Integrate complete Candidat platform with ASP.NET chatbot service

- Added Next.js frontend for candidate interviews - Added Node.js backend with TypeScript and AI integration - Added ASP.NET Core chatbot service for specialized AI conversations - Added MySQL database with complete schema - Added Nginx reverse proxy configuration - Complete Docker Compose orchestration for all services - Environment configuration for production, development, and Cloudflare - Comprehensive documentation and setup instructions - Flattened nested folder structures for clean organization - Integrated chatbot service with fallback to direct AI calls
2025-09-20 10:45:21 +02:00
parent bcd25503c5
commit ec8342b5e2
128 changed files with 27581 additions and 10 deletions
@@ -0,0 +1,176 @@
+# Cloudflare Setup Guide for candivista.com
+
+This guide will help you configure Cloudflare for your application to get proper SSL certificates and better performance.
+
+## Cloudflare Configuration Steps
+
+### 1. DNS Configuration
+In your Cloudflare dashboard:
+
+1. **Add A Records:**
+   ```
+   Type: A
+   Name: @
+   Content: 168.231.108.135
+   Proxy status: Proxied (orange cloud)
+   
+   Type: A
+   Name: www
+   Content: 168.231.108.135
+   Proxy status: Proxied (orange cloud)
+   ```
+
+### 2. SSL/TLS Configuration
+1. Go to **SSL/TLS** → **Overview**
+2. Set encryption mode to **"Full (strict)"**
+3. Go to **SSL/TLS** → **Edge Certificates**
+4. Enable **"Always Use HTTPS"**
+5. Enable **"HTTP Strict Transport Security (HSTS)"**
+
+### 3. Security Settings
+1. Go to **Security** → **Settings**
+2. Set security level to **"Medium"** or **"High"**
+3. Enable **"Browser Integrity Check"**
+4. Go to **Security** → **WAF**
+5. Enable **"Web Application Firewall"**
+
+### 4. Performance Settings
+1. Go to **Speed** → **Optimization**
+2. Enable **"Auto Minify"** for CSS, HTML, and JavaScript
+3. Enable **"Brotli"** compression
+4. Go to **Caching** → **Configuration**
+5. Set caching level to **"Standard"**
+
+## Nginx Configuration Updates
+
+The nginx configuration has been updated to work optimally with Cloudflare:
+
+### ✅ Changes Made:
+1. **Real IP Detection** - Added Cloudflare IP ranges
+2. **SSL Optimization** - Disabled OCSP stapling (handled by Cloudflare)
+3. **Security Headers** - Added Cloudflare-specific headers
+4. **Rate Limiting** - Works with Cloudflare's real IP detection
+
+## Deployment with Cloudflare
+
+### Option 1: Use Cloudflare Environment
+```bash
+# Deploy with Cloudflare-optimized settings
+docker-compose --env-file env.cloudflare up -d
+```
+
+### Option 2: Use Self-Signed Certificates
+```bash
+# Generate self-signed certificates (Cloudflare will handle SSL)
+openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
+    -keyout nginx/ssl/key.pem \
+    -out nginx/ssl/cert.pem \
+    -subj "/C=US/ST=State/L=City/O=Organization/CN=candivista.com"
+
+# Deploy
+docker-compose --env-file env.cloudflare up -d
+```
+
+## Testing Your Setup
+
+### 1. Check DNS Propagation
+```bash
+# Check if domain resolves through Cloudflare
+nslookup candivista.com
+dig candivista.com
+```
+
+### 2. Test SSL Certificate
+```bash
+# Test SSL (should show Cloudflare certificate)
+curl -I https://candivista.com
+
+# Check certificate details
+openssl s_client -connect candivista.com:443 -servername candivista.com
+```
+
+### 3. Test Application
+```bash
+# Test HTTP (should redirect to HTTPS)
+curl -I http://candivista.com
+
+# Test HTTPS
+curl -I https://candivista.com
+
+# Test health endpoint
+curl https://candivista.com/health
+```
+
+## Cloudflare Benefits
+
+### ✅ SSL/TLS
+- **Free SSL certificates** from Cloudflare
+- **Automatic certificate renewal**
+- **Modern TLS protocols** (TLS 1.3)
+- **Perfect SSL score** on SSL Labs
+
+### ✅ Performance
+- **Global CDN** - Faster loading worldwide
+- **Caching** - Reduced server load
+- **Compression** - Smaller file sizes
+- **HTTP/2 and HTTP/3** support
+
+### ✅ Security
+- **DDoS protection**
+- **Web Application Firewall (WAF)**
+- **Bot protection**
+- **Rate limiting**
+
+### ✅ Monitoring
+- **Analytics** - Traffic insights
+- **Security events** - Attack monitoring
+- **Performance metrics** - Speed optimization
+
+## Troubleshooting
+
+### Common Issues
+
+1. **"Not Secure" Warning:**
+   - Check Cloudflare SSL/TLS settings
+   - Ensure "Full (strict)" mode is enabled
+   - Wait for DNS propagation
+
+2. **502 Bad Gateway:**
+   - Check if your server is running
+   - Verify Cloudflare can reach your server
+   - Check nginx logs
+
+3. **Slow Loading:**
+   - Enable Cloudflare caching
+   - Check compression settings
+   - Optimize images and assets
+
+### Useful Commands
+
+```bash
+# Check Cloudflare IP ranges
+curl -s https://www.cloudflare.com/ips-v4
+
+# Test from Cloudflare's perspective
+curl -H "CF-Connecting-IP: 1.2.3.4" https://candivista.com
+
+# Check SSL certificate
+curl -I https://candivista.com
+
+# Monitor nginx logs
+docker logs candidat-nginx -f
+```
+
+## Next Steps
+
+1. **Configure DNS** in Cloudflare dashboard
+2. **Set SSL/TLS** to "Full (strict)"
+3. **Deploy application** with Cloudflare settings
+4. **Test everything** works correctly
+5. **Enable additional features** (caching, security, etc.)
+
+Your application will now have:
+- ✅ **Free SSL certificates**
+- ✅ **Global CDN performance**
+- ✅ **Enhanced security**
+- ✅ **Professional setup**
@@ -0,0 +1,183 @@
+# DNS Setup Guide for candivista.com
+
+This guide will help you configure your domain name `candivista.com` to point to your VPS at `168.231.108.135`.
+
+## DNS Configuration
+
+### Required DNS Records
+
+You need to add the following DNS records in your domain registrar's DNS management panel:
+
+#### A Records
+```
+Type: A
+Name: @
+Value: 168.231.108.135
+TTL: 300 (or default)
+
+Type: A  
+Name: www
+Value: 168.231.108.135
+TTL: 300 (or default)
+```
+
+#### Optional CNAME Record (Alternative to www A record)
+```
+Type: CNAME
+Name: www
+Value: candivista.com
+TTL: 300 (or default)
+```
+
+### DNS Propagation
+
+After adding these records:
+1. DNS changes can take 5 minutes to 48 hours to propagate globally
+2. You can check propagation status at: https://www.whatsmydns.net/
+3. Test locally with: `nslookup candivista.com` and `nslookup www.candivista.com`
+
+## SSL Certificate Setup
+
+### Option 1: Let's Encrypt (Recommended)
+
+1. **Update your email in the SSL setup script:**
+   ```bash
+   # Edit nginx/ssl-setup.sh
+   EMAIL="your-actual-email@example.com"
+   ```
+
+2. **Run the SSL setup:**
+   ```bash
+   chmod +x nginx/ssl-setup.sh
+   ./nginx/ssl-setup.sh
+   ```
+
+3. **Deploy with SSL:**
+   ```bash
+   ./deploy-production.sh
+   ```
+
+### Option 2: Cloudflare (Alternative)
+
+If you prefer using Cloudflare:
+
+1. **Add your domain to Cloudflare**
+2. **Point your nameservers to Cloudflare**
+3. **Enable SSL/TLS encryption mode: "Full (strict)"**
+4. **Update nginx configuration to use Cloudflare's origin certificates**
+
+## Verification Steps
+
+### 1. Check DNS Resolution
+```bash
+# Check A record
+nslookup candivista.com
+nslookup www.candivista.com
+
+# Check from different locations
+dig candivista.com @8.8.8.8
+dig www.candivista.com @1.1.1.1
+```
+
+### 2. Test HTTP/HTTPS Access
+```bash
+# Test HTTP (should redirect to HTTPS)
+curl -I http://candivista.com
+
+# Test HTTPS
+curl -I https://candivista.com
+
+# Test www subdomain
+curl -I https://www.candivista.com
+```
+
+### 3. SSL Certificate Verification
+```bash
+# Check SSL certificate
+openssl s_client -connect candivista.com:443 -servername candivista.com
+
+# Test SSL Labs rating
+# Visit: https://www.ssllabs.com/ssltest/analyze.html?d=candivista.com
+```
+
+## Troubleshooting
+
+### Common Issues
+
+1. **DNS not resolving:**
+   - Wait for propagation (up to 48 hours)
+   - Check DNS records are correct
+   - Verify TTL settings
+
+2. **SSL certificate issues:**
+   - Ensure domain points to your server before running SSL setup
+   - Check firewall allows ports 80 and 443
+   - Verify Let's Encrypt can reach your server
+
+3. **Nginx not starting:**
+   - Check nginx configuration: `nginx -t`
+   - Check logs: `docker logs candidat-nginx`
+   - Verify SSL certificates exist
+
+### Useful Commands
+
+```bash
+# Check nginx configuration
+docker exec candidat-nginx nginx -t
+
+# View nginx logs
+docker logs candidat-nginx
+
+# Restart nginx
+docker-compose restart nginx
+
+# Check all services
+docker-compose ps
+
+# View all logs
+docker-compose logs -f
+```
+
+## Security Considerations
+
+1. **Firewall Configuration:**
+   - Only allow ports 80, 443, and SSH (22)
+   - Block direct access to backend ports (8083, 3000, 3306)
+
+2. **SSL Security:**
+   - The nginx configuration includes modern SSL settings
+   - HSTS is enabled for security
+   - Regular certificate renewal is automated
+
+3. **Rate Limiting:**
+   - API endpoints are rate limited
+   - Admin endpoints have stricter limits
+   - Connection limits per IP are enforced
+
+## Monitoring
+
+### Health Checks
+- Application health: `https://candivista.com/health`
+- Nginx status: `https://candivista.com/nginx_status` (internal only)
+
+### Log Monitoring
+```bash
+# Real-time access logs
+docker exec candidat-nginx tail -f /var/log/nginx/access.log
+
+# Error logs
+docker exec candidat-nginx tail -f /var/log/nginx/error.log
+
+# Application logs
+docker-compose logs -f backend
+docker-compose logs -f frontend
+```
+
+## Next Steps
+
+1. **Configure your domain DNS records** as described above
+2. **Wait for DNS propagation** (check with whatsmydns.net)
+3. **Update your email** in the SSL setup script
+4. **Run the deployment script** to set up SSL and deploy
+5. **Test your application** at https://candivista.com
+6. **Set up monitoring** and regular backups
@@ -0,0 +1,44 @@
+events {
+    worker_connections 1024;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+    
+    sendfile on;
+    keepalive_timeout 65;
+
+    server {
+        listen 80;
+        
+        server_name candivista.com www.candivista.com _;
+
+        # Frontend - everything goes to frontend by default
+        location / {
+            proxy_pass http://frontend:3000;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
+        # Backend API
+        location /rest {
+            proxy_pass http://backend:8083/rest;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
+        # Backend docs
+        location /doc {
+            proxy_pass http://backend:8083/doc;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+    }
+}
@@ -0,0 +1,116 @@
+# SSL Certificate Setup Script for VPS Deployment (PowerShell)
+# This script helps set up SSL certificates for your nginx configuration
+
+param(
+    [string]$Domain = "candivista.com",
+    [string]$Email = "your-email@example.com"
+)
+
+$ErrorActionPreference = "Stop"
+
+$NginxConfDir = ".\nginx"
+$SslDir = ".\nginx\ssl"
+
+Write-Host "Setting up SSL certificates for $Domain" -ForegroundColor Green
+
+# Create SSL directory if it doesn't exist
+if (!(Test-Path $SslDir)) {
+    New-Item -ItemType Directory -Path $SslDir -Force
+}
+
+# Check if we have a domain name or just IP
+if ($Domain -match '^\d+\.\d+\.\d+\.\d+$') {
+    Write-Host "IP address detected: $Domain" -ForegroundColor Yellow
+    Write-Host "For IP addresses, you'll need to use self-signed certificates or a service like Cloudflare" -ForegroundColor Yellow
+    Write-Host "Generating self-signed certificate..." -ForegroundColor Yellow
+    
+    # Check if OpenSSL is available
+    try {
+        $opensslVersion = & openssl version 2>$null
+        if ($LASTEXITCODE -ne 0) {
+            throw "OpenSSL not found"
+        }
+    }
+    catch {
+        Write-Host "OpenSSL not found. Please install OpenSSL or use WSL/Linux subsystem." -ForegroundColor Red
+        Write-Host "Alternative: Use Cloudflare for SSL termination" -ForegroundColor Yellow
+        exit 1
+    }
+    
+    # Generate self-signed certificate
+    & openssl req -x509 -nodes -days 365 -newkey rsa:2048 `
+        -keyout "$SslDir\key.pem" `
+        -out "$SslDir\cert.pem" `
+        -subj "/C=US/ST=State/L=City/O=Organization/CN=$Domain"
+    
+    if ($LASTEXITCODE -eq 0) {
+        Write-Host "Self-signed certificate generated successfully!" -ForegroundColor Green
+        Write-Host "Note: Browsers will show a security warning for self-signed certificates." -ForegroundColor Yellow
+        Write-Host "For production, consider using Cloudflare or a domain name with Let's Encrypt." -ForegroundColor Yellow
+    } else {
+        Write-Host "Failed to generate self-signed certificate" -ForegroundColor Red
+        exit 1
+    }
+} else {
+    Write-Host "Domain name detected: $Domain" -ForegroundColor Green
+    Write-Host "Setting up Let's Encrypt certificate..." -ForegroundColor Green
+    
+    # Check if certbot is available
+    try {
+        $certbotVersion = & certbot --version 2>$null
+        if ($LASTEXITCODE -ne 0) {
+            throw "Certbot not found"
+        }
+    }
+    catch {
+        Write-Host "Certbot not found. Please install certbot first:" -ForegroundColor Red
+        Write-Host "  Windows: Use WSL or install via pip" -ForegroundColor Yellow
+        Write-Host "  Linux: sudo apt-get install certbot" -ForegroundColor Yellow
+        Write-Host "  macOS: brew install certbot" -ForegroundColor Yellow
+        exit 1
+    }
+    
+    # Create webroot directory for Let's Encrypt challenge
+    $webrootDir = "$SslDir\webroot\.well-known\acme-challenge"
+    if (!(Test-Path $webrootDir)) {
+        New-Item -ItemType Directory -Path $webrootDir -Force
+    }
+    
+    # Get certificate
+    & certbot certonly --webroot `
+        -w "$SslDir\webroot" `
+        -d $Domain `
+        --email $Email `
+        --agree-tos `
+        --non-interactive
+    
+    if ($LASTEXITCODE -eq 0) {
+        # Copy certificates to our SSL directory
+        Copy-Item "/etc/letsencrypt/live/$Domain/fullchain.pem" "$SslDir\cert.pem"
+        Copy-Item "/etc/letsencrypt/live/$Domain/privkey.pem" "$SslDir\key.pem"
+        
+        Write-Host "Let's Encrypt certificate installed successfully!" -ForegroundColor Green
+        
+        # Create renewal script
+        $renewScript = @"
+#!/bin/bash
+certbot renew --quiet
+docker-compose restart nginx
+"@
+        $renewScript | Out-File -FilePath "$SslDir\renew.sh" -Encoding UTF8
+        
+        Write-Host "Auto-renewal script created!" -ForegroundColor Green
+    } else {
+        Write-Host "Failed to obtain Let's Encrypt certificate" -ForegroundColor Red
+        exit 1
+    }
+}
+
+Write-Host "SSL setup complete!" -ForegroundColor Green
+Write-Host "Certificate: $SslDir\cert.pem" -ForegroundColor Cyan
+Write-Host "Private key: $SslDir\key.pem" -ForegroundColor Cyan
+Write-Host ""
+Write-Host "Next steps:" -ForegroundColor Yellow
+Write-Host "1. Update your .env file with production values" -ForegroundColor White
+Write-Host "2. Run: docker-compose -f docker-compose.yml --env-file env.production up -d" -ForegroundColor White
+Write-Host "3. Test your setup: https://$Domain" -ForegroundColor White
@@ -0,0 +1,93 @@
+#!/bin/bash
+
+# SSL Certificate Setup Script for VPS Deployment
+# This script helps set up SSL certificates for your nginx configuration
+
+set -e
+
+DOMAIN="candivista.com"
+EMAIL="blindxfish@gmail.com"  # Change this to your email
+NGINX_CONF_DIR="./nginx"
+SSL_DIR="./nginx/ssl"
+
+echo "Setting up SSL certificates for $DOMAIN"
+
+# Create SSL directory if it doesn't exist
+mkdir -p "$SSL_DIR"
+
+# Check if we have a domain name or just IP
+if [[ $DOMAIN =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+    echo "IP address detected: $DOMAIN"
+    echo "For IP addresses, you'll need to use self-signed certificates or a service like Cloudflare"
+    echo "Generating self-signed certificate..."
+    
+    # Generate self-signed certificate
+    openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
+        -keyout "$SSL_DIR/key.pem" \
+        -out "$SSL_DIR/cert.pem" \
+        -subj "/C=US/ST=State/L=City/O=Organization/CN=$DOMAIN"
+    
+    echo "Self-signed certificate generated successfully!"
+    echo "Note: Browsers will show a security warning for self-signed certificates."
+    echo "For production, consider using Cloudflare or a domain name with Let's Encrypt."
+    
+else
+    echo "Domain name detected: $DOMAIN"
+    echo "Setting up Let's Encrypt certificate..."
+    
+    # Install certbot if not already installed
+    if ! command -v certbot &> /dev/null; then
+        echo "Installing certbot..."
+        if [[ "$OSTYPE" == "linux-gnu"* ]]; then
+            sudo apt-get update
+            sudo apt-get install -y certbot
+        elif [[ "$OSTYPE" == "darwin"* ]]; then
+            brew install certbot
+        else
+            echo "Please install certbot manually for your OS"
+            exit 1
+        fi
+    fi
+    
+    # Create webroot directory for Let's Encrypt challenge
+    mkdir -p "$SSL_DIR/webroot/.well-known/acme-challenge"
+    
+    # Get certificate
+    sudo certbot certonly --webroot \
+        -w "$SSL_DIR/webroot" \
+        -d "$DOMAIN" \
+        --email "$EMAIL" \
+        --agree-tos \
+        --non-interactive
+    
+    # Copy certificates to our SSL directory
+    sudo cp "/etc/letsencrypt/live/$DOMAIN/fullchain.pem" "$SSL_DIR/cert.pem"
+    sudo cp "/etc/letsencrypt/live/$DOMAIN/privkey.pem" "$SSL_DIR/key.pem"
+    sudo chown $(whoami):$(whoami) "$SSL_DIR/cert.pem" "$SSL_DIR/key.pem"
+    
+    echo "Let's Encrypt certificate installed successfully!"
+    echo "Setting up auto-renewal..."
+    
+    # Add renewal script
+    cat > "$SSL_DIR/renew.sh" << 'EOF'
+#!/bin/bash
+certbot renew --quiet
+docker-compose restart nginx
+EOF
+    
+    chmod +x "$SSL_DIR/renew.sh"
+    
+    # Add to crontab for auto-renewal
+    (crontab -l 2>/dev/null; echo "0 12 * * * $SSL_DIR/renew.sh") | crontab -
+    
+    echo "Auto-renewal configured!"
+fi
+
+echo "SSL setup complete!"
+echo "Certificate: $SSL_DIR/cert.pem"
+echo "Private key: $SSL_DIR/key.pem"
+echo ""
+echo "Next steps:"
+echo "1. Update your .env file with production values"
+echo "2. Run: docker-compose -f docker-compose.yml --env-file env.production up -d"
+echo "3. Test your setup: https://$DOMAIN"