---
status: seed
type: concept
tags: []
created: 2025-12-17
updated: 2026-05-31
aliases: []
---

# Инструкция по деплою finreport-analyzer

## Сервер

- Хост: `finances-deploy` (10.10.108.52, Debian, без systemd)
- SSH: через ProxyJump `dragon` (10.102.179.132, user: gkkryuchkov)
- Deploy user: `deploy`
- Deploy path: `/srv/finreport-analyzer`
- Ветка деплоя: `migrate_rails_to8` (временно; в будущем `master`)

## Первоначальная настройка сервера (один раз)

### 1. Пакеты
```bash
apt install git postgresql libpq-dev nginx nodejs supervisor
```

### 2. Пользователь deploy
```bash
adduser deploy
# добавить ~/.ssh/authorized_keys
```

### 3. Rbenv + Ruby
```bash
# от имени deploy
git clone https://github.com/rbenv/rbenv.git ~/.rbenv
git clone https://github.com/rbenv/ruby-build.git ~/.rbenv/plugins/ruby-build
# добавить rbenv в PATH в ~/.bashrc
rbenv install 3.3.0
rbenv global 3.3.0
gem install bundler
```

### 4. PostgreSQL
```bash
sudo -u postgres createuser deploy
sudo -u postgres createdb finanalyzer_production -O deploy
sudo -u postgres psql -c "ALTER USER deploy WITH PASSWORD 'пароль';"
```

### 5. Директория деплоя
```bash
mkdir -p /srv/finreport-analyzer
chown deploy:deploy /srv/finreport-analyzer
```

### 6. Shared-файлы
```bash
mkdir -p /srv/finreport-analyzer/shared/config

# database.yml
cat > /srv/finreport-analyzer/shared/config/database.yml << 'EOF'
default: &default
  adapter: postgresql
  encoding: unicode
  pool: 5

production:
  <<: *default
  url: <%= ENV["DATABASE_URL"] %>
EOF

# .env
cat > /srv/finreport-analyzer/shared/.env << 'EOF'
RAILS_ENV=production
DATABASE_URL=postgres://deploy:ПАРОЛЬ@localhost/finanalyzer_production
EOF

# credentials и master.key — скопировать с локальной машины:
scp config/credentials.yml.enc finances-deploy:/srv/finreport-analyzer/shared/config/
scp config/master.key finances-deploy:/srv/finreport-analyzer/shared/config/
```

### 7. Deploy key для GitLab
```bash
# на сервере от deploy:
ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 -N ""
cat ~/.ssh/id_ed25519.pub
# добавить в GitLab: Settings → Repository → Deploy keys
```

### 8. Sudoers
```bash
sudo visudo -f /etc/sudoers.d/deploy
```
```
deploy ALL=(ALL) NOPASSWD: /usr/bin/supervisorctl restart puma
deploy ALL=(ALL) NOPASSWD: /usr/bin/supervisorctl restart solid_queue
deploy ALL=(ALL) NOPASSWD: /usr/bin/supervisorctl start puma
deploy ALL=(ALL) NOPASSWD: /usr/bin/supervisorctl start solid_queue
deploy ALL=(ALL) NOPASSWD: /usr/bin/supervisorctl stop puma
deploy ALL=(ALL) NOPASSWD: /usr/bin/supervisorctl stop solid_queue
deploy ALL=(ALL) NOPASSWD: /usr/bin/supervisorctl reread
deploy ALL=(ALL) NOPASSWD: /usr/bin/supervisorctl update
deploy ALL=(ALL) NOPASSWD: /bin/mv /tmp/puma.conf /etc/supervisor/conf.d/puma.conf
deploy ALL=(ALL) NOPASSWD: /bin/mv /tmp/solid_queue.conf /etc/supervisor/conf.d/solid_queue.conf
deploy ALL=(ALL) NOPASSWD: /bin/mv /tmp/nginx.conf /etc/nginx/sites-available/finreport-analyzer
deploy ALL=(ALL) NOPASSWD: /usr/sbin/nginx -t
deploy ALL=(ALL) NOPASSWD: /usr/sbin/service nginx reload
deploy ALL=(ALL) NOPASSWD: /bin/ln -sf /etc/nginx/sites-available/finreport-analyzer /etc/nginx/sites-enabled/finreport-analyzer
deploy ALL=(ALL) NOPASSWD: /bin/rm -f /etc/nginx/sites-enabled/default
```

### 9. Supervisor и nginx (через Capistrano)
```bash
bundle exec cap production setup:supervisor
bundle exec cap production setup:nginx
```

## Регулярный деплой

```bash
bundle exec cap production deploy
```

## Подключение к серверу

```bash
ssh finances-deploy
# или с туннелем для браузера:
sudo ssh -L 80:localhost:80 -J gkkryuchkov@10.102.179.132 -i ~/.ssh/id_ed25519 deploy@10.10.108.52
```

## Логи на сервере

```bash
tail -f /srv/finreport-analyzer/shared/log/puma.log
tail -f /srv/finreport-analyzer/shared/log/solid_queue.log
sudo supervisorctl status
```

## Известные нюансы

- `force_ssl = false` и `assume_ssl = false` — сервер работает по HTTP, SSL не настроен
- Solid Queue supervisor конфиг: `rake solid_queue:start` (не `rails solid_queue:start`)
- net-ssh не читает `Include` в `~/.ssh/config` — ProxyJump задан явно в `config/deploy/production.rb`
- HSTS-кэш браузера может мешать при тестировании через туннель — использовать инкогнито