<!-- webhook uctan uca test: 2026-07-06 -->
# news - Otomatik Deploy (Bitbucket push -> sunucu build -> pm2 restart)

Bu klasor, sunucuda `main` dalina her push'ta **sadece degisen** Next.js site(ler)ini
otomatik build edip `pm2 restart` eden, hata durumunda **otomatik rollback** yapan
stabil bir deploy sistemidir.

## Mimari

```
Bitbucket (main push)
  -> Webhook POST  https://admin.trsondakika.com/git-deploy/hooks/deploy-news?token=SECRET
  -> Apache (TLS, mod_proxy) -> 127.0.0.1:9000 (adnanh/webhook, systemd)
  -> webhook-trigger.sh (arka planda baslatir, aninda 200 doner)
  -> deploy.sh:
       git fetch -> degisen proje tespiti -> git reset --hard origin/main
       degisen site(ler): yarn install(gerekliyse) -> yarn build -> pm2 restart -> healthcheck
       hata -> onceki commit'e ROLLBACK
```

## Kapsam / Eslemeler

| Klasor | pm2 adi | Port | Domain |
|---|---|---|---|
| trsondakika | `trsondakika` | 3001 | trsondakika.com |
| borsauzmani | `borsauzmani` | 3004 | borsauzmani.co |
| ieconomy | `ieconmy` | 3000 | ieconomy.io |
| trensonhaber | `trensondakika` | 3003 | trensonhaber.com |

`expo` (pm2'de calismiyor) ve `gl-news` (statik) **kapsam disi**.

Build araci **yarn**. Calisma kullanicisi **ubuntu** (sudo'suz).

---

## KURULUM (tek seferlik) — sirayla, YEDEKLI

> Her riskli adimdan once yedek alinir. Adimlari birlikte, onayla ilerletelim.

### 0) On kosul: dosya sahipligi
`git reset` ve `yarn build` icin tum agacin `ubuntu` tarafindan yazilabilir olmasi gerekir
(su an bazi dizinler `root:root`).

```bash
# Once mevcut durumu gor
sudo ls -la /var/www/html
for d in trsondakika borsauzmani ieconomy trensonhaber; do stat -c '%U:%G %n' /var/www/html/$d/site; done

# YEDEK (sadece kaynak; node_modules/.next haric -> kucuk ve hizli)
tar --exclude='*/node_modules' --exclude='*/.next' --exclude='*.zip' \
    -czf /home/ubuntu/news-src-backup-$(date +%F-%H%M).tgz -C /var/www html

# Sahipligi normalize et (grup www-data korunur; Apache okumaya devam eder)
sudo chown -R ubuntu:www-data /var/www/html
# Laravel storage/bootstrap-cache grup-yazilabilir kalsin (api'ler icin)
sudo find /var/www/html -type d -path '*/api/storage' -exec chmod -R g+rwX {} +
sudo find /var/www/html -type d -path '*/api/bootstrap/cache' -exec chmod -R g+rwX {} +
```

### 1) Bitbucket'a read-only SSH deploy key
```bash
ssh-keygen -t ed25519 -C "deploy-news-server" -f ~/.ssh/bitbucket_news -N ""
cat ~/.ssh/bitbucket_news.pub    # -> Bitbucket: Repo settings > Access keys > Add key (read-only)

cat >> ~/.ssh/config <<'EOF'

Host bitbucket-news
  HostName bitbucket.org
  User git
  IdentityFile ~/.ssh/bitbucket_news
  IdentitiesOnly yes
EOF

ssh -T bitbucket-news   # "logged in as ..." benzeri mesaj bekleriz
```

### 2) Calisan dizini repoya bagla (HASSAS — fark incelemesi sart)
```bash
cd /var/www/html
git init -b main
git remote add origin git@bitbucket-news:mblcrmteam/newstrsondakika.git
git fetch origin main            # DOSYALARA DOKUNMAZ

# FARKI INCELE (reset'ten ONCE!). Cikti buyukse birlikte bakalim:
git status
git diff --stat origin/main      # sunucudaki kod repodan ne kadar farkli?
```
> `.env`, `node_modules`, `.next`, `*.zip` gitignore'da; reset bunlara dokunmaz.
> Fark **guvenli** oldugunda:
```bash
git reset --hard origin/main
```

### 3) .git'i web'den gizle (guvenlik)
```bash
sudo cp /var/www/html/deploy/apache-security-git.conf /etc/apache2/conf-available/security-git.conf
sudo a2enconf security-git
sudo apachectl configtest && sudo systemctl reload apache2
# Dogrula (403/404 beklenir):
curl -sI https://admin.trsondakika.com/.git/config | head -n1
```

### 4) adnanh/webhook kur + secret'li hooks.json (repo DISINDA)
```bash
sudo apt-get update && sudo apt-get install -y webhook

# Guclu bir secret uret ve NOT AL:
WH_SECRET="$(openssl rand -hex 24)"; echo "SECRET = $WH_SECRET"

# hooks.json'u repo disina koy (git reset ezmesin), secret'i yaz:
mkdir -p ~/webhook
sed "s/__WEBHOOK_SECRET__/${WH_SECRET}/" \
    /var/www/html/deploy/hooks.json.example > ~/webhook/hooks.json

# scriptleri calistirilabilir yap
chmod +x /var/www/html/deploy/deploy.sh /var/www/html/deploy/webhook-trigger.sh

# systemd servisi
sudo cp /var/www/html/deploy/webhook.service.example /etc/systemd/system/webhook-news.service
sudo systemctl daemon-reload
sudo systemctl enable --now webhook-news
sudo systemctl status webhook-news --no-pager
# Lokal test:
curl -s "http://127.0.0.1:9000/hooks/deploy-news?token=${WH_SECRET}"
```

### 5) Apache uzerinden TLS'li disari acma
`deploy/apache-git-deploy.conf.example` icindeki 3 satiri
`admin.trsondakika.com` (443) vhost'una, diger `ProxyPass /` satirlarindan ONCE ekle.
```bash
sudo cp /etc/apache2/sites-enabled/000-default-le-ssl.conf \
        /etc/apache2/sites-enabled/000-default-le-ssl.conf.bak-$(date +%F-%H%M)   # YEDEK
sudo nano /etc/apache2/sites-enabled/000-default-le-ssl.conf   # satirlari ekle
sudo apachectl configtest && sudo systemctl reload apache2
# Disaridan test (deploy tetikler!):
curl -s "https://admin.trsondakika.com/git-deploy/hooks/deploy-news?token=${WH_SECRET}"
```

### 6) pm2 kaliciligi
```bash
pm2 save
pm2 startup systemd -u ubuntu --hp /home/ubuntu   # ciktidaki komutu sudo ile calistir
```

### 7) Bitbucket Webhook
Repository settings > Webhooks > Add webhook
- URL: `https://admin.trsondakika.com/git-deploy/hooks/deploy-news?token=SECRET`
- Triggers: **Repository push**

---

## Gunluk kullanim
Local'de degisiklik -> `git push origin main` -> sunucu otomatik build+restart eder.
Loglar: `/var/www/html/deploy/logs/deploy_*.log` ve `pm2 logs <ad>`.

## Manuel deploy / rollback
```bash
# Manuel deploy:
/var/www/html/deploy/deploy.sh

# Manuel rollback (belirli commit'e):
cd /var/www/html && git reset --hard <ONCEKI_SHA>
cd <klasor>/site && rm -rf .next && yarn build && pm2 restart <pm2_ad>
```

## Sorun giderme
- Webhook tetiklenmiyor: `sudo journalctl -u webhook-news -f`
- Build hatasi: ilgili `deploy/logs/deploy_*.log`
- Site acilmiyor: `pm2 logs <ad> --lines 100`, `curl -I http://127.0.0.1:<port>/`