feat: integrate invitation access, world NPCs, and deployment

deploy/nginx/whaletown-admin-v2.conf.example

@@ -2,20 +2,5 @@ server {
     listen 80;
     server_name whaletownadmin.xinghangee.icu;
 
-    root /var/www/whale-town-end-v2/client/dist;
-    index index.html;
-
-    location / {
-        try_files $uri $uri/ /index.html;
-    }
-
-    location = /index.html {
-        add_header Cache-Control "no-cache";
-    }
-
-    location ~* \.(?:js|css|png|jpg|jpeg|gif|svg|ico|woff2?)$ {
-        expires 7d;
-        add_header Cache-Control "public, max-age=604800, immutable";
-        try_files $uri =404;
-    }
+    return 301 https://whaletown.novamailio.com/admin$request_uri;
 }

deploy/nginx/whaletownend-v2.conf.example

@@ -1,8 +1,30 @@
 server {
     listen 80;
-    server_name whaletownend.xinghangee.icu;
+    server_name whaletown.novamailio.com;
 
     client_max_body_size 24m;
+    root /var/www/whale-town-end-v2/client/dist;
+
+    location = /admin {
+        return 301 /admin/;
+    }
+
+    location ^~ /admin/assets/ {
+        rewrite ^/admin/(.*)$ /$1 break;
+        try_files $uri =404;
+        expires 7d;
+        add_header Cache-Control "public, max-age=604800, immutable";
+    }
+
+    location /admin/ {
+        rewrite ^/admin/(.*)$ /$1 break;
+        try_files $uri $uri/ /index.html;
+    }
+
+    location = /index.html {
+        internal;
+        add_header Cache-Control "no-cache";
+    }
 
     location /game {
         proxy_pass http://127.0.0.1:3001/game;
@@ -43,12 +65,21 @@ server {
         proxy_send_timeout 3600s;
     }
 
-    location / {
-        proxy_pass http://127.0.0.1:3000;
+    location = /api {
+        return 301 /api/;
+    }
+
+    location /api/ {
+        # The trailing slash strips the public /api prefix before Nest routing.
+        proxy_pass http://127.0.0.1:3000/;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
     }
+
+    location / {
+        return 302 /admin/;
+    }
 }

deploy/zulip/.env.example

@@ -0,0 +1,6 @@
+ZULIP__POSTGRES_PASSWORD=replace-with-random-value
+ZULIP__MEMCACHED_PASSWORD=replace-with-random-value
+ZULIP__RABBITMQ_PASSWORD=replace-with-random-value
+ZULIP__REDIS_PASSWORD=replace-with-random-value
+ZULIP__SECRET_KEY=replace-with-random-value
+ZULIP__EMAIL_PASSWORD=replace-with-random-value

deploy/zulip/Caddyfile

@@ -0,0 +1,6 @@
+:80 {
+    reverse_proxy zulip:80 {
+        header_up Host zulip.novamailio.com
+        header_up X-Forwarded-Proto https
+    }
+}

deploy/zulip/compose.override.yaml

@@ -0,0 +1,80 @@
+secrets:
+  zulip__postgres_password:
+    environment: ZULIP__POSTGRES_PASSWORD
+  zulip__memcached_password:
+    environment: ZULIP__MEMCACHED_PASSWORD
+  zulip__rabbitmq_password:
+    environment: ZULIP__RABBITMQ_PASSWORD
+  zulip__redis_password:
+    environment: ZULIP__REDIS_PASSWORD
+  zulip__secret_key:
+    environment: ZULIP__SECRET_KEY
+  zulip__email_password:
+    environment: ZULIP__EMAIL_PASSWORD
+
+services:
+  proxy:
+    image: caddy:2.10.2-alpine
+    restart: unless-stopped
+    command: ["caddy", "run", "--config", "/etc/caddy/Caddyfile"]
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+    depends_on:
+      - zulip
+    mem_limit: 32m
+    cpus: 0.1
+    networks:
+      default:
+        ipv4_address: 172.30.50.10
+      whaletown:
+        aliases:
+          - zulip.novamailio.com
+
+  database:
+    mem_limit: 384m
+    cpus: 0.5
+
+  memcached:
+    command:
+      - sh
+      - -euc
+      - |
+        echo 'mech_list: plain' > "$$SASL_CONF_PATH"
+        echo "zulip@$$HOSTNAME:$$(cat $$MEMCACHED_PASSWORD_FILE)" > "$$MEMCACHED_SASL_PWDB"
+        echo "zulip@localhost:$$(cat $$MEMCACHED_PASSWORD_FILE)" >> "$$MEMCACHED_SASL_PWDB"
+        exec memcached -S -m 32
+    mem_limit: 64m
+    cpus: 0.2
+
+  rabbitmq:
+    mem_limit: 256m
+    cpus: 0.4
+
+  redis:
+    mem_limit: 96m
+    cpus: 0.2
+
+  zulip:
+    ports: !override []
+    environment:
+      SETTING_EXTERNAL_HOST: zulip.novamailio.com
+      SETTING_ZULIP_ADMINISTRATOR: admin@novamailio.com
+      SETTING_EMAIL_BACKEND: django.core.mail.backends.console.EmailBackend
+      SETTING_SEND_LOGIN_EMAILS: "False"
+      CONFIG_application_server__queue_workers_multiprocess: "false"
+      LOADBALANCER_IPS: 172.30.50.10
+      TRUST_GATEWAY_IP: "False"
+    mem_limit: 1400m
+    cpus: 1.5
+    networks:
+      default:
+      whaletown:
+
+networks:
+  default:
+    ipam:
+      config:
+        - subnet: 172.30.50.0/24
+  whaletown:
+    external: true
+    name: whaletown_whaletown

deploy/zulip/compose.yaml

@@ -0,0 +1,111 @@
+---
+services:
+  database:
+    image: zulip/zulip-postgresql:14
+    restart: unless-stopped
+    secrets:
+      - zulip__postgres_password
+    environment:
+      POSTGRES_DB: zulip
+      POSTGRES_USER: zulip
+      POSTGRES_PASSWORD_FILE: /run/secrets/zulip__postgres_password
+    volumes:
+      - postgresql-14:/var/lib/postgresql/data:rw
+    attach: false
+
+  memcached:
+    image: memcached:alpine
+    restart: unless-stopped
+    command:
+      - sh
+      - -euc
+      - |
+        echo 'mech_list: plain' > "$$SASL_CONF_PATH"
+        echo "zulip@$$HOSTNAME:$$(cat $$MEMCACHED_PASSWORD_FILE)" > "$$MEMCACHED_SASL_PWDB"
+        echo "zulip@localhost:$$(cat $$MEMCACHED_PASSWORD_FILE)" >> "$$MEMCACHED_SASL_PWDB"
+        exec memcached -S
+    secrets:
+      - zulip__memcached_password
+    environment:
+      SASL_CONF_PATH: /home/memcache/memcached.conf
+      MEMCACHED_SASL_PWDB: /home/memcache/memcached-sasl-db
+      MEMCACHED_PASSWORD_FILE: /run/secrets/zulip__memcached_password
+    attach: false
+
+  rabbitmq:
+    image: rabbitmq:4.2
+    restart: unless-stopped
+    command:
+      - sh
+      - -euc
+      - |
+        export RABBITMQ_DEFAULT_PASS="$$(cat $$RABBITMQ_PASSWORD_FILE)"
+        echo 'default_user = $$(RABBITMQ_DEFAULT_USER)' >> /etc/rabbitmq/rabbitmq.conf
+        echo 'default_pass = $$(RABBITMQ_DEFAULT_PASS)' >> /etc/rabbitmq/rabbitmq.conf
+        exec docker-entrypoint.sh rabbitmq-server
+    secrets:
+      - zulip__rabbitmq_password
+    environment:
+      RABBITMQ_DEFAULT_USER: zulip
+      RABBITMQ_PASSWORD_FILE: /run/secrets/zulip__rabbitmq_password
+    volumes:
+      - rabbitmq:/var/lib/rabbitmq:rw
+    attach: false
+
+  redis:
+    image: redis:alpine
+    restart: unless-stopped
+    command:
+      - sh
+      - -euc
+      - '/usr/local/bin/docker-entrypoint.sh --requirepass "$$(cat $$REDIS_PASSWORD_FILE)"'
+    secrets:
+      - zulip__redis_password
+    environment:
+      REDIS_PASSWORD_FILE: /run/secrets/zulip__redis_password
+    volumes:
+      - redis:/data:rw
+    attach: false
+
+  zulip:
+    image: ghcr.io/zulip/zulip-server:12.1-0
+    restart: unless-stopped
+    ports:
+      - target: 25
+        published: 25
+        app_protocol: smtp
+      - target: 80
+        published: 80
+        app_protocol: http
+      - target: 443
+        published: 443
+        app_protocol: https
+    secrets:
+      - zulip__postgres_password
+      - zulip__memcached_password
+      - zulip__rabbitmq_password
+      - zulip__redis_password
+      - zulip__secret_key
+      - zulip__email_password
+    environment:
+      SETTING_REMOTE_POSTGRES_HOST: database
+      SETTING_MEMCACHED_LOCATION: memcached:11211
+      SETTING_RABBITMQ_HOST: rabbitmq
+      SETTING_REDIS_HOST: redis
+    volumes:
+      - zulip:/data:rw
+    ulimits:
+      nofile:
+        soft: 1000000
+        hard: 1048576
+    depends_on:
+      - database
+      - memcached
+      - rabbitmq
+      - redis
+
+volumes:
+  zulip:
+  postgresql-14:
+  rabbitmq:
+  redis: