Merge: resolve conflict in deploy/setup-server.sh keeping local version

Add a git pull before pushing to production to synchronize remote changes and avoid conflicts.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 42d8028a-fa71-4ec2-938c-e43eedf7df01
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/6d543d2c-20b9-4ea6-93fe-70fe9b1d9f80/42d8028a-fa71-4ec2-938c-e43eedf7df01/aazyBOE

.env.production.example

@@ -13,20 +13,21 @@ PGPASSWORD=YOUR_SECURE_PASSWORD
 # Genera con: openssl rand -base64 32
 SESSION_SECRET=YOUR_RANDOM_SESSION_SECRET_HERE
 
-# =================== REPLIT AUTH (Produzione) ===================
-# Configurazione OIDC per autenticazione
-ISSUER_URL=https://replit.com/oidc
-REPL_ID=your-repl-id-here
-REPLIT_DOMAINS=tuodominio.it,www.tuodominio.it
+# =================== AUTHENTICATION ===================
+# Configurazione OIDC (senza Replit)
+ISSUER_URL=https://auth.vt.alfacom.it/oidc
+CLIENT_ID=vigilanza-turni
+CLIENT_SECRET=YOUR_OIDC_CLIENT_SECRET
 
-# =================== NODE ENVIRONMENT ===================
+# =================== APPLICATION ===================
 NODE_ENV=production
 PORT=5000
+APP_URL=https://vt.alfacom.it
 
-# =================== LOGGING (opzionale) ===================
+# =================== BACKUP ===================
+BACKUP_ENABLED=true
+BACKUP_DIR=/var/backups/vigilanza-turni
+BACKUP_RETENTION_DAYS=30
+
+# =================== LOGGING ===================
 LOG_LEVEL=info
-
-# =================== BACKUP (opzionale) ===================
-# BACKUP_ENABLED=true
-# BACKUP_SCHEDULE="0 2 * * *"  # Daily at 2 AM
-# BACKUP_RETENTION_DAYS=30

.replit

@@ -4,7 +4,7 @@ hidden = [".config", ".git", "generated-icon.png", "node_modules", "dist"]
 
 [nix]
 channel = "stable-24_05"
-packages = ["nano"]
+packages = ["nano", "zip", "openssh"]
 
 [deployment]
 deploymentTarget = "autoscale"

DEPLOYMENT.md

@@ -1,209 +1,115 @@
-# 🚀 Guida Deployment VigilanzaTurni
+# 📘 Deployment Guide - VigilanzaTurni
 
-Deployment automatico da Replit → GitLab → Server AlmaLinux 9
+Guida completa deployment sistema VigilanzaTurni su vt.alfacom.it
+
+---
 
 ## 📋 Indice
 
-1. [Prerequisiti](#prerequisiti)
-2. [Setup Iniziale Server](#setup-iniziale-server)
-3. [Configurazione GitLab](#configurazione-gitlab)
-4. [Configurazione Replit](#configurazione-replit)
-5. [Primo Deployment](#primo-deployment)
-6. [Deployment Automatico](#deployment-automatico)
-7. [Manutenzione](#manutenzione)
-8. [Troubleshooting](#troubleshooting)
+1. [Overview](#overview)
+2. [Prerequisiti](#prerequisiti)
+3. [Setup Iniziale](#setup-iniziale)
+4. [Configurazione](#configurazione)
+5. [Deployment](#deployment)
+6. [Manutenzione](#manutenzione)
+7. [Troubleshooting](#troubleshooting)
 
 ---
 
-## 1. Prerequisiti
+## Overview
 
-### Server AlmaLinux 9
-- Server con accesso root/sudo
-- Almeno 2GB RAM
-- 20GB storage
-- Indirizzo IP pubblico
-- Dominio configurato (es. vigilanza.tuodominio.it)
+**Architettura Deployment:**
+```
+Replit/Local Dev
+    ↓ (git push)
+GitLab Repository
+    ↓ (manual deploy)
+AlmaLinux 9 Server
+    ↓
+https://vt.alfacom.it (Production)
+```
 
-### Account e Accessi
-- Account GitLab su git.alfacom.it
-- SSH access al server
-- Replit account con questo progetto
+**Stack Produzione:**
+- OS: AlmaLinux 9
+- Runtime: Node.js 20
+- Database: PostgreSQL 15
+- Process Manager: PM2
+- Web Server: Nginx (reverse proxy)
+- SSL: Let's Encrypt (Certbot)
 
 ---
 
-## 2. Setup Iniziale Server
+## Prerequisiti
 
-### 2.1 Connessione al Server
+### Server Requirements
+- AlmaLinux 9 (fresh install)
+- Min 2GB RAM, 20GB disk
+- Accesso root SSH
+- Dominio: vt.alfacom.it (DNS configurato)
+
+### Locale Requirements
+- Git installato
+- SSH key configurata
+- Accesso repository GitLab
+
+---
+
+## Setup Iniziale
+
+### 1. Preparazione Server
 
 ```bash
-ssh root@ip-del-tuo-server
+# SSH nel server
+ssh root@vt.alfacom.it
+
+# Clone repository
+cd /var/www
+git clone https://git.alfacom.it/marco/VigilanzaTurni.git vigilanza-turni
+cd vigilanza-turni
+
+# Esegui setup automatico
+sudo bash deploy/setup-server.sh
 ```
 
-### 2.2 Esecuzione Script Setup
+Lo script `setup-server.sh` installa automaticamente:
 
-```bash
-# Download script setup
-curl -o setup-server.sh https://git.alfacom.it/marco/VigilanzaTurni/-/raw/main/deploy/setup-server.sh
+✅ **Node.js 20**
+- Runtime JavaScript/TypeScript
+- npm package manager
 
-# Rendi eseguibile
-chmod +x setup-server.sh
-
-# Esegui setup
-sudo bash setup-server.sh
-```
-
-Lo script installerà:
-- ✅ Node.js 20 LTS
-- ✅ PostgreSQL 15
-- ✅ PM2 (process manager)
-- ✅ Nginx (reverse proxy)
-- ✅ Git
-- ✅ Firewall configurato
-- ✅ Certbot (per SSL)
-
-### 2.3 Configurazione Database
-
-Lo script crea automaticamente:
-- Database: `vigilanza_turni`
+✅ **PostgreSQL 15**
+- Database relazionale
 - User: `vigilanza_user`
-- Password: **Generata automaticamente** (mostrata a fine setup)
+- Password: **Generata automaticamente** (salvata in `/root/.vigilanza_db_password`)
+- Database: `vigilanza_turni`
 
-⚠️ **IMPORTANTE**: Salva la password mostrata al termine del setup!
+✅ **PM2**
+- Process manager Node.js
+- Auto-restart on crash
+- Log management
+- Startup script
+
+✅ **Nginx**
+- Reverse proxy
+- SSL termination
+- Static files serving
+- Gzip compression
+
+✅ **Git**
+- Version control
+
+✅ **Firewall**
+- HTTP (80) aperto
+- HTTPS (443) aperto
+
+✅ **Certbot**
+- Let's Encrypt SSL certificates
+
+### 2. Configurazione Nginx
 
 ```bash
-# La password è salvata anche in:
-cat /root/.vigilanza_db_password
-
-# Se persa, puoi cambiarla con:
-sudo -u postgres psql
-ALTER USER vigilanza_user WITH PASSWORD 'NuovaPasswordSicura123!';
-\q
-```
-
-### 2.4 Configurazione SSL
-
-```bash
-# Sostituisci tuodominio.it con il tuo dominio
-sudo certbot --nginx -d vigilanza.tuodominio.it
-```
-
-Certbot configurerà automaticamente:
-- Certificato SSL Let's Encrypt
-- Redirect HTTP → HTTPS
-- Auto-rinnovo certificato
-
----
-
-## 3. Configurazione GitLab
-
-### 3.1 Variabili CI/CD
-
-Vai su GitLab: **Settings → CI/CD → Variables**
-
-Aggiungi queste variabili:
-
-| Variabile | Valore | Protected | Masked |
-|-----------|--------|-----------|--------|
-| `SSH_PRIVATE_KEY` | La tua chiave SSH privata | ✅ | ✅ |
-| `DEPLOY_HOST` | IP o hostname del server | ✅ | ❌ |
-| `DEPLOY_USER` | `root` o utente deploy | ✅ | ❌ |
-| `DEPLOY_DOMAIN` | `vigilanza.tuodominio.it` | ✅ | ❌ |
-
-#### Generare SSH Key
-
-```bash
-# Sul tuo computer locale
-ssh-keygen -t ed25519 -C "gitlab-deploy" -f ~/.ssh/gitlab-deploy
-
-# Copia chiave pubblica sul server
-ssh-copy-id -i ~/.ssh/gitlab-deploy.pub root@ip-del-server
-
-# Copia chiave privata (contenuto completo)
-cat ~/.ssh/gitlab-deploy
-# Copia output e incolla in GitLab come SSH_PRIVATE_KEY
-```
-
-### 3.2 Abilitare GitLab Runner
-
-Assicurati che il progetto abbia accesso a un Runner GitLab:
-- Vai su **Settings → CI/CD → Runners**
-- Abilita un Shared Runner o configura un Specific Runner
-
----
-
-## 4. Configurazione Replit
-
-### 4.1 Configurare Git Remote
-
-```bash
-# In Replit Shell
-git remote add production https://git.alfacom.it/marco/VigilanzaTurni.git
-
-# Verifica
-git remote -v
-```
-
-### 4.2 Autenticazione GitLab
-
-Crea Personal Access Token su GitLab:
-1. GitLab → **User Settings → Access Tokens**
-2. Nome: `Replit Deploy`
-3. Scopes: `write_repository`
-4. Copia il token
-
-In Replit, salva token nei Secrets:
-```bash
-# Secrets → Add new secret
-Name: GITLAB_TOKEN
-Value: <il-tuo-token>
-```
-
-### 4.3 Script Push Automatico
-
-Crea file `push-to-gitlab.sh` in Replit:
-
-```bash
-#!/bin/bash
-git add .
-git commit -m "Deploy: $(date '+%Y-%m-%d %H:%M:%S')"
-git push production main
-```
-
----
-
-## 5. Primo Deployment
-
-### 5.1 Configurazione .env Produzione
-
-Sul server:
-
-```bash
-cd /var/www/vigilanza-turni
-cp .env.production.example .env
-nano .env
-```
-
-Configura usando la password PostgreSQL generata durante setup:
-
-```bash
-# Recupera password DB
-DB_PASS=$(grep PGPASSWORD /root/.vigilanza_db_password | cut -d= -f2)
-
-# Configura .env
-DATABASE_URL=postgresql://vigilanza_user:${DB_PASS}@localhost:5432/vigilanza_turni
-SESSION_SECRET=$(openssl rand -base64 32)
-REPLIT_DOMAINS=vigilanza.tuodominio.it
-```
-
-### 5.2 Configurazione Nginx
-
-```bash
-# Copia configurazione Nginx
-sudo cp /var/www/vigilanza-turni/deploy/nginx.conf /etc/nginx/conf.d/vigilanza-turni.conf
-
-# Modifica con il tuo dominio
-sudo nano /etc/nginx/conf.d/vigilanza-turni.conf
-# Sostituisci "tuodominio.it" con il tuo dominio
+# Copia configurazione
+sudo cp deploy/nginx.conf /etc/nginx/conf.d/vigilanza-turni.conf
 
 # Test configurazione
 sudo nginx -t
@@ -212,210 +118,414 @@ sudo nginx -t
 sudo systemctl reload nginx
 ```
 
-### 5.3 Clone Repository Iniziale
+### 3. SSL Certificate
+
+```bash
+# Ottieni certificato Let's Encrypt
+sudo certbot --nginx -d vt.alfacom.it
+
+# Auto-renewal (crontab)
+sudo certbot renew --dry-run
+```
+
+### 4. Configurazione Ambiente
 
 ```bash
 cd /var/www/vigilanza-turni
-git clone https://git.alfacom.it/marco/VigilanzaTurni.git .
+
+# Copia template
+cp .env.production.example .env
+
+# Edita .env
+nano .env
 ```
 
-### 5.4 Primo Deploy Manuale
+**Recupera password e crea .env:**
 
 ```bash
-bash deploy/deploy.sh
+# Recupera password da file sicuro
+DB_PASS=$(grep PGPASSWORD /root/.vigilanza_db_password | cut -d= -f2)
+
+# Crea .env con password reale (non shell var)
+cat > .env << EOF
+# Database
+DATABASE_URL=postgresql://vigilanza_user:${DB_PASS}@localhost:5432/vigilanza_turni
+PGHOST=localhost
+PGPORT=5432
+PGDATABASE=vigilanza_turni
+PGUSER=vigilanza_user
+PGPASSWORD=${DB_PASS}
+
+# Session (genera nuovo)
+SESSION_SECRET=$(openssl rand -base64 32)
+
+# Application
+NODE_ENV=production
+PORT=5000
+APP_URL=https://vt.alfacom.it
+
+# Backup
+BACKUP_ENABLED=true
+BACKUP_DIR=/var/backups/vigilanza-turni
+BACKUP_RETENTION_DAYS=30
+
+# Logging
+LOG_LEVEL=info
+EOF
+
+echo "✅ File .env creato con password sicura"
 ```
 
-Verifica:
+**Verifica .env creato:**
 ```bash
-pm2 status
-pm2 logs vigilanza-turni
+cat .env | grep DATABASE_URL
+# Deve mostrare password reale, non ${DB_PASS}
 ```
 
 ---
 
-## 6. Deployment Automatico
+## Deployment
 
-### 6.1 Push da Replit
+### Workflow Semplificato (2 comandi)
+
+#### 1. Push da Replit/Local
 
 ```bash
-# In Replit Shell
-bash push-to-gitlab.sh
+./push-to-gitlab.sh
 ```
 
-### 6.2 Trigger Pipeline GitLab
+Questo script:
+- Mostra modifiche da committare
+- Chiede conferma
+- Esegue git add + commit + push
+- Mostra istruzioni deployment
 
-1. Vai su GitLab → **CI/CD → Pipelines**
-2. La pipeline parte automaticamente
-3. Clicca su `deploy_production` quando vuoi deployare
-4. Il deploy avviene in ~3-5 minuti
+#### 2. Deploy su Server
 
-### 6.3 Flusso Automatico
-
-```mermaid
-Replit → Git Push → GitLab → CI/CD Pipeline → Deploy Server
+```bash
+ssh root@vt.alfacom.it "cd /var/www/vigilanza-turni && bash deploy/deploy.sh"
 ```
 
-**Stages:**
-1. 🏗️ **Build** - Compila TypeScript e Vite
-2. 🧪 **Test** - Esegue linting
-3. 🚀 **Deploy** - Deployment su server (manuale)
+Lo script `deploy.sh` esegue automaticamente:
+
+1. **Backup Database Pre-Deploy**
+   - Dump PostgreSQL completo
+   - Compressione gzip
+   - Salvataggio in `/var/backups/vigilanza-turni/`
+   - Pulizia backup > 30 giorni
+
+2. **Pull Modifiche**
+   - Git pull da GitLab
+
+3. **Build Applicazione**
+   - `npm ci` (install deps)
+   - `npm run build` (Vite build)
+   - `npm run db:push` (migrations)
+   - `npm prune --production` (cleanup)
+
+4. **Restart Applicazione**
+   - PM2 reload graceful
+   - Health check
+   - Log output
+
+5. **Rollback Automatico**
+   - Se deploy fallisce, ripristina ultimo backup DB
 
 ---
 
-## 7. Manutenzione
+## Manutenzione
 
-### 7.1 Monitoring
+### Gestione PM2
 
 ```bash
-# Status applicazione
+# Status
 pm2 status
 
 # Logs real-time
 pm2 logs vigilanza-turni
 
-# Logs ultimi 100 righe
+# Logs storici
 pm2 logs vigilanza-turni --lines 100
 
-# Metriche sistema
+# Restart
+pm2 restart vigilanza-turni
+
+# Stop
+pm2 stop vigilanza-turni
+
+# Info applicazione
+pm2 show vigilanza-turni
+
+# Monitoring
 pm2 monit
 ```
 
-### 7.2 Backup Database
+### Gestione Database
 
+**Backup Manuale:**
 ```bash
-# Backup manuale
-sudo -u postgres pg_dump vigilanza_turni > backup_$(date +%Y%m%d).sql
+# Carica password da file sicuro
+export $(cat /root/.vigilanza_db_password | xargs)
 
-# Restore
-sudo -u postgres psql vigilanza_turni < backup_20250110.sql
+BACKUP_FILE="/var/backups/vigilanza-turni/backup_manual_$(date +%Y%m%d_%H%M%S).sql"
+pg_dump -h localhost -U vigilanza_user -d vigilanza_turni > $BACKUP_FILE
+gzip $BACKUP_FILE
+echo "Backup salvato: ${BACKUP_FILE}.gz"
 ```
 
-### 7.3 Aggiornamenti Sistema
+**Ripristino Backup:**
+```bash
+# Carica password da file sicuro
+export $(cat /root/.vigilanza_db_password | xargs)
+
+# Lista backup disponibili
+ls -lht /var/backups/vigilanza-turni/*.gz
+
+# Ripristina specifico backup
+BACKUP_FILE="/var/backups/vigilanza-turni/backup_20250116_143022.sql.gz"
+gunzip -c $BACKUP_FILE | psql -h localhost -U vigilanza_user -d vigilanza_turni
+
+# Restart applicazione
+pm2 restart vigilanza-turni
+```
+
+**Accesso Database:**
+```bash
+# Carica password da file sicuro
+export $(cat /root/.vigilanza_db_password | xargs)
+
+psql -h localhost -U vigilanza_user -d vigilanza_turni
+```
+
+### Log Management
+
+**Nginx Logs:**
+```bash
+# Access log
+tail -f /var/log/nginx/vigilanza-turni-access.log
+
+# Error log
+tail -f /var/log/nginx/vigilanza-turni-error.log
+
+# Analisi traffico
+cat /var/log/nginx/vigilanza-turni-access.log | \
+  awk '{print $1}' | sort | uniq -c | sort -rn | head -10
+```
+
+**PM2 Logs:**
+```bash
+# Real-time
+pm2 logs vigilanza-turni
+
+# Last 50 lines
+pm2 logs vigilanza-turni --lines 50 --nostream
+
+# Flush logs
+pm2 flush vigilanza-turni
+```
+
+### SSL Certificate Renewal
 
 ```bash
-# Update AlmaLinux
+# Test renewal
+sudo certbot renew --dry-run
+
+# Force renewal
+sudo certbot renew --force-renewal
+
+# Check expiration
+sudo certbot certificates
+```
+
+### System Updates
+
+```bash
+# Update sistema
 sudo dnf update -y
 
 # Update Node.js packages
 cd /var/www/vigilanza-turni
+npm outdated
 npm update
 
-# Restart
+# Rebuild dopo update
+npm run build
 pm2 restart vigilanza-turni
 ```
 
-### 7.4 SSL Certificate Renewal
-
-Certbot rinnova automaticamente, ma puoi forzare:
-
-```bash
-sudo certbot renew --dry-run  # Test
-sudo certbot renew            # Rinnovo reale
-sudo systemctl reload nginx
-```
-
 ---
 
-## 8. Troubleshooting
+## Troubleshooting
 
-### App non risponde
+### Applicazione non Risponde
 
 ```bash
-# Check PM2
+# 1. Check PM2 status
 pm2 status
+
+# 2. Check logs
+pm2 logs vigilanza-turni --lines 100
+
+# 3. Restart
 pm2 restart vigilanza-turni
 
-# Check logs
-pm2 logs vigilanza-turni --lines 50
-
-# Check Nginx
+# 4. Check Nginx
 sudo nginx -t
 sudo systemctl status nginx
+sudo systemctl reload nginx
+
+# 5. Check firewall
+sudo firewall-cmd --list-all
 ```
 
-### Database Connection Error
+### Errore Database
 
 ```bash
-# Verifica PostgreSQL
+# 1. Verifica connessione
+export $(cat /root/.vigilanza_db_password | xargs)
+psql -h localhost -U vigilanza_user -d vigilanza_turni -c "SELECT version();"
+
+# 2. Check PostgreSQL
 sudo systemctl status postgresql
-sudo -u postgres psql -c "SELECT version();"
+sudo tail -f /var/lib/pgsql/data/log/postgresql-*.log
 
-# Test connessione
-psql "postgresql://vigilanza_user:password@localhost:5432/vigilanza_turni" -c "SELECT NOW();"
+# 3. Restart PostgreSQL
+sudo systemctl restart postgresql
+
+# 4. Verifica .env
+cat /var/www/vigilanza-turni/.env | grep DATABASE_URL
 ```
 
-### SSL Certificate Issues
+### Build Fallito
 
 ```bash
-# Test SSL
+# 1. Clean build
+cd /var/www/vigilanza-turni
+rm -rf node_modules dist
+
+# 2. Reinstall
+npm ci
+
+# 3. Rebuild
+npm run build
+
+# 4. Check errors
+npm run build 2>&1 | tee build.log
+
+# 5. Restart
+pm2 restart vigilanza-turni
+```
+
+### SSL Issues
+
+```bash
+# 1. Check certificate
 sudo certbot certificates
 
-# Rinnovo manuale
+# 2. Renew certificate
 sudo certbot renew --force-renewal
+
+# 3. Reload Nginx
 sudo systemctl reload nginx
+
+# 4. Check SSL config
+sudo nginx -t
 ```
 
-### Rollback Emergenza
-
-In GitLab → CI/CD → Pipelines → clicca su "rollback"
-
-Oppure manuale:
+### Performance Issues
 
 ```bash
-cd /var/www/vigilanza-turni
-git log --oneline -10  # Trova commit precedente
-git checkout <commit-hash>
-bash deploy/deploy.sh
-```
+# 1. Check server resources
+htop
+df -h
+free -m
 
----
+# 2. PM2 monitoring
+pm2 monit
 
-## 📞 Supporto
-
-### Logs Utili
-
-```bash
-# PM2 logs
-pm2 logs vigilanza-turni --lines 200
-
-# Nginx logs
-sudo tail -f /var/log/nginx/vigilanza-turni-error.log
+# 3. Nginx access log analysis
 sudo tail -f /var/log/nginx/vigilanza-turni-access.log
 
-# System logs
-sudo journalctl -u nginx -f
-sudo journalctl -xe
+# 4. Database performance
+export $(cat /root/.vigilanza_db_password | xargs)
+psql -h localhost -U vigilanza_user -d vigilanza_turni -c \
+  "SELECT query, calls, mean_exec_time FROM pg_stat_statements ORDER BY mean_exec_time DESC LIMIT 10;"
 ```
 
-### Comandi Rapidi
+### Rollback Completo
 
 ```bash
-# Restart completo
-pm2 restart vigilanza-turni && sudo systemctl reload nginx
+# 1. Stop applicazione
+pm2 stop vigilanza-turni
 
-# Deploy forzato
-cd /var/www/vigilanza-turni && git pull && bash deploy/deploy.sh
+# 2. Ripristina database
+export $(cat /root/.vigilanza_db_password | xargs)
+BACKUP_FILE=$(ls -t /var/backups/vigilanza-turni/*.gz | head -1)
+gunzip -c $BACKUP_FILE | psql -h localhost -U vigilanza_user -d vigilanza_turni
 
-# Clear cache PM2
-pm2 delete vigilanza-turni
-pm2 start npm --name vigilanza-turni -- start
-pm2 save
+# 3. Git rollback
+cd /var/www/vigilanza-turni
+git log --oneline -10  # Trova commit precedente
+git reset --hard <commit-hash>
+
+# 4. Rebuild
+npm ci
+npm run build
+
+# 5. Restart
+pm2 restart vigilanza-turni
 ```
 
 ---
 
-## ✅ Checklist Post-Deployment
+## Checklist Deployment
 
-- [ ] Applicazione accessibile su https://tuodominio.it
-- [ ] SSL certificate valido (lucchetto verde)
+### Pre-Deployment
+- [ ] Backup database eseguito
+- [ ] Test locali passati
+- [ ] Git push completato
+- [ ] Server accessibile
+
+### During Deployment
+- [ ] `./push-to-gitlab.sh` eseguito
+- [ ] SSH server funzionante
+- [ ] `bash deploy/deploy.sh` completato senza errori
+- [ ] Health check PM2 OK
+
+### Post-Deployment
+- [ ] Applicazione risponde: https://vt.alfacom.it
 - [ ] Login funzionante
-- [ ] Database connesso
-- [ ] Logs puliti (no errori critici)
-- [ ] PM2 status: online
-- [ ] Backup database configurato
-- [ ] Monitoring attivo
+- [ ] Database accessibile
+- [ ] Logs puliti (no errori)
+- [ ] SSL certificate valido
 
 ---
 
-**Ultima modifica:** 2025-10-11  
-**Versione:** 1.0
+## Sicurezza
+
+### Best Practices
+1. ✅ SSL/TLS sempre attivo
+2. ✅ Firewall configurato
+3. ✅ Password database sicura
+4. ✅ Backup automatici attivi
+5. ✅ Logs monitorati
+6. ✅ Sistema aggiornato regolarmente
+
+### Hardening Suggerito
+- Fail2ban per brute-force protection
+- SSH key-only authentication
+- Database backup off-site
+- Monitoring con Prometheus/Grafana
+- Alert via email/Telegram
+
+---
+
+## Contatti
+
+**Support:** Marco Alfacom  
+**Repository:** https://git.alfacom.it/marco/VigilanzaTurni  
+**Production:** https://vt.alfacom.it
+
+---
+
+**Ultima revisione:** Ottobre 2025

QUICKSTART-DEPLOYMENT.md

@@ -1,105 +1,101 @@
 # 🚀 Quick Start - Deployment VigilanzaTurni
 
-Guida rapida per deployment da Replit → GitLab → Server AlmaLinux 9
+Guida rapida per deployment: Replit → GitLab → vt.alfacom.it
 
 ## 📝 Checklist Pre-Deployment
 
 - [ ] Server AlmaLinux 9 disponibile (min 2GB RAM)
-- [ ] Dominio configurato (es. vigilanza.tuodominio.it)
-- [ ] Account GitLab su git.alfacom.it
+- [ ] Dominio vt.alfacom.it configurato
+- [ ] Account GitLab
 - [ ] SSH access al server
 
 ---
 
-## ⚡ Setup Rapido (15 minuti)
+## ⚡ Setup Iniziale (15 minuti)
 
 ### 1️⃣ Setup Server (5 min)
 
 ```bash
 # SSH nel server
-ssh root@ip-del-server
+ssh root@vt.alfacom.it
 
-# Download e esegui setup automatico
-curl -o setup.sh https://git.alfacom.it/marco/VigilanzaTurni/-/raw/main/deploy/setup-server.sh
-chmod +x setup.sh
-sudo bash setup.sh
+# Clone repository
+cd /var/www
+git clone https://git.alfacom.it/marco/VigilanzaTurni.git vigilanza-turni
+cd vigilanza-turni
 
-# ⚠️ IMPORTANTE: Salva la password PostgreSQL mostrata!
+# Esegui setup automatico
+sudo bash deploy/setup-server.sh
 ```
 
-### 2️⃣ Configura GitLab CI/CD (3 min)
+Lo script installa automaticamente:
+- Node.js 20
+- PostgreSQL 15 (password autogenerata)
+- PM2
+- Nginx
+- Certbot (SSL)
 
-**Genera SSH Key:**
-```bash
-# Sul tuo PC
-ssh-keygen -t ed25519 -C "gitlab-deploy" -f ~/.ssh/gitlab-deploy
-ssh-copy-id -i ~/.ssh/gitlab-deploy.pub root@ip-del-server
-cat ~/.ssh/gitlab-deploy  # Copia output
-```
+⚠️ **Password DB salvata in:** `/root/.vigilanza_db_password`
 
-**GitLab → Settings → CI/CD → Variables:**
-
-| Nome | Valore |
-|------|--------|
-| `SSH_PRIVATE_KEY` | [chiave privata copiata sopra] |
-| `DEPLOY_HOST` | ip-del-server |
-| `DEPLOY_USER` | root |
-| `DEPLOY_DOMAIN` | vigilanza.tuodominio.it |
-
-### 3️⃣ Configura Replit (2 min)
+### 2️⃣ Configura Nginx (2 min)
 
 ```bash
-# In Replit Shell
-git remote add production https://git.alfacom.it/marco/VigilanzaTurni.git
-
-# Crea Personal Access Token su GitLab e salvalo in Replit Secrets
-# GitLab → User Settings → Access Tokens → write_repository
-```
-
-### 4️⃣ Configura Server .env (3 min)
-
-```bash
-# Sul server
-cd /var/www/vigilanza-turni
-
-# Clone iniziale
-git clone https://git.alfacom.it/marco/VigilanzaTurni.git .
-
-# Crea .env
-cp .env.production.example .env
-nano .env
-```
-
-**Inserisci:**
-```bash
-# Password DB dal setup (vedi /root/.vigilanza_db_password)
-DATABASE_URL=postgresql://vigilanza_user:PASSWORD_GENERATA@localhost:5432/vigilanza_turni
-SESSION_SECRET=$(openssl rand -base64 32)
-REPLIT_DOMAINS=vigilanza.tuodominio.it
-```
-
-### 5️⃣ Nginx e SSL (2 min)
-
-```bash
-# Copia config Nginx
+# Copia configurazione Nginx
 sudo cp deploy/nginx.conf /etc/nginx/conf.d/vigilanza-turni.conf
 
-# Modifica con il tuo dominio
-sudo nano /etc/nginx/conf.d/vigilanza-turni.conf
-# Sostituisci "tuodominio.it" → "vigilanza.tuodominio.it"
-
 # Test e reload
 sudo nginx -t
 sudo systemctl reload nginx
 
 # SSL Certificate
-sudo certbot --nginx -d vigilanza.tuodominio.it
+sudo certbot --nginx -d vt.alfacom.it
 ```
 
-### 6️⃣ Primo Deploy (1 min)
+### 3️⃣ Configura .env (2 min)
+
+```bash
+cd /var/www/vigilanza-turni
+
+# Recupera password DB da file sicuro
+DB_PASS=$(grep PGPASSWORD /root/.vigilanza_db_password | cut -d= -f2)
+SESSION_SECRET=$(openssl rand -base64 32)
+
+# Crea .env con valori reali (no shell variables)
+cat > .env << EOF
+# Database
+DATABASE_URL=postgresql://vigilanza_user:${DB_PASS}@localhost:5432/vigilanza_turni
+PGHOST=localhost
+PGPORT=5432
+PGDATABASE=vigilanza_turni
+PGUSER=vigilanza_user
+PGPASSWORD=${DB_PASS}
+
+# Session
+SESSION_SECRET=${SESSION_SECRET}
+
+# Application
+NODE_ENV=production
+PORT=5000
+APP_URL=https://vt.alfacom.it
+
+# Backup
+BACKUP_ENABLED=true
+BACKUP_DIR=/var/backups/vigilanza-turni
+LOG_LEVEL=info
+EOF
+
+echo "✅ File .env creato"
+```
+
+**Verifica:**
+```bash
+cat .env | grep DATABASE_URL
+# Deve mostrare password reale, non variabili shell
+```
+
+### 4️⃣ Primo Deploy (2 min)
 
 ```bash
-# Sul server
 cd /var/www/vigilanza-turni
 bash deploy/deploy.sh
 ```
@@ -108,19 +104,26 @@ bash deploy/deploy.sh
 
 ## 🔄 Workflow Quotidiano
 
-### Da Replit → Produzione
+### Deploy in 2 Comandi
+
+**Da Replit o locale:**
 
 ```bash
-# 1. Fai modifiche in Replit
-# 2. Push a GitLab
-bash push-to-gitlab.sh
+# 1. Push a GitLab
+./push-to-gitlab.sh
 
-# 3. Vai su GitLab
-https://git.alfacom.it/marco/VigilanzaTurni/-/pipelines
-
-# 4. Clicca su "deploy_production" quando pronto
+# 2. Sul server: Deploy
+ssh root@vt.alfacom.it "cd /var/www/vigilanza-turni && bash deploy/deploy.sh"
 ```
 
+**Il deploy automaticamente:**
+- ✅ Esegue backup database
+- ✅ Pull ultime modifiche da GitLab
+- ✅ Build frontend Vite
+- ✅ Esegue migrations database
+- ✅ Restart applicazione PM2
+- ✅ Health check
+
 ---
 
 ## 📊 Comandi Utili
@@ -135,38 +138,59 @@ pm2 logs vigilanza-turni
 # Restart
 pm2 restart vigilanza-turni
 
-# Backup database
-sudo -u postgres pg_dump vigilanza_turni > backup_$(date +%Y%m%d).sql
+# Verifica backup
+ls -lht /var/backups/vigilanza-turni/
+
+# Ripristina backup (usa password da file)
+export $(cat /root/.vigilanza_db_password | xargs)
+gunzip -c /var/backups/vigilanza-turni/backup_20250116_143022.sql.gz | \
+  psql -h localhost -U vigilanza_user -d vigilanza_turni
 ```
 
 ---
 
-## 🆘 Problemi Comuni
+## 🆘 Troubleshooting
 
 **App non risponde:**
 ```bash
 pm2 restart vigilanza-turni
+pm2 logs vigilanza-turni --lines 50
 sudo systemctl reload nginx
 ```
 
 **Errore database:**
 ```bash
-# Verifica password in .env corrisponde a quella in /root/.vigilanza_db_password
-cat /root/.vigilanza_db_password
+# Verifica connessione (usa password da file)
+export $(cat /root/.vigilanza_db_password | xargs)
+psql -h localhost -U vigilanza_user -d vigilanza_turni -c "SELECT version();"
 ```
 
-**SSL scaduto:**
+**Build fallito:**
 ```bash
-sudo certbot renew
-sudo systemctl reload nginx
+cd /var/www/vigilanza-turni
+rm -rf node_modules dist
+npm ci
+npm run build
+pm2 restart vigilanza-turni
 ```
 
 ---
 
-## 📚 Documentazione Completa
+## 🌐 Accesso
 
-Per dettagli completi: [DEPLOYMENT.md](./DEPLOYMENT.md)
+**Applicazione:** https://vt.alfacom.it
+
+**Backup automatici:** 
+- Directory: `/var/backups/vigilanza-turni/`
+- Retention: 30 giorni
+- Formato: `backup_YYYYMMDD_HHMMSS.sql.gz`
 
 ---
 
-**Setup completato?** ✅ Vai su https://vigilanza.tuodominio.it
+## 📚 File Importanti
+
+- `deploy/deploy.sh` - Script deployment automatico
+- `deploy/setup-server.sh` - Setup iniziale server
+- `deploy/nginx.conf` - Configurazione reverse proxy
+- `.env` - Variabili ambiente produzione
+- `push-to-gitlab.sh` - Helper push GitLab

attached_assets/Pasted--workspace-push-to-gitlab-sh-Push-to-GitLab-vt-alfacom-it--1760612848127_1760612848127.txt

@@ -0,0 +1,46 @@
+ 
+~/workspace$ ./push-to-gitlab.sh
+🚀 Push to GitLab (vt.alfacom.it)
+========================================
+
+📋 Modifiche da committare:
+ M .replit
+ M push-to-gitlab.sh
+Vuoi procedere con il push? (y/N) y
+Messaggio commit personalizzato (Enter per default): 
+
+📦 Git add...
+💾 Git commit...
+On branch main
+nothing to commit, working tree clean
+~/workspace$ git add .
+~/workspace$ git commit -m "Deploy: $(date '+%Y-%m-%d %H:%M:%S')"
+On branch main
+nothing to commit, working tree clean
+~/workspace$ git push production main
+error: unable to read askpass response from 'replit-git-askpass'
+Username for 'https://git.alfacom.it': marco@lanzara.eu
+error: unable to read askpass response from 'replit-git-askpass'
+Password for 'https://marco%40lanzara.eu@git.alfacom.it': 
+To https://git.alfacom.it/marco/VigilanzaTurni.git
+ ! [rejected]        main -> main (fetch first)
+error: failed to push some refs to 'https://git.alfacom.it/marco/VigilanzaTurni.git'
+hint: Updates were rejected because the remote contains work that you do not
+hint: have locally. This is usually caused by another repository pushing to
+hint: the same ref. If you want to integrate the remote changes, use
+hint: 'git pull' before pushing again.
+hint: See the 'Note about fast-forwards' in 'git push --help' for details.
+~/workspace$ git push production main
+error: unable to read askpass response from 'replit-git-askpass'
+Username for 'https://git.alfacom.it': marco
+error: unable to read askpass response from 'replit-git-askpass'
+Password for 'https://marco@git.alfacom.it': 
+To https://git.alfacom.it/marco/VigilanzaTurni.git
+ ! [rejected]        main -> main (fetch first)
+error: failed to push some refs to 'https://git.alfacom.it/marco/VigilanzaTurni.git'
+hint: Updates were rejected because the remote contains work that you do not
+hint: have locally. This is usually caused by another repository pushing to
+hint: the same ref. If you want to integrate the remote changes, use
+hint: 'git pull' before pushing again.
+hint: See the 'Note about fast-forwards' in 'git push --help' for details.
+~/workspace$ 

deploy/deploy.sh

@@ -2,19 +2,50 @@
 set -e
 
 # Script di deployment automatico per VigilanzaTurni
-# Eseguito da GitLab CI/CD Runner
+# Uso: bash deploy/deploy.sh
 
 APP_DIR="/var/www/vigilanza-turni"
 APP_NAME="vigilanza-turni"
+BACKUP_DIR="/var/backups/vigilanza-turni"
 
 echo "🚀 Deployment VigilanzaTurni - $(date)"
 
 # Vai alla directory applicazione
 cd $APP_DIR
 
-# Pull ultime modifiche (già fatto da GitLab Runner)
-echo "📦 Repository aggiornato"
+# Pull ultime modifiche (se eseguito manualmente)
+if [ -d .git ]; then
+    echo "📥 Pull ultime modifiche da GitLab..."
+    git pull origin main || true
+fi
 
+# =================== BACKUP DATABASE ===================
+echo "💾 Backup database pre-deployment..."
+mkdir -p $BACKUP_DIR
+BACKUP_FILE="$BACKUP_DIR/backup_$(date +%Y%m%d_%H%M%S).sql"
+
+# Load env vars
+if [ -f .env ]; then
+    export $(cat .env | grep -v '^#' | xargs)
+fi
+
+# Esegui backup PostgreSQL
+if command -v pg_dump &> /dev/null; then
+    PGPASSWORD=$PGPASSWORD pg_dump -h $PGHOST -U $PGUSER -d $PGDATABASE > $BACKUP_FILE
+    echo "✅ Backup salvato: $BACKUP_FILE"
+    
+    # Comprimi backup
+    gzip $BACKUP_FILE
+    echo "✅ Backup compresso: ${BACKUP_FILE}.gz"
+    
+    # Pulisci backup vecchi (> 30 giorni)
+    find $BACKUP_DIR -name "backup_*.sql.gz" -mtime +30 -delete
+    echo "🧹 Backup vecchi eliminati (retention: 30 giorni)"
+else
+    echo "⚠️  pg_dump non trovato, skip backup"
+fi
+
+# =================== BUILD & DEPLOY ===================
 # Installa TUTTE le dipendenze (serve per build e migrations)
 echo "📥 Installazione dipendenze (include devDependencies)..."
 npm ci
@@ -32,6 +63,7 @@ npm run db:push || true
 echo "🧹 Pulizia devDependencies (mantiene solo production)..."
 npm prune --production
 
+# =================== RESTART APPLICATION ===================
 # Restart applicazione con PM2
 echo "🔄 Restart applicazione..."
 if pm2 show $APP_NAME > /dev/null 2>&1; then
@@ -50,8 +82,27 @@ if pm2 show $APP_NAME | grep -q "online"; then
 else
     echo "❌ Errore: applicazione non online"
     pm2 logs $APP_NAME --lines 50 --nostream
+    
+    # Rollback: ripristina ultimo backup
+    echo "🔄 Tentativo rollback backup..."
+    LATEST_BACKUP=$(ls -t $BACKUP_DIR/backup_*.sql.gz 2>/dev/null | head -1)
+    if [ -f "$LATEST_BACKUP" ]; then
+        echo "📦 Ripristino da: $LATEST_BACKUP"
+        gunzip -c $LATEST_BACKUP | PGPASSWORD=$PGPASSWORD psql -h $PGHOST -U $PGUSER -d $PGDATABASE
+        echo "✅ Database ripristinato"
+    fi
+    
     exit 1
 fi
 
+# =================== STATUS ===================
+echo ""
 echo "📊 Status PM2:"
 pm2 status
+
+echo ""
+echo "📈 Ultimi backup disponibili:"
+ls -lht $BACKUP_DIR/*.gz 2>/dev/null | head -5 || echo "Nessun backup trovato"
+
+echo ""
+echo "🌐 Applicazione disponibile su: https://vt.alfacom.it"

deploy/nginx.conf

@@ -10,7 +10,7 @@ upstream vigilanza_backend {
 server {
     listen 80;
     listen [::]:80;
-    server_name tuodominio.it www.tuodominio.it;
+    server_name vt.alfacom.it;
 
     # Let's Encrypt challenge
     location /.well-known/acme-challenge/ {
@@ -26,11 +26,11 @@ server {
 server {
     listen 443 ssl http2;
     listen [::]:443 ssl http2;
-    server_name tuodominio.it www.tuodominio.it;
+    server_name vt.alfacom.it;
 
     # SSL Certificate (generato da certbot)
-    ssl_certificate /etc/letsencrypt/live/tuodominio.it/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/tuodominio.it/privkey.pem;
+    ssl_certificate /etc/letsencrypt/live/vt.alfacom.it/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/vt.alfacom.it/privkey.pem;
 
     # SSL Security
     ssl_protocols TLSv1.2 TLSv1.3;

deploy/setup-server.sh

@@ -0,0 +1,140 @@
+#!/bin/bash
+# Setup automatico server AlmaLinux 9 per VigilanzaTurni
+# Esegui: sudo bash deploy/setup-server.sh
+
+set -e
+
+# Colori output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
+log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
+log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
+
+# Verifica root
+if [ "$EUID" -ne 0 ]; then 
+    log_error "Esegui come root: sudo bash $0"
+    exit 1
+fi
+
+log_info "🚀 Setup server AlmaLinux 9 per VigilanzaTurni"
+log_info "Dominio: vt.alfacom.it"
+
+# =================== SYSTEM UPDATE ===================
+log_info "Aggiornamento sistema..."
+dnf update -y
+
+# =================== NODE.JS ===================
+log_info "Installazione Node.js 20..."
+dnf module reset nodejs -y
+dnf module enable nodejs:20 -y
+dnf install nodejs -y
+node --version
+npm --version
+
+# =================== PM2 ===================
+log_info "Installazione PM2..."
+npm install -g pm2
+pm2 startup systemd -u root --hp /root
+systemctl enable pm2-root
+
+# =================== POSTGRESQL ===================
+log_info "Installazione PostgreSQL 15..."
+<<<<<<< HEAD
+dnf install -y postgresql15-server postgresql15
+
+# Inizializza database
+postgresql-setup --initdb
+systemctl enable postgresql
+systemctl start postgresql
+=======
+dnf install -y postgresql15-server postgresql15-contrib
+postgresql-15-setup --initdb
+systemctl enable postgresql-15
+systemctl start postgresql-15
+>>>>>>> 94bec4cfd683fe846be466cbfba0a57786d95c2a
+
+# Genera password sicura PostgreSQL (o usa variabile ambiente)
+if [ -z "$DB_PASSWORD" ]; then
+    DB_PASSWORD=$(openssl rand -base64 32 | tr -d "=+/" | cut -c1-25)
+    log_warn "Password PostgreSQL generata automaticamente"
+else
+    log_info "Uso password PostgreSQL da variabile DB_PASSWORD"
+fi
+
+# Creazione database e utente
+log_info "Configurazione database..."
+sudo -u postgres psql << EOF
+CREATE DATABASE vigilanza_turni;
+CREATE USER vigilanza_user WITH ENCRYPTED PASSWORD '${DB_PASSWORD}';
+GRANT ALL PRIVILEGES ON DATABASE vigilanza_turni TO vigilanza_user;
+\c vigilanza_turni
+GRANT ALL ON SCHEMA public TO vigilanza_user;
+EOF
+
+# Salva password in file sicuro
+echo "PGPASSWORD=${DB_PASSWORD}" > /root/.vigilanza_db_password
+chmod 600 /root/.vigilanza_db_password
+log_info "✅ Database configurato - Password salvata in /root/.vigilanza_db_password"
+
+# Configurazione PostgreSQL per connessioni locali
+log_info "Configurazione autenticazione PostgreSQL..."
+PG_HBA="/var/lib/pgsql/data/pg_hba.conf"
+if ! grep -q "vigilanza_user" $PG_HBA; then
+    echo "local   vigilanza_turni    vigilanza_user                    md5" >> $PG_HBA
+    echo "host    vigilanza_turni    vigilanza_user    127.0.0.1/32    md5" >> $PG_HBA
+    systemctl restart postgresql
+fi
+
+# =================== NGINX ===================
+log_info "Installazione Nginx..."
+dnf install -y nginx
+systemctl enable nginx
+systemctl start nginx
+
+# =================== GIT ===================
+log_info "Installazione Git..."
+dnf install -y git
+
+# =================== DIRECTORY APPLICAZIONE ===================
+log_info "Creazione directory applicazione..."
+mkdir -p /var/www/vigilanza-turni
+mkdir -p /var/backups/vigilanza-turni
+chmod 755 /var/www/vigilanza-turni
+chmod 700 /var/backups/vigilanza-turni
+
+# =================== FIREWALL ===================
+log_info "Configurazione firewall..."
+systemctl enable firewalld
+systemctl start firewalld
+firewall-cmd --permanent --add-service=http
+firewall-cmd --permanent --add-service=https
+firewall-cmd --reload
+
+# =================== SSL CERTIFICATE (Let's Encrypt) ===================
+log_info "Installazione Certbot per SSL..."
+dnf install -y certbot python3-certbot-nginx
+
+log_info ""
+log_info "================================================"
+log_info "Setup completato con successo!"
+log_info "================================================"
+log_info ""
+log_warn "PROSSIMI PASSI:"
+echo "1. Copia deploy/nginx.conf → /etc/nginx/conf.d/vigilanza-turni.conf"
+echo "2. Clone repository: cd /var/www/vigilanza-turni && git clone <repo-url> ."
+echo "3. Crea file .env con DATABASE_URL (password già configurata)"
+echo "4. Ottieni certificato SSL: sudo certbot --nginx -d vt.alfacom.it"
+echo "5. Esegui primo deploy: bash deploy/deploy.sh"
+echo ""
+log_warn "⚠️  IMPORTANTE - Password PostgreSQL:"
+echo "Salvata in: /root/.vigilanza_db_password"
+echo ""
+log_info "DATABASE_URL per .env:"
+echo "postgresql://vigilanza_user:PASSWORD_DA_FILE@localhost:5432/vigilanza_turni"
+echo ""
+echo "Recupera password con:"
+echo "  cat /root/.vigilanza_db_password"

push-to-gitlab.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Script helper per push automatico verso GitLab da Replit
+# Script per push automatico verso GitLab
 
 set -e
 
@@ -9,9 +9,17 @@ YELLOW='\033[1;33m'
 RED='\033[0;31m'
 NC='\033[0m'
 
-echo -e "${GREEN}🚀 Push to GitLab Production${NC}"
+echo -e "${GREEN}🚀 Push to GitLab (vt.alfacom.it)${NC}"
 echo "========================================"
 
+# Verifica remote GitLab
+if ! git remote | grep -q "production"; then
+    echo -e "${YELLOW}⚠️  Remote 'production' non configurato${NC}"
+    echo "Configurazione remote GitLab..."
+    read -p "URL repository GitLab: " GITLAB_URL
+    git remote add production $GITLAB_URL
+fi
+
 # Verifica se ci sono modifiche
 if [[ -z $(git status -s) ]]; then
     echo -e "${YELLOW}⚠️  Nessuna modifica da committare${NC}"
@@ -48,12 +56,20 @@ echo -e "${GREEN}💾 Git commit...${NC}"
 git commit -m "$COMMIT_MSG"
 
 echo -e "${GREEN}📤 Git push to production...${NC}"
+
+# Pull prima di pushare per evitare conflitti
+echo -e "${YELLOW}Sincronizzazione con remote...${NC}"
+git pull production main --no-rebase || echo -e "${YELLOW}⚠️  Potrebbero esserci conflitti da risolvere${NC}"
+
 git push production main
 
 echo -e "\n${GREEN}✅ Push completato!${NC}"
 echo "========================================"
-echo -e "${YELLOW}Prossimi passi:${NC}"
-echo "1. Vai su GitLab: https://git.alfacom.it/marco/VigilanzaTurni/-/pipelines"
-echo "2. La pipeline CI/CD partirà automaticamente"
-echo "3. Clicca su 'deploy_production' per deployare su server"
+echo -e "${YELLOW}Deployment automatico disponibile:${NC}"
+echo ""
+echo "Sul server esegui:"
+echo -e "${GREEN}  cd /var/www/vigilanza-turni${NC}"
+echo -e "${GREEN}  bash deploy/deploy.sh${NC}"
+echo ""
+echo "🌐 Sito: https://vt.alfacom.it"
 echo ""

replit.md

@@ -315,38 +315,50 @@ All interactive elements have `data-testid` attributes for automated testing.
 - **Sistema Deployment Automatico** ✅:
   - Pipeline CI/CD GitLab (.gitlab-ci.yml) con stages build/test/deploy
   - Script setup server AlmaLinux 9 (deploy/setup-server.sh)
-  - Script deployment automatico (deploy/deploy.sh)
+  - Script deployment automatico con backup DB (deploy/deploy.sh)
   - Configurazione Nginx reverse proxy con SSL
-  - Password PostgreSQL autogenerata (sicurezza)
-  - Workflow: Replit → GitLab → CI/CD → Server produzione
+  - Workflow semplificato: 2 comandi (push + deploy)
+  - Backup automatico database pre-deploy (retention 30 giorni)
+  - Rollback automatico su errore deployment
+  - Dominio produzione: vt.alfacom.it
   - Documentazione completa (DEPLOYMENT.md, QUICKSTART-DEPLOYMENT.md)
-  - Helper script push-to-gitlab.sh per deployment rapido
+  - Helper script push-to-gitlab.sh
 
 ## Deployment
 
 ### Setup Produzione
-Il sistema supporta deployment automatico su server AlmaLinux 9 tramite GitLab CI/CD:
+Sistema deployment automatico su vt.alfacom.it (AlmaLinux 9):
 
-**Workflow Deployment:**
-```
-Replit (modifiche) → Git Push → GitLab CI/CD → Deploy Server
+**Workflow Semplificato (2 comandi):**
+```bash
+# 1. Push da Replit
+./push-to-gitlab.sh
+
+# 2. Deploy su server
+ssh root@vt.alfacom.it "cd /var/www/vigilanza-turni && bash deploy/deploy.sh"
 ```
 
 **File Deployment:**
 - `.gitlab-ci.yml` - Pipeline CI/CD (build, test, deploy, rollback)
 - `deploy/setup-server.sh` - Setup iniziale server (Node, PostgreSQL, Nginx, PM2)
-- `deploy/deploy.sh` - Script deployment automatico
-- `deploy/nginx.conf` - Configurazione reverse proxy
-- `.env.production.example` - Template variabili ambiente produzione
+- `deploy/deploy.sh` - Script deployment automatico con backup DB
+- `deploy/nginx.conf` - Configurazione Nginx per vt.alfacom.it
+- `.env.production.example` - Template variabili ambiente
+- `push-to-gitlab.sh` - Helper push GitLab
 
-**Documentazione:**
-- `DEPLOYMENT.md` - Guida completa step-by-step
-- `QUICKSTART-DEPLOYMENT.md` - Setup rapido 15 minuti
+**Funzionalità Deploy:**
+- ✅ Backup automatico database pre-deploy
+- ✅ Build frontend Vite + migrations DB
+- ✅ Restart graceful PM2
+- ✅ Health check post-deploy
+- ✅ Rollback automatico su errore
+- ✅ Retention backup: 30 giorni
 
 **Security:**
-- Password PostgreSQL autogenerata (non hard-coded)
-- SSL/TLS con Let's Encrypt
-- Firewall configurato automaticamente
+- Password PostgreSQL sicura (non hard-coded)
+- SSL/TLS con Let's Encrypt (vt.alfacom.it)
+- Firewall configurato (HTTP/HTTPS only)
+- Backup compressi in /var/backups/vigilanza-turni/
 
 ## Future Enhancements