (Get-Process nginx -ErrorAction SilentlyContinue)) {
        Write-Host "Nginx crashed, restarting..."
        cd C:\nginx
        .\nginx.exe
    }
    Start-Sleep -Seconds 30
}
```

Run it: `.\keep-services-alive.ps1`

---

## Security Checklist

- [x] HTTPS enabled with SSL certificate
- [x] HTTP redirects to HTTPS
- [x] Flask running in production mode
- [x] Router port forwarding configured
- [x] DNS updated to public IP
- [x] Google OAuth redirect URIs updated
- [x] Firewall allows ports 80, 443
- [x] Strong SSL ciphers configured

---

## Next Steps

1. Complete Steps 1-4 (DNS, Router, Nginx, Config)
2. Get SSL certificate (Step 5)
3. Start services (Step 6)
4. Update OAuth (Step 7)
5. Test from browser (Step 8)

**Questions?** Check the troubleshooting section or the logs in `C:\nginx\logs\`