feat: use agronom.fastergo.uz domain for staging with nginx + SSL

- Update staging.conf: domain staging-api.fastergo.uz → agronom.fastergo.uz
- Add /uploads/ static file location in nginx (served from uploads volume)
- Restore nginx + certbot SSL block in CD pipeline with new domain
- FileStorage__BaseUrl → https://agronom.fastergo.uz/uploads
- Smoke test hits https://agronom.fastergo.uz instead of raw IP:port
- Mount uploads volume into nginx container for direct static file serving

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

Author: JaloliddinDeveloper

.github/workflows/cd.yml

@@ -101,7 +101,7 @@ jobs:
     needs: build-and-push
     environment:
       name: staging
-      url: http://${{ secrets.STAGING_HOST }}:8080
+      url: https://agronom.fastergo.uz
     if: >-
       github.ref == 'refs/heads/master' ||
       startsWith(github.ref, 'refs/tags/v') ||
@@ -142,6 +142,17 @@ jobs:
           ssh-keyscan -H "${SSH_HOST}" >> ~/.ssh/known_hosts 2>/dev/null
           echo "SSH configured for ${SSH_HOST}"
 
+      - name: Copy nginx config to staging server
+        env:
+          SSH_HOST: ${{ secrets.STAGING_HOST }}
+          SSH_USER: ${{ secrets.STAGING_USER }}
+        run: |
+          ssh -i ~/.ssh/deploy_key "${SSH_USER}@${SSH_HOST}" \
+            mkdir -p /opt/aqlliagronom/staging/nginx
+          scp -i ~/.ssh/deploy_key \
+            nginx/conf.d/staging.conf \
+            "${SSH_USER}@${SSH_HOST}:/opt/aqlliagronom/staging/nginx/app.conf"
+
       - name: Deploy to staging via SSH
         env:
           SSH_HOST: ${{ secrets.STAGING_HOST }}
@@ -289,7 +300,7 @@ jobs:
             -e "Qdrant__Host=\${QDRANT_CONTAINER}" \
             -e "Qdrant__ApiKey=\${QDRANT_KEY}" \
             -e "FileStorage__BasePath=/app/uploads" \
-            -e "FileStorage__BaseUrl=http://\${SSH_HOST}:8080/uploads" \
+            -e "FileStorage__BaseUrl=https://agronom.fastergo.uz/uploads" \
             -v /opt/aqlliagronom/staging/logs:/app/logs \
             -v staging_uploads_data:/app/uploads \
             "\${IMAGE_FULL}"
@@ -311,28 +322,75 @@ jobs:
             sleep 5
           done
 
-          # ── Nginx / SSL — skipped for staging (no domain, accessed via IP:8080) ──
-          echo "==> Staging accessible at http://\$(hostname -I | awk '{print \$1}'):8080"
+          # ── Nginx + Certbot (SSL) ─────────────────────────────────────────────
+          NGINX_DOMAIN="agronom.fastergo.uz"
+          NGINX_CONF_DIR="/opt/aqlliagronom/staging/nginx"
+
+          docker volume create certbot_staging_certs 2>/dev/null || true
+          docker volume create certbot_staging_www   2>/dev/null || true
+
+          # Generate temporary self-signed cert on first deploy so nginx can start
+          if ! docker run --rm -v certbot_staging_certs:/etc/letsencrypt alpine \
+               test -f "/etc/letsencrypt/live/\${NGINX_DOMAIN}/fullchain.pem" 2>/dev/null; then
+            echo "==> Generating temporary self-signed cert for \${NGINX_DOMAIN}..."
+            docker run --rm -v certbot_staging_certs:/etc/letsencrypt alpine sh -c \
+              "apk add --no-cache openssl >/dev/null 2>&1 && \
+               mkdir -p /etc/letsencrypt/live/\${NGINX_DOMAIN} && \
+               openssl req -x509 -nodes -newkey rsa:2048 \
+                 -keyout /etc/letsencrypt/live/\${NGINX_DOMAIN}/privkey.pem \
+                 -out    /etc/letsencrypt/live/\${NGINX_DOMAIN}/fullchain.pem \
+                 -days 1 -subj /CN=\${NGINX_DOMAIN} 2>/dev/null"
+          fi
+
+          if docker ps --format '{{.Names}}' | grep -q '^aqlliagronom-nginx\$'; then
+            echo "==> Reloading nginx config..."
+            docker exec aqlliagronom-nginx nginx -s reload || true
+          else
+            docker stop aqlliagronom-nginx 2>/dev/null || true
+            docker rm   aqlliagronom-nginx 2>/dev/null || true
+            echo "==> Starting nginx..."
+            docker run -d \
+              --name aqlliagronom-nginx \
+              --restart unless-stopped \
+              --network aqlliagronom-network \
+              -p 80:80 -p 443:443 \
+              -v "\${NGINX_CONF_DIR}:/etc/nginx/conf.d:ro" \
+              -v certbot_staging_certs:/etc/letsencrypt:ro \
+              -v certbot_staging_www:/var/www/certbot:ro \
+              -v staging_uploads_data:/app/uploads:ro \
+              nginx:1.28-alpine
+          fi
+
+          if [ -n "\${CERTBOT_EMAIL}" ]; then
+            echo "==> Running certbot for \${NGINX_DOMAIN}..."
+            docker run --rm \
+              -v certbot_staging_certs:/etc/letsencrypt \
+              -v certbot_staging_www:/var/www/certbot \
+              certbot/certbot certonly \
+                --webroot -w /var/www/certbot \
+                -d "\${NGINX_DOMAIN}" \
+                --non-interactive --agree-tos \
+                -m "\${CERTBOT_EMAIL}" \
+                --keep-until-expiring 2>&1 | tail -5 || true
+            docker exec aqlliagronom-nginx nginx -s reload 2>/dev/null || true
+          fi
+          echo "==> https://\${NGINX_DOMAIN} ready"
 
           docker image prune -f || true
           ENDSSH
 
   # ── 3. Smoke Test Staging ─────────────────────────────────────────────────────
-  # Tests against http://<host>:8080 (direct Docker port) — no nginx/TLS needed.
-  # Switch to https://staging-api.aqlliagronom.uz once a reverse proxy is set up.
   smoke-test-staging:
     name: Smoke Test — Staging
     runs-on: ubuntu-latest
     needs: deploy-staging
 
     steps:
       - name: Health check with retries
-        env:
-          STAGING_HOST: ${{ secrets.STAGING_HOST }}
         run: |
-          BASE="http://${STAGING_HOST}:8080"
+          BASE="https://agronom.fastergo.uz"
           for i in $(seq 1 6); do
-            STATUS=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 10 "${BASE}/health/live")
+            STATUS=$(curl -sk -o /dev/null -w "%{http_code}" --connect-timeout 10 "${BASE}/health/live")
             if [ "$STATUS" = "200" ]; then
               echo "Health check passed (HTTP $STATUS)"
               break
@@ -346,11 +404,9 @@ jobs:
           done
 
       - name: API smoke test
-        env:
-          STAGING_HOST: ${{ secrets.STAGING_HOST }}
         run: |
-          BASE="http://${STAGING_HOST}:8080"
-          STATUS=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 10 \
+          BASE="https://agronom.fastergo.uz"
+          STATUS=$(curl -sk -o /dev/null -w "%{http_code}" --connect-timeout 10 \
             -X POST "${BASE}/api/v1/auth/register" \
             -H "Content-Type: application/json" \
             -d '{"fullName":"","phone":"","password":""}')

nginx/conf.d/staging.conf

@@ -1,10 +1,10 @@
-# Staging — staging-api.fastergo.uz
+# Staging — agronom.fastergo.uz
 # Used by the CD pipeline on the staging server.
 # Upstream container name matches the one started by cd.yml: aqlliagronom-staging
 
 server {
     listen 80;
-    server_name staging-api.fastergo.uz;
+    server_name agronom.fastergo.uz;
 
     # Let's Encrypt ACME webroot challenge
     location /.well-known/acme-challenge/ {
@@ -18,10 +18,10 @@ server {
 
 server {
     listen 443 ssl;
-    server_name staging-api.fastergo.uz;
+    server_name agronom.fastergo.uz;
 
-    ssl_certificate     /etc/letsencrypt/live/staging-api.fastergo.uz/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/staging-api.fastergo.uz/privkey.pem;
+    ssl_certificate     /etc/letsencrypt/live/agronom.fastergo.uz/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/agronom.fastergo.uz/privkey.pem;
     ssl_protocols       TLSv1.2 TLSv1.3;
     ssl_ciphers         ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
     ssl_prefer_server_ciphers off;
@@ -39,6 +39,12 @@ server {
     resolver 127.0.0.11 valid=30s;
     set $upstream aqlliagronom-staging;
 
+    location /uploads/ {
+        alias /app/uploads/;
+        expires 30d;
+        add_header Cache-Control "public, immutable";
+    }
+
     location / {
         proxy_pass         http://$upstream:8080;
         proxy_http_version 1.1;