.env.production.example

@@ -13,21 +13,20 @@ PGPASSWORD=YOUR_SECURE_PASSWORD
 # Genera con: openssl rand -base64 32
 SESSION_SECRET=YOUR_RANDOM_SESSION_SECRET_HERE
 
-# =================== AUTHENTICATION ===================
+# =================== REPLIT AUTH (Produzione) ===================
-# Configurazione OIDC (senza Replit)
+# Configurazione OIDC per autenticazione
-ISSUER_URL=https://auth.vt.alfacom.it/oidc
+ISSUER_URL=https://replit.com/oidc
-CLIENT_ID=vigilanza-turni
+REPL_ID=your-repl-id-here
-CLIENT_SECRET=YOUR_OIDC_CLIENT_SECRET
+REPLIT_DOMAINS=tuodominio.it,www.tuodominio.it
 
-# =================== APPLICATION ===================
+# =================== NODE ENVIRONMENT ===================
 NODE_ENV=production
 PORT=5000
-APP_URL=https://vt.alfacom.it
 
-# =================== BACKUP ===================
+# =================== LOGGING (opzionale) ===================
-BACKUP_ENABLED=true
-BACKUP_DIR=/var/backups/vigilanza-turni
-BACKUP_RETENTION_DAYS=30
-
-# =================== LOGGING ===================
 LOG_LEVEL=info
+
+# =================== BACKUP (opzionale) ===================
+# BACKUP_ENABLED=true
+# BACKUP_SCHEDULE="0 2 * * *"  # Daily at 2 AM
+# BACKUP_RETENTION_DAYS=30

.replit

@@ -4,7 +4,7 @@ hidden = [".config", ".git", "generated-icon.png", "node_modules", "dist"]
 
 [nix]
 channel = "stable-24_05"
-packages = ["nano", "zip", "openssh"]
+packages = ["nano"]
 
 [deployment]
 deploymentTarget = "autoscale"

DEPLOYMENT.md

@@ -1,115 +1,209 @@
-# 📘 Deployment Guide - VigilanzaTurni
+# 🚀 Guida Deployment VigilanzaTurni
 
-Guida completa deployment sistema VigilanzaTurni su vt.alfacom.it
+Deployment automatico da Replit → GitLab → Server AlmaLinux 9
-
----
 
 ## 📋 Indice
 
-1. [Overview](#overview)
+1. [Prerequisiti](#prerequisiti)
-2. [Prerequisiti](#prerequisiti)
+2. [Setup Iniziale Server](#setup-iniziale-server)
-3. [Setup Iniziale](#setup-iniziale)
+3. [Configurazione GitLab](#configurazione-gitlab)
-4. [Configurazione](#configurazione)
+4. [Configurazione Replit](#configurazione-replit)
-5. [Deployment](#deployment)
+5. [Primo Deployment](#primo-deployment)
-6. [Manutenzione](#manutenzione)
+6. [Deployment Automatico](#deployment-automatico)
-7. [Troubleshooting](#troubleshooting)
+7. [Manutenzione](#manutenzione)
+8. [Troubleshooting](#troubleshooting)
 
 ---
 
-## Overview
+## 1. Prerequisiti
 
-**Architettura Deployment:**
+### Server AlmaLinux 9
-```
+- Server con accesso root/sudo
-Replit/Local Dev
+- Almeno 2GB RAM
-    ↓ (git push)
+- 20GB storage
-GitLab Repository
+- Indirizzo IP pubblico
-    ↓ (manual deploy)
+- Dominio configurato (es. vigilanza.tuodominio.it)
-AlmaLinux 9 Server
-    ↓
-https://vt.alfacom.it (Production)
-```
 
-**Stack Produzione:**
+### Account e Accessi
-- OS: AlmaLinux 9
+- Account GitLab su git.alfacom.it
-- Runtime: Node.js 20
+- SSH access al server
-- Database: PostgreSQL 15
+- Replit account con questo progetto
-- Process Manager: PM2
-- Web Server: Nginx (reverse proxy)
-- SSL: Let's Encrypt (Certbot)
 
 ---
 
-## Prerequisiti
+## 2. Setup Iniziale Server
 
-### Server Requirements
+### 2.1 Connessione al Server
-- AlmaLinux 9 (fresh install)
-- Min 2GB RAM, 20GB disk
-- Accesso root SSH
-- Dominio: vt.alfacom.it (DNS configurato)
-
-### Locale Requirements
-- Git installato
-- SSH key configurata
-- Accesso repository GitLab
-
----
-
-## Setup Iniziale
-
-### 1. Preparazione Server
 
 ```bash
-# SSH nel server
+ssh root@ip-del-tuo-server
-ssh root@vt.alfacom.it
-
-# Clone repository
-cd /var/www
-git clone https://git.alfacom.it/marco/VigilanzaTurni.git vigilanza-turni
-cd vigilanza-turni
-
-# Esegui setup automatico
-sudo bash deploy/setup-server.sh
 ```
 
-Lo script `setup-server.sh` installa automaticamente:
+### 2.2 Esecuzione Script Setup
 
-✅ **Node.js 20**
+```bash
-- Runtime JavaScript/TypeScript
+# Download script setup
-- npm package manager
+curl -o setup-server.sh https://git.alfacom.it/marco/VigilanzaTurni/-/raw/main/deploy/setup-server.sh
 
-✅ **PostgreSQL 15**
+# Rendi eseguibile
-- Database relazionale
+chmod +x setup-server.sh
-- User: `vigilanza_user`
+
-- Password: **Generata automaticamente** (salvata in `/root/.vigilanza_db_password`)
+# Esegui setup
+sudo bash setup-server.sh
+```
+
+Lo script installerà:
+- ✅ Node.js 20 LTS
+- ✅ PostgreSQL 15
+- ✅ PM2 (process manager)
+- ✅ Nginx (reverse proxy)
+- ✅ Git
+- ✅ Firewall configurato
+- ✅ Certbot (per SSL)
+
+### 2.3 Configurazione Database
+
+Lo script crea automaticamente:
 - Database: `vigilanza_turni`
+- User: `vigilanza_user`
+- Password: **Generata automaticamente** (mostrata a fine setup)
 
-✅ **PM2**
+⚠️ **IMPORTANTE**: Salva la password mostrata al termine del setup!
-- Process manager Node.js
-- Auto-restart on crash
-- Log management
-- Startup script
-
-✅ **Nginx**
-- Reverse proxy
-- SSL termination
-- Static files serving
-- Gzip compression
-
-✅ **Git**
-- Version control
-
-✅ **Firewall**
-- HTTP (80) aperto
-- HTTPS (443) aperto
-
-✅ **Certbot**
-- Let's Encrypt SSL certificates
-
-### 2. Configurazione Nginx
 
 ```bash
-# Copia configurazione
+# La password è salvata anche in:
-sudo cp deploy/nginx.conf /etc/nginx/conf.d/vigilanza-turni.conf
+cat /root/.vigilanza_db_password
+
+# Se persa, puoi cambiarla con:
+sudo -u postgres psql
+ALTER USER vigilanza_user WITH PASSWORD 'NuovaPasswordSicura123!';
+\q
+```
+
+### 2.4 Configurazione SSL
+
+```bash
+# Sostituisci tuodominio.it con il tuo dominio
+sudo certbot --nginx -d vigilanza.tuodominio.it
+```
+
+Certbot configurerà automaticamente:
+- Certificato SSL Let's Encrypt
+- Redirect HTTP → HTTPS
+- Auto-rinnovo certificato
+
+---
+
+## 3. Configurazione GitLab
+
+### 3.1 Variabili CI/CD
+
+Vai su GitLab: **Settings → CI/CD → Variables**
+
+Aggiungi queste variabili:
+
+| Variabile | Valore | Protected | Masked |
+|-----------|--------|-----------|--------|
+| `SSH_PRIVATE_KEY` | La tua chiave SSH privata | ✅ | ✅ |
+| `DEPLOY_HOST` | IP o hostname del server | ✅ | ❌ |
+| `DEPLOY_USER` | `root` o utente deploy | ✅ | ❌ |
+| `DEPLOY_DOMAIN` | `vigilanza.tuodominio.it` | ✅ | ❌ |
+
+#### Generare SSH Key
+
+```bash
+# Sul tuo computer locale
+ssh-keygen -t ed25519 -C "gitlab-deploy" -f ~/.ssh/gitlab-deploy
+
+# Copia chiave pubblica sul server
+ssh-copy-id -i ~/.ssh/gitlab-deploy.pub root@ip-del-server
+
+# Copia chiave privata (contenuto completo)
+cat ~/.ssh/gitlab-deploy
+# Copia output e incolla in GitLab come SSH_PRIVATE_KEY
+```
+
+### 3.2 Abilitare GitLab Runner
+
+Assicurati che il progetto abbia accesso a un Runner GitLab:
+- Vai su **Settings → CI/CD → Runners**
+- Abilita un Shared Runner o configura un Specific Runner
+
+---
+
+## 4. Configurazione Replit
+
+### 4.1 Configurare Git Remote
+
+```bash
+# In Replit Shell
+git remote add production https://git.alfacom.it/marco/VigilanzaTurni.git
+
+# Verifica
+git remote -v
+```
+
+### 4.2 Autenticazione GitLab
+
+Crea Personal Access Token su GitLab:
+1. GitLab → **User Settings → Access Tokens**
+2. Nome: `Replit Deploy`
+3. Scopes: `write_repository`
+4. Copia il token
+
+In Replit, salva token nei Secrets:
+```bash
+# Secrets → Add new secret
+Name: GITLAB_TOKEN
+Value: <il-tuo-token>
+```
+
+### 4.3 Script Push Automatico
+
+Crea file `push-to-gitlab.sh` in Replit:
+
+```bash
+#!/bin/bash
+git add .
+git commit -m "Deploy: $(date '+%Y-%m-%d %H:%M:%S')"
+git push production main
+```
+
+---
+
+## 5. Primo Deployment
+
+### 5.1 Configurazione .env Produzione
+
+Sul server:
+
+```bash
+cd /var/www/vigilanza-turni
+cp .env.production.example .env
+nano .env
+```
+
+Configura usando la password PostgreSQL generata durante setup:
+
+```bash
+# Recupera password DB
+DB_PASS=$(grep PGPASSWORD /root/.vigilanza_db_password | cut -d= -f2)
+
+# Configura .env
+DATABASE_URL=postgresql://vigilanza_user:${DB_PASS}@localhost:5432/vigilanza_turni
+SESSION_SECRET=$(openssl rand -base64 32)
+REPLIT_DOMAINS=vigilanza.tuodominio.it
+```
+
+### 5.2 Configurazione Nginx
+
+```bash
+# Copia configurazione Nginx
+sudo cp /var/www/vigilanza-turni/deploy/nginx.conf /etc/nginx/conf.d/vigilanza-turni.conf
+
+# Modifica con il tuo dominio
+sudo nano /etc/nginx/conf.d/vigilanza-turni.conf
+# Sostituisci "tuodominio.it" con il tuo dominio
 
 # Test configurazione
 sudo nginx -t
@@ -118,414 +212,210 @@ sudo nginx -t
 sudo systemctl reload nginx
 ```
 
-### 3. SSL Certificate
+### 5.3 Clone Repository Iniziale
-
-```bash
-# Ottieni certificato Let's Encrypt
-sudo certbot --nginx -d vt.alfacom.it
-
-# Auto-renewal (crontab)
-sudo certbot renew --dry-run
-```
-
-### 4. Configurazione Ambiente
 
 ```bash
 cd /var/www/vigilanza-turni
-
+git clone https://git.alfacom.it/marco/VigilanzaTurni.git .
-# Copia template
-cp .env.production.example .env
-
-# Edita .env
-nano .env
 ```
 
-**Recupera password e crea .env:**
+### 5.4 Primo Deploy Manuale
 
 ```bash
-# Recupera password da file sicuro
+bash deploy/deploy.sh
-DB_PASS=$(grep PGPASSWORD /root/.vigilanza_db_password | cut -d= -f2)
-
-# Crea .env con password reale (non shell var)
-cat > .env << EOF
-# Database
-DATABASE_URL=postgresql://vigilanza_user:${DB_PASS}@localhost:5432/vigilanza_turni
-PGHOST=localhost
-PGPORT=5432
-PGDATABASE=vigilanza_turni
-PGUSER=vigilanza_user
-PGPASSWORD=${DB_PASS}
-
-# Session (genera nuovo)
-SESSION_SECRET=$(openssl rand -base64 32)
-
-# Application
-NODE_ENV=production
-PORT=5000
-APP_URL=https://vt.alfacom.it
-
-# Backup
-BACKUP_ENABLED=true
-BACKUP_DIR=/var/backups/vigilanza-turni
-BACKUP_RETENTION_DAYS=30
-
-# Logging
-LOG_LEVEL=info
-EOF
-
-echo "✅ File .env creato con password sicura"
 ```
 
-**Verifica .env creato:**
+Verifica:
 ```bash
-cat .env | grep DATABASE_URL
+pm2 status
-# Deve mostrare password reale, non ${DB_PASS}
+pm2 logs vigilanza-turni
 ```
 
 ---
 
-## Deployment
+## 6. Deployment Automatico
 
-### Workflow Semplificato (2 comandi)
+### 6.1 Push da Replit
-
-#### 1. Push da Replit/Local
 
 ```bash
-./push-to-gitlab.sh
+# In Replit Shell
+bash push-to-gitlab.sh
 ```
 
-Questo script:
+### 6.2 Trigger Pipeline GitLab
-- Mostra modifiche da committare
-- Chiede conferma
-- Esegue git add + commit + push
-- Mostra istruzioni deployment
 
-#### 2. Deploy su Server
+1. Vai su GitLab → **CI/CD → Pipelines**
+2. La pipeline parte automaticamente
+3. Clicca su `deploy_production` quando vuoi deployare
+4. Il deploy avviene in ~3-5 minuti
 
-```bash
+### 6.3 Flusso Automatico
-ssh root@vt.alfacom.it "cd /var/www/vigilanza-turni && bash deploy/deploy.sh"
+
+```mermaid
+Replit → Git Push → GitLab → CI/CD Pipeline → Deploy Server
 ```
 
-Lo script `deploy.sh` esegue automaticamente:
+**Stages:**
-
+1. 🏗️ **Build** - Compila TypeScript e Vite
-1. **Backup Database Pre-Deploy**
+2. 🧪 **Test** - Esegue linting
-   - Dump PostgreSQL completo
+3. 🚀 **Deploy** - Deployment su server (manuale)
-   - Compressione gzip
-   - Salvataggio in `/var/backups/vigilanza-turni/`
-   - Pulizia backup > 30 giorni
-
-2. **Pull Modifiche**
-   - Git pull da GitLab
-
-3. **Build Applicazione**
-   - `npm ci` (install deps)
-   - `npm run build` (Vite build)
-   - `npm run db:push` (migrations)
-   - `npm prune --production` (cleanup)
-
-4. **Restart Applicazione**
-   - PM2 reload graceful
-   - Health check
-   - Log output
-
-5. **Rollback Automatico**
-   - Se deploy fallisce, ripristina ultimo backup DB
 
 ---
 
-## Manutenzione
+## 7. Manutenzione
 
-### Gestione PM2
+### 7.1 Monitoring
 
 ```bash
-# Status
+# Status applicazione
 pm2 status
 
 # Logs real-time
 pm2 logs vigilanza-turni
 
-# Logs storici
+# Logs ultimi 100 righe
 pm2 logs vigilanza-turni --lines 100
 
-# Restart
+# Metriche sistema
-pm2 restart vigilanza-turni
-
-# Stop
-pm2 stop vigilanza-turni
-
-# Info applicazione
-pm2 show vigilanza-turni
-
-# Monitoring
 pm2 monit
 ```
 
-### Gestione Database
+### 7.2 Backup Database
 
-**Backup Manuale:**
 ```bash
-# Carica password da file sicuro
+# Backup manuale
-export $(cat /root/.vigilanza_db_password | xargs)
+sudo -u postgres pg_dump vigilanza_turni > backup_$(date +%Y%m%d).sql
 
-BACKUP_FILE="/var/backups/vigilanza-turni/backup_manual_$(date +%Y%m%d_%H%M%S).sql"
+# Restore
-pg_dump -h localhost -U vigilanza_user -d vigilanza_turni > $BACKUP_FILE
+sudo -u postgres psql vigilanza_turni < backup_20250110.sql
-gzip $BACKUP_FILE
-echo "Backup salvato: ${BACKUP_FILE}.gz"
 ```
 
-**Ripristino Backup:**
+### 7.3 Aggiornamenti Sistema
-```bash
-# Carica password da file sicuro
-export $(cat /root/.vigilanza_db_password | xargs)
-
-# Lista backup disponibili
-ls -lht /var/backups/vigilanza-turni/*.gz
-
-# Ripristina specifico backup
-BACKUP_FILE="/var/backups/vigilanza-turni/backup_20250116_143022.sql.gz"
-gunzip -c $BACKUP_FILE | psql -h localhost -U vigilanza_user -d vigilanza_turni
-
-# Restart applicazione
-pm2 restart vigilanza-turni
-```
-
-**Accesso Database:**
-```bash
-# Carica password da file sicuro
-export $(cat /root/.vigilanza_db_password | xargs)
-
-psql -h localhost -U vigilanza_user -d vigilanza_turni
-```
-
-### Log Management
-
-**Nginx Logs:**
-```bash
-# Access log
-tail -f /var/log/nginx/vigilanza-turni-access.log
-
-# Error log
-tail -f /var/log/nginx/vigilanza-turni-error.log
-
-# Analisi traffico
-cat /var/log/nginx/vigilanza-turni-access.log | \
-  awk '{print $1}' | sort | uniq -c | sort -rn | head -10
-```
-
-**PM2 Logs:**
-```bash
-# Real-time
-pm2 logs vigilanza-turni
-
-# Last 50 lines
-pm2 logs vigilanza-turni --lines 50 --nostream
-
-# Flush logs
-pm2 flush vigilanza-turni
-```
-
-### SSL Certificate Renewal
 
 ```bash
-# Test renewal
+# Update AlmaLinux
-sudo certbot renew --dry-run
-
-# Force renewal
-sudo certbot renew --force-renewal
-
-# Check expiration
-sudo certbot certificates
-```
-
-### System Updates
-
-```bash
-# Update sistema
 sudo dnf update -y
 
 # Update Node.js packages
 cd /var/www/vigilanza-turni
-npm outdated
 npm update
 
-# Rebuild dopo update
+# Restart
-npm run build
 pm2 restart vigilanza-turni
 ```
 
+### 7.4 SSL Certificate Renewal
+
+Certbot rinnova automaticamente, ma puoi forzare:
+
+```bash
+sudo certbot renew --dry-run  # Test
+sudo certbot renew            # Rinnovo reale
+sudo systemctl reload nginx
+```
+
 ---
 
-## Troubleshooting
+## 8. Troubleshooting
 
-### Applicazione non Risponde
+### App non risponde
 
 ```bash
-# 1. Check PM2 status
+# Check PM2
 pm2 status
-
-# 2. Check logs
-pm2 logs vigilanza-turni --lines 100
-
-# 3. Restart
 pm2 restart vigilanza-turni
 
-# 4. Check Nginx
+# Check logs
+pm2 logs vigilanza-turni --lines 50
+
+# Check Nginx
 sudo nginx -t
 sudo systemctl status nginx
-sudo systemctl reload nginx
-
-# 5. Check firewall
-sudo firewall-cmd --list-all
 ```
 
-### Errore Database
+### Database Connection Error
 
 ```bash
-# 1. Verifica connessione
+# Verifica PostgreSQL
-export $(cat /root/.vigilanza_db_password | xargs)
-psql -h localhost -U vigilanza_user -d vigilanza_turni -c "SELECT version();"
-
-# 2. Check PostgreSQL
 sudo systemctl status postgresql
-sudo tail -f /var/lib/pgsql/data/log/postgresql-*.log
+sudo -u postgres psql -c "SELECT version();"
 
-# 3. Restart PostgreSQL
+# Test connessione
-sudo systemctl restart postgresql
+psql "postgresql://vigilanza_user:password@localhost:5432/vigilanza_turni" -c "SELECT NOW();"
-
-# 4. Verifica .env
-cat /var/www/vigilanza-turni/.env | grep DATABASE_URL
 ```
 
-### Build Fallito
+### SSL Certificate Issues
 
 ```bash
-# 1. Clean build
+# Test SSL
-cd /var/www/vigilanza-turni
-rm -rf node_modules dist
-
-# 2. Reinstall
-npm ci
-
-# 3. Rebuild
-npm run build
-
-# 4. Check errors
-npm run build 2>&1 | tee build.log
-
-# 5. Restart
-pm2 restart vigilanza-turni
-```
-
-### SSL Issues
-
-```bash
-# 1. Check certificate
 sudo certbot certificates
 
-# 2. Renew certificate
+# Rinnovo manuale
 sudo certbot renew --force-renewal
-
-# 3. Reload Nginx
 sudo systemctl reload nginx
-
-# 4. Check SSL config
-sudo nginx -t
 ```
 
-### Performance Issues
+### Rollback Emergenza
+
+In GitLab → CI/CD → Pipelines → clicca su "rollback"
+
+Oppure manuale:
 
 ```bash
-# 1. Check server resources
-htop
-df -h
-free -m
-
-# 2. PM2 monitoring
-pm2 monit
-
-# 3. Nginx access log analysis
-sudo tail -f /var/log/nginx/vigilanza-turni-access.log
-
-# 4. Database performance
-export $(cat /root/.vigilanza_db_password | xargs)
-psql -h localhost -U vigilanza_user -d vigilanza_turni -c \
-  "SELECT query, calls, mean_exec_time FROM pg_stat_statements ORDER BY mean_exec_time DESC LIMIT 10;"
-```
-
-### Rollback Completo
-
-```bash
-# 1. Stop applicazione
-pm2 stop vigilanza-turni
-
-# 2. Ripristina database
-export $(cat /root/.vigilanza_db_password | xargs)
-BACKUP_FILE=$(ls -t /var/backups/vigilanza-turni/*.gz | head -1)
-gunzip -c $BACKUP_FILE | psql -h localhost -U vigilanza_user -d vigilanza_turni
-
-# 3. Git rollback
 cd /var/www/vigilanza-turni
 git log --oneline -10  # Trova commit precedente
-git reset --hard <commit-hash>
+git checkout <commit-hash>
-
+bash deploy/deploy.sh
-# 4. Rebuild
-npm ci
-npm run build
-
-# 5. Restart
-pm2 restart vigilanza-turni
 ```
 
 ---
 
-## Checklist Deployment
+## 📞 Supporto
 
-### Pre-Deployment
+### Logs Utili
-- [ ] Backup database eseguito
-- [ ] Test locali passati
-- [ ] Git push completato
-- [ ] Server accessibile
 
-### During Deployment
+```bash
-- [ ] `./push-to-gitlab.sh` eseguito
+# PM2 logs
-- [ ] SSH server funzionante
+pm2 logs vigilanza-turni --lines 200
-- [ ] `bash deploy/deploy.sh` completato senza errori
-- [ ] Health check PM2 OK
 
-### Post-Deployment
+# Nginx logs
-- [ ] Applicazione risponde: https://vt.alfacom.it
+sudo tail -f /var/log/nginx/vigilanza-turni-error.log
+sudo tail -f /var/log/nginx/vigilanza-turni-access.log
+
+# System logs
+sudo journalctl -u nginx -f
+sudo journalctl -xe
+```
+
+### Comandi Rapidi
+
+```bash
+# Restart completo
+pm2 restart vigilanza-turni && sudo systemctl reload nginx
+
+# Deploy forzato
+cd /var/www/vigilanza-turni && git pull && bash deploy/deploy.sh
+
+# Clear cache PM2
+pm2 delete vigilanza-turni
+pm2 start npm --name vigilanza-turni -- start
+pm2 save
+```
+
+---
+
+## ✅ Checklist Post-Deployment
+
+- [ ] Applicazione accessibile su https://tuodominio.it
+- [ ] SSL certificate valido (lucchetto verde)
 - [ ] Login funzionante
-- [ ] Database accessibile
+- [ ] Database connesso
-- [ ] Logs puliti (no errori)
+- [ ] Logs puliti (no errori critici)
-- [ ] SSL certificate valido
+- [ ] PM2 status: online
+- [ ] Backup database configurato
+- [ ] Monitoring attivo
 
 ---
 
-## Sicurezza
+**Ultima modifica:** 2025-10-11  
-
+**Versione:** 1.0
-### Best Practices
-1. ✅ SSL/TLS sempre attivo
-2. ✅ Firewall configurato
-3. ✅ Password database sicura
-4. ✅ Backup automatici attivi
-5. ✅ Logs monitorati
-6. ✅ Sistema aggiornato regolarmente
-
-### Hardening Suggerito
-- Fail2ban per brute-force protection
-- SSH key-only authentication
-- Database backup off-site
-- Monitoring con Prometheus/Grafana
-- Alert via email/Telegram
-
----
-
-## Contatti
-
-**Support:** Marco Alfacom  
-**Repository:** https://git.alfacom.it/marco/VigilanzaTurni  
-**Production:** https://vt.alfacom.it
-
----
-
-**Ultima revisione:** Ottobre 2025

QUICKSTART-DEPLOYMENT.md

@@ -1,101 +1,105 @@
 # 🚀 Quick Start - Deployment VigilanzaTurni
 
-Guida rapida per deployment: Replit → GitLab → vt.alfacom.it
+Guida rapida per deployment da Replit → GitLab → Server AlmaLinux 9
 
 ## 📝 Checklist Pre-Deployment
 
 - [ ] Server AlmaLinux 9 disponibile (min 2GB RAM)
-- [ ] Dominio vt.alfacom.it configurato
+- [ ] Dominio configurato (es. vigilanza.tuodominio.it)
-- [ ] Account GitLab
+- [ ] Account GitLab su git.alfacom.it
 - [ ] SSH access al server
 
 ---
 
-## ⚡ Setup Iniziale (15 minuti)
+## ⚡ Setup Rapido (15 minuti)
 
 ### 1️⃣ Setup Server (5 min)
 
 ```bash
 # SSH nel server
-ssh root@vt.alfacom.it
+ssh root@ip-del-server
 
-# Clone repository
+# Download e esegui setup automatico
-cd /var/www
+curl -o setup.sh https://git.alfacom.it/marco/VigilanzaTurni/-/raw/main/deploy/setup-server.sh
-git clone https://git.alfacom.it/marco/VigilanzaTurni.git vigilanza-turni
+chmod +x setup.sh
-cd vigilanza-turni
+sudo bash setup.sh
 
-# Esegui setup automatico
+# ⚠️ IMPORTANTE: Salva la password PostgreSQL mostrata!
-sudo bash deploy/setup-server.sh
 ```
 
-Lo script installa automaticamente:
+### 2️⃣ Configura GitLab CI/CD (3 min)
-- Node.js 20
-- PostgreSQL 15 (password autogenerata)
-- PM2
-- Nginx
-- Certbot (SSL)
 
-⚠️ **Password DB salvata in:** `/root/.vigilanza_db_password`
+**Genera SSH Key:**
+```bash
+# Sul tuo PC
+ssh-keygen -t ed25519 -C "gitlab-deploy" -f ~/.ssh/gitlab-deploy
+ssh-copy-id -i ~/.ssh/gitlab-deploy.pub root@ip-del-server
+cat ~/.ssh/gitlab-deploy  # Copia output
+```
 
-### 2️⃣ Configura Nginx (2 min)
+**GitLab → Settings → CI/CD → Variables:**
+
+| Nome | Valore |
+|------|--------|
+| `SSH_PRIVATE_KEY` | [chiave privata copiata sopra] |
+| `DEPLOY_HOST` | ip-del-server |
+| `DEPLOY_USER` | root |
+| `DEPLOY_DOMAIN` | vigilanza.tuodominio.it |
+
+### 3️⃣ Configura Replit (2 min)
 
 ```bash
-# Copia configurazione Nginx
+# In Replit Shell
+git remote add production https://git.alfacom.it/marco/VigilanzaTurni.git
+
+# Crea Personal Access Token su GitLab e salvalo in Replit Secrets
+# GitLab → User Settings → Access Tokens → write_repository
+```
+
+### 4️⃣ Configura Server .env (3 min)
+
+```bash
+# Sul server
+cd /var/www/vigilanza-turni
+
+# Clone iniziale
+git clone https://git.alfacom.it/marco/VigilanzaTurni.git .
+
+# Crea .env
+cp .env.production.example .env
+nano .env
+```
+
+**Inserisci:**
+```bash
+# Password DB dal setup (vedi /root/.vigilanza_db_password)
+DATABASE_URL=postgresql://vigilanza_user:PASSWORD_GENERATA@localhost:5432/vigilanza_turni
+SESSION_SECRET=$(openssl rand -base64 32)
+REPLIT_DOMAINS=vigilanza.tuodominio.it
+```
+
+### 5️⃣ Nginx e SSL (2 min)
+
+```bash
+# Copia config Nginx
 sudo cp deploy/nginx.conf /etc/nginx/conf.d/vigilanza-turni.conf
 
+# Modifica con il tuo dominio
+sudo nano /etc/nginx/conf.d/vigilanza-turni.conf
+# Sostituisci "tuodominio.it" → "vigilanza.tuodominio.it"
+
 # Test e reload
 sudo nginx -t
 sudo systemctl reload nginx
 
 # SSL Certificate
-sudo certbot --nginx -d vt.alfacom.it
+sudo certbot --nginx -d vigilanza.tuodominio.it
 ```
 
-### 3️⃣ Configura .env (2 min)
+### 6️⃣ Primo Deploy (1 min)
-
-```bash
-cd /var/www/vigilanza-turni
-
-# Recupera password DB da file sicuro
-DB_PASS=$(grep PGPASSWORD /root/.vigilanza_db_password | cut -d= -f2)
-SESSION_SECRET=$(openssl rand -base64 32)
-
-# Crea .env con valori reali (no shell variables)
-cat > .env << EOF
-# Database
-DATABASE_URL=postgresql://vigilanza_user:${DB_PASS}@localhost:5432/vigilanza_turni
-PGHOST=localhost
-PGPORT=5432
-PGDATABASE=vigilanza_turni
-PGUSER=vigilanza_user
-PGPASSWORD=${DB_PASS}
-
-# Session
-SESSION_SECRET=${SESSION_SECRET}
-
-# Application
-NODE_ENV=production
-PORT=5000
-APP_URL=https://vt.alfacom.it
-
-# Backup
-BACKUP_ENABLED=true
-BACKUP_DIR=/var/backups/vigilanza-turni
-LOG_LEVEL=info
-EOF
-
-echo "✅ File .env creato"
-```
-
-**Verifica:**
-```bash
-cat .env | grep DATABASE_URL
-# Deve mostrare password reale, non variabili shell
-```
-
-### 4️⃣ Primo Deploy (2 min)
 
 ```bash
+# Sul server
 cd /var/www/vigilanza-turni
 bash deploy/deploy.sh
 ```
@@ -104,26 +108,19 @@ bash deploy/deploy.sh
 
 ## 🔄 Workflow Quotidiano
 
-### Deploy in 2 Comandi
+### Da Replit → Produzione
-
-**Da Replit o locale:**
 
 ```bash
-# 1. Push a GitLab
+# 1. Fai modifiche in Replit
-./push-to-gitlab.sh
+# 2. Push a GitLab
+bash push-to-gitlab.sh
 
-# 2. Sul server: Deploy
+# 3. Vai su GitLab
-ssh root@vt.alfacom.it "cd /var/www/vigilanza-turni && bash deploy/deploy.sh"
+https://git.alfacom.it/marco/VigilanzaTurni/-/pipelines
+
+# 4. Clicca su "deploy_production" quando pronto
 ```
 
-**Il deploy automaticamente:**
-- ✅ Esegue backup database
-- ✅ Pull ultime modifiche da GitLab
-- ✅ Build frontend Vite
-- ✅ Esegue migrations database
-- ✅ Restart applicazione PM2
-- ✅ Health check
-
 ---
 
 ## 📊 Comandi Utili
@@ -138,59 +135,38 @@ pm2 logs vigilanza-turni
 # Restart
 pm2 restart vigilanza-turni
 
-# Verifica backup
+# Backup database
-ls -lht /var/backups/vigilanza-turni/
+sudo -u postgres pg_dump vigilanza_turni > backup_$(date +%Y%m%d).sql
-
-# Ripristina backup (usa password da file)
-export $(cat /root/.vigilanza_db_password | xargs)
-gunzip -c /var/backups/vigilanza-turni/backup_20250116_143022.sql.gz | \
-  psql -h localhost -U vigilanza_user -d vigilanza_turni
 ```
 
 ---
 
-## 🆘 Troubleshooting
+## 🆘 Problemi Comuni
 
 **App non risponde:**
 ```bash
 pm2 restart vigilanza-turni
-pm2 logs vigilanza-turni --lines 50
 sudo systemctl reload nginx
 ```
 
 **Errore database:**
 ```bash
-# Verifica connessione (usa password da file)
+# Verifica password in .env corrisponde a quella in /root/.vigilanza_db_password
-export $(cat /root/.vigilanza_db_password | xargs)
+cat /root/.vigilanza_db_password
-psql -h localhost -U vigilanza_user -d vigilanza_turni -c "SELECT version();"
 ```
 
-**Build fallito:**
+**SSL scaduto:**
 ```bash
-cd /var/www/vigilanza-turni
+sudo certbot renew
-rm -rf node_modules dist
+sudo systemctl reload nginx
-npm ci
-npm run build
-pm2 restart vigilanza-turni
 ```
 
 ---
 
-## 🌐 Accesso
+## 📚 Documentazione Completa
 
-**Applicazione:** https://vt.alfacom.it
+Per dettagli completi: [DEPLOYMENT.md](./DEPLOYMENT.md)
-
-**Backup automatici:** 
-- Directory: `/var/backups/vigilanza-turni/`
-- Retention: 30 giorni
-- Formato: `backup_YYYYMMDD_HHMMSS.sql.gz`
 
 ---
 
-## 📚 File Importanti
+**Setup completato?** ✅ Vai su https://vigilanza.tuodominio.it
-
-- `deploy/deploy.sh` - Script deployment automatico
-- `deploy/setup-server.sh` - Setup iniziale server
-- `deploy/nginx.conf` - Configurazione reverse proxy
-- `.env` - Variabili ambiente produzione
-- `push-to-gitlab.sh` - Helper push GitLab

attached_assets/Pasted--workspace-push-to-gitlab-sh-Push-to-GitLab-vt-alfacom-it--1760612848127_1760612848127.txt

@@ -1,46 +0,0 @@
- 
-~/workspace$ ./push-to-gitlab.sh
-🚀 Push to GitLab (vt.alfacom.it)
-========================================
-
-📋 Modifiche da committare:
- M .replit
- M push-to-gitlab.sh
-Vuoi procedere con il push? (y/N) y
-Messaggio commit personalizzato (Enter per default): 
-
-📦 Git add...
-💾 Git commit...
-On branch main
-nothing to commit, working tree clean
-~/workspace$ git add .
-~/workspace$ git commit -m "Deploy: $(date '+%Y-%m-%d %H:%M:%S')"
-On branch main
-nothing to commit, working tree clean
-~/workspace$ git push production main
-error: unable to read askpass response from 'replit-git-askpass'
-Username for 'https://git.alfacom.it': marco@lanzara.eu
-error: unable to read askpass response from 'replit-git-askpass'
-Password for 'https://marco%40lanzara.eu@git.alfacom.it': 
-To https://git.alfacom.it/marco/VigilanzaTurni.git
- ! [rejected]        main -> main (fetch first)
-error: failed to push some refs to 'https://git.alfacom.it/marco/VigilanzaTurni.git'
-hint: Updates were rejected because the remote contains work that you do not
-hint: have locally. This is usually caused by another repository pushing to
-hint: the same ref. If you want to integrate the remote changes, use
-hint: 'git pull' before pushing again.
-hint: See the 'Note about fast-forwards' in 'git push --help' for details.
-~/workspace$ git push production main
-error: unable to read askpass response from 'replit-git-askpass'
-Username for 'https://git.alfacom.it': marco
-error: unable to read askpass response from 'replit-git-askpass'
-Password for 'https://marco@git.alfacom.it': 
-To https://git.alfacom.it/marco/VigilanzaTurni.git
- ! [rejected]        main -> main (fetch first)
-error: failed to push some refs to 'https://git.alfacom.it/marco/VigilanzaTurni.git'
-hint: Updates were rejected because the remote contains work that you do not
-hint: have locally. This is usually caused by another repository pushing to
-hint: the same ref. If you want to integrate the remote changes, use
-hint: 'git pull' before pushing again.
-hint: See the 'Note about fast-forwards' in 'git push --help' for details.
-~/workspace$ 

deploy/deploy.sh

@@ -2,50 +2,19 @@
 set -e
 
 # Script di deployment automatico per VigilanzaTurni
-# Uso: bash deploy/deploy.sh
+# Eseguito da GitLab CI/CD Runner
 
 APP_DIR="/var/www/vigilanza-turni"
 APP_NAME="vigilanza-turni"
-BACKUP_DIR="/var/backups/vigilanza-turni"
 
 echo "🚀 Deployment VigilanzaTurni - $(date)"
 
 # Vai alla directory applicazione
 cd $APP_DIR
 
-# Pull ultime modifiche (se eseguito manualmente)
+# Pull ultime modifiche (già fatto da GitLab Runner)
-if [ -d .git ]; then
+echo "📦 Repository aggiornato"
-    echo "📥 Pull ultime modifiche da GitLab..."
-    git pull origin main || true
-fi
 
-# =================== BACKUP DATABASE ===================
-echo "💾 Backup database pre-deployment..."
-mkdir -p $BACKUP_DIR
-BACKUP_FILE="$BACKUP_DIR/backup_$(date +%Y%m%d_%H%M%S).sql"
-
-# Load env vars
-if [ -f .env ]; then
-    export $(cat .env | grep -v '^#' | xargs)
-fi
-
-# Esegui backup PostgreSQL
-if command -v pg_dump &> /dev/null; then
-    PGPASSWORD=$PGPASSWORD pg_dump -h $PGHOST -U $PGUSER -d $PGDATABASE > $BACKUP_FILE
-    echo "✅ Backup salvato: $BACKUP_FILE"
-    
-    # Comprimi backup
-    gzip $BACKUP_FILE
-    echo "✅ Backup compresso: ${BACKUP_FILE}.gz"
-    
-    # Pulisci backup vecchi (> 30 giorni)
-    find $BACKUP_DIR -name "backup_*.sql.gz" -mtime +30 -delete
-    echo "🧹 Backup vecchi eliminati (retention: 30 giorni)"
-else
-    echo "⚠️  pg_dump non trovato, skip backup"
-fi
-
-# =================== BUILD & DEPLOY ===================
 # Installa TUTTE le dipendenze (serve per build e migrations)
 echo "📥 Installazione dipendenze (include devDependencies)..."
 npm ci
@@ -63,7 +32,6 @@ npm run db:push || true
 echo "🧹 Pulizia devDependencies (mantiene solo production)..."
 npm prune --production
 
-# =================== RESTART APPLICATION ===================
 # Restart applicazione con PM2
 echo "🔄 Restart applicazione..."
 if pm2 show $APP_NAME > /dev/null 2>&1; then
@@ -82,27 +50,8 @@ if pm2 show $APP_NAME | grep -q "online"; then
 else
     echo "❌ Errore: applicazione non online"
     pm2 logs $APP_NAME --lines 50 --nostream
-    
-    # Rollback: ripristina ultimo backup
-    echo "🔄 Tentativo rollback backup..."
-    LATEST_BACKUP=$(ls -t $BACKUP_DIR/backup_*.sql.gz 2>/dev/null | head -1)
-    if [ -f "$LATEST_BACKUP" ]; then
-        echo "📦 Ripristino da: $LATEST_BACKUP"
-        gunzip -c $LATEST_BACKUP | PGPASSWORD=$PGPASSWORD psql -h $PGHOST -U $PGUSER -d $PGDATABASE
-        echo "✅ Database ripristinato"
-    fi
-    
     exit 1
 fi
 
-# =================== STATUS ===================
-echo ""
 echo "📊 Status PM2:"
 pm2 status
-
-echo ""
-echo "📈 Ultimi backup disponibili:"
-ls -lht $BACKUP_DIR/*.gz 2>/dev/null | head -5 || echo "Nessun backup trovato"
-
-echo ""
-echo "🌐 Applicazione disponibile su: https://vt.alfacom.it"

deploy/nginx.conf

@@ -10,7 +10,7 @@ upstream vigilanza_backend {
 server {
     listen 80;
     listen [::]:80;
-    server_name vt.alfacom.it;
+    server_name tuodominio.it www.tuodominio.it;
 
     # Let's Encrypt challenge
     location /.well-known/acme-challenge/ {
@@ -26,11 +26,11 @@ server {
 server {
     listen 443 ssl http2;
     listen [::]:443 ssl http2;
-    server_name vt.alfacom.it;
+    server_name tuodominio.it www.tuodominio.it;
 
     # SSL Certificate (generato da certbot)
-    ssl_certificate /etc/letsencrypt/live/vt.alfacom.it/fullchain.pem;
+    ssl_certificate /etc/letsencrypt/live/tuodominio.it/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/vt.alfacom.it/privkey.pem;
+    ssl_certificate_key /etc/letsencrypt/live/tuodominio.it/privkey.pem;
 
     # SSL Security
     ssl_protocols TLSv1.2 TLSv1.3;

deploy/setup-server.sh

@@ -1,140 +0,0 @@
-#!/bin/bash
-# Setup automatico server AlmaLinux 9 per VigilanzaTurni
-# Esegui: sudo bash deploy/setup-server.sh
-
-set -e
-
-# Colori output
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-NC='\033[0m'
-
-log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
-log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
-log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
-
-# Verifica root
-if [ "$EUID" -ne 0 ]; then 
-    log_error "Esegui come root: sudo bash $0"
-    exit 1
-fi
-
-log_info "🚀 Setup server AlmaLinux 9 per VigilanzaTurni"
-log_info "Dominio: vt.alfacom.it"
-
-# =================== SYSTEM UPDATE ===================
-log_info "Aggiornamento sistema..."
-dnf update -y
-
-# =================== NODE.JS ===================
-log_info "Installazione Node.js 20..."
-dnf module reset nodejs -y
-dnf module enable nodejs:20 -y
-dnf install nodejs -y
-node --version
-npm --version
-
-# =================== PM2 ===================
-log_info "Installazione PM2..."
-npm install -g pm2
-pm2 startup systemd -u root --hp /root
-systemctl enable pm2-root
-
-# =================== POSTGRESQL ===================
-log_info "Installazione PostgreSQL 15..."
-<<<<<<< HEAD
-dnf install -y postgresql15-server postgresql15
-
-# Inizializza database
-postgresql-setup --initdb
-systemctl enable postgresql
-systemctl start postgresql
-=======
-dnf install -y postgresql15-server postgresql15-contrib
-postgresql-15-setup --initdb
-systemctl enable postgresql-15
-systemctl start postgresql-15
->>>>>>> 94bec4cfd683fe846be466cbfba0a57786d95c2a
-
-# Genera password sicura PostgreSQL (o usa variabile ambiente)
-if [ -z "$DB_PASSWORD" ]; then
-    DB_PASSWORD=$(openssl rand -base64 32 | tr -d "=+/" | cut -c1-25)
-    log_warn "Password PostgreSQL generata automaticamente"
-else
-    log_info "Uso password PostgreSQL da variabile DB_PASSWORD"
-fi
-
-# Creazione database e utente
-log_info "Configurazione database..."
-sudo -u postgres psql << EOF
-CREATE DATABASE vigilanza_turni;
-CREATE USER vigilanza_user WITH ENCRYPTED PASSWORD '${DB_PASSWORD}';
-GRANT ALL PRIVILEGES ON DATABASE vigilanza_turni TO vigilanza_user;
-\c vigilanza_turni
-GRANT ALL ON SCHEMA public TO vigilanza_user;
-EOF
-
-# Salva password in file sicuro
-echo "PGPASSWORD=${DB_PASSWORD}" > /root/.vigilanza_db_password
-chmod 600 /root/.vigilanza_db_password
-log_info "✅ Database configurato - Password salvata in /root/.vigilanza_db_password"
-
-# Configurazione PostgreSQL per connessioni locali
-log_info "Configurazione autenticazione PostgreSQL..."
-PG_HBA="/var/lib/pgsql/data/pg_hba.conf"
-if ! grep -q "vigilanza_user" $PG_HBA; then
-    echo "local   vigilanza_turni    vigilanza_user                    md5" >> $PG_HBA
-    echo "host    vigilanza_turni    vigilanza_user    127.0.0.1/32    md5" >> $PG_HBA
-    systemctl restart postgresql
-fi
-
-# =================== NGINX ===================
-log_info "Installazione Nginx..."
-dnf install -y nginx
-systemctl enable nginx
-systemctl start nginx
-
-# =================== GIT ===================
-log_info "Installazione Git..."
-dnf install -y git
-
-# =================== DIRECTORY APPLICAZIONE ===================
-log_info "Creazione directory applicazione..."
-mkdir -p /var/www/vigilanza-turni
-mkdir -p /var/backups/vigilanza-turni
-chmod 755 /var/www/vigilanza-turni
-chmod 700 /var/backups/vigilanza-turni
-
-# =================== FIREWALL ===================
-log_info "Configurazione firewall..."
-systemctl enable firewalld
-systemctl start firewalld
-firewall-cmd --permanent --add-service=http
-firewall-cmd --permanent --add-service=https
-firewall-cmd --reload
-
-# =================== SSL CERTIFICATE (Let's Encrypt) ===================
-log_info "Installazione Certbot per SSL..."
-dnf install -y certbot python3-certbot-nginx
-
-log_info ""
-log_info "================================================"
-log_info "Setup completato con successo!"
-log_info "================================================"
-log_info ""
-log_warn "PROSSIMI PASSI:"
-echo "1. Copia deploy/nginx.conf → /etc/nginx/conf.d/vigilanza-turni.conf"
-echo "2. Clone repository: cd /var/www/vigilanza-turni && git clone <repo-url> ."
-echo "3. Crea file .env con DATABASE_URL (password già configurata)"
-echo "4. Ottieni certificato SSL: sudo certbot --nginx -d vt.alfacom.it"
-echo "5. Esegui primo deploy: bash deploy/deploy.sh"
-echo ""
-log_warn "⚠️  IMPORTANTE - Password PostgreSQL:"
-echo "Salvata in: /root/.vigilanza_db_password"
-echo ""
-log_info "DATABASE_URL per .env:"
-echo "postgresql://vigilanza_user:PASSWORD_DA_FILE@localhost:5432/vigilanza_turni"
-echo ""
-echo "Recupera password con:"
-echo "  cat /root/.vigilanza_db_password"

push-to-gitlab.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Script per push automatico verso GitLab
+# Script helper per push automatico verso GitLab da Replit
 
 set -e
 
@@ -9,17 +9,9 @@ YELLOW='\033[1;33m'
 RED='\033[0;31m'
 NC='\033[0m'
 
-echo -e "${GREEN}🚀 Push to GitLab (vt.alfacom.it)${NC}"
+echo -e "${GREEN}🚀 Push to GitLab Production${NC}"
 echo "========================================"
 
-# Verifica remote GitLab
-if ! git remote | grep -q "production"; then
-    echo -e "${YELLOW}⚠️  Remote 'production' non configurato${NC}"
-    echo "Configurazione remote GitLab..."
-    read -p "URL repository GitLab: " GITLAB_URL
-    git remote add production $GITLAB_URL
-fi
-
 # Verifica se ci sono modifiche
 if [[ -z $(git status -s) ]]; then
     echo -e "${YELLOW}⚠️  Nessuna modifica da committare${NC}"
@@ -56,20 +48,12 @@ echo -e "${GREEN}💾 Git commit...${NC}"
 git commit -m "$COMMIT_MSG"
 
 echo -e "${GREEN}📤 Git push to production...${NC}"
-
-# Pull prima di pushare per evitare conflitti
-echo -e "${YELLOW}Sincronizzazione con remote...${NC}"
-git pull production main --no-rebase || echo -e "${YELLOW}⚠️  Potrebbero esserci conflitti da risolvere${NC}"
-
 git push production main
 
 echo -e "\n${GREEN}✅ Push completato!${NC}"
 echo "========================================"
-echo -e "${YELLOW}Deployment automatico disponibile:${NC}"
+echo -e "${YELLOW}Prossimi passi:${NC}"
-echo ""
+echo "1. Vai su GitLab: https://git.alfacom.it/marco/VigilanzaTurni/-/pipelines"
-echo "Sul server esegui:"
+echo "2. La pipeline CI/CD partirà automaticamente"
-echo -e "${GREEN}  cd /var/www/vigilanza-turni${NC}"
+echo "3. Clicca su 'deploy_production' per deployare su server"
-echo -e "${GREEN}  bash deploy/deploy.sh${NC}"
-echo ""
-echo "🌐 Sito: https://vt.alfacom.it"
 echo ""

replit.md

@@ -315,50 +315,38 @@ All interactive elements have `data-testid` attributes for automated testing.
 - **Sistema Deployment Automatico** ✅:
   - Pipeline CI/CD GitLab (.gitlab-ci.yml) con stages build/test/deploy
   - Script setup server AlmaLinux 9 (deploy/setup-server.sh)
-  - Script deployment automatico con backup DB (deploy/deploy.sh)
+  - Script deployment automatico (deploy/deploy.sh)
   - Configurazione Nginx reverse proxy con SSL
-  - Workflow semplificato: 2 comandi (push + deploy)
+  - Password PostgreSQL autogenerata (sicurezza)
-  - Backup automatico database pre-deploy (retention 30 giorni)
+  - Workflow: Replit → GitLab → CI/CD → Server produzione
-  - Rollback automatico su errore deployment
-  - Dominio produzione: vt.alfacom.it
   - Documentazione completa (DEPLOYMENT.md, QUICKSTART-DEPLOYMENT.md)
-  - Helper script push-to-gitlab.sh
+  - Helper script push-to-gitlab.sh per deployment rapido
 
 ## Deployment
 
 ### Setup Produzione
-Sistema deployment automatico su vt.alfacom.it (AlmaLinux 9):
+Il sistema supporta deployment automatico su server AlmaLinux 9 tramite GitLab CI/CD:
 
-**Workflow Semplificato (2 comandi):**
+**Workflow Deployment:**
-```bash
+```
-# 1. Push da Replit
+Replit (modifiche) → Git Push → GitLab CI/CD → Deploy Server
-./push-to-gitlab.sh
-
-# 2. Deploy su server
-ssh root@vt.alfacom.it "cd /var/www/vigilanza-turni && bash deploy/deploy.sh"
 ```
 
 **File Deployment:**
 - `.gitlab-ci.yml` - Pipeline CI/CD (build, test, deploy, rollback)
 - `deploy/setup-server.sh` - Setup iniziale server (Node, PostgreSQL, Nginx, PM2)
-- `deploy/deploy.sh` - Script deployment automatico con backup DB
+- `deploy/deploy.sh` - Script deployment automatico
-- `deploy/nginx.conf` - Configurazione Nginx per vt.alfacom.it
+- `deploy/nginx.conf` - Configurazione reverse proxy
-- `.env.production.example` - Template variabili ambiente
+- `.env.production.example` - Template variabili ambiente produzione
-- `push-to-gitlab.sh` - Helper push GitLab
 
-**Funzionalità Deploy:**
+**Documentazione:**
-- ✅ Backup automatico database pre-deploy
+- `DEPLOYMENT.md` - Guida completa step-by-step
-- ✅ Build frontend Vite + migrations DB
+- `QUICKSTART-DEPLOYMENT.md` - Setup rapido 15 minuti
-- ✅ Restart graceful PM2
-- ✅ Health check post-deploy
-- ✅ Rollback automatico su errore
-- ✅ Retention backup: 30 giorni
 
 **Security:**
-- Password PostgreSQL sicura (non hard-coded)
+- Password PostgreSQL autogenerata (non hard-coded)
-- SSL/TLS con Let's Encrypt (vt.alfacom.it)
+- SSL/TLS con Let's Encrypt
-- Firewall configurato (HTTP/HTTPS only)
+- Firewall configurato automaticamente
-- Backup compressi in /var/backups/vigilanza-turni/
 
 ## Future Enhancements