coop/docs/SETUP-INFRASTRUCTURE.md

# CoopCredits Setup for 172.20.1.0/24 Infrastructure

This guide covers setting up CoopCredits with your existing Plex/Tautulli/Overseer infrastructure.

## Prerequisites

- Server running Docker and Docker Compose
- Access to 172.20.1.0/24 network
- API keys from Tautulli and Overseer
- Domain name (coop.hobokenchicken.com) pointing to your server

## Network Overview

```
┌─────────────────────────────────────────────────────────────────┐
│                     CoopCredits Server                           │
│                    (Your Server IP)                              │
│                         :443                                     │
└─────────────────────────────────┬───────────────────────────────┘
                                  │ HTTPS
        ┌─────────────────────────┼──────────────────────────┐
        │                         │                          │
        ▼                         ▼                          ▼
┌──────────────┐         ┌──────────────┐          ┌──────────────┐
│     Plex     │         │   Tautulli   │          │   Overseer   │
│172.20.1.220  │         │172.20.1.255  │          │172.20.1.225  │
│   :32400     │         │   :8181      │          │   :5055      │
└──────────────┘         └──────────────┘          └──────────────┘
```

## Quick Start

### 1. Clone Repository

```bash
cd /opt
git clone <repository> coop-credits
cd coop-credits
```

### 2. Run Infrastructure Setup

```bash
./deployment/setup-infrastructure.sh
```

This script will:
- Test connectivity to your services (Plex, Tautulli, Overseer)
- Generate a secure `.env` file
- Output configuration instructions

**Note:** SSL/TLS is handled by your external reverse proxy (Caddy). The application runs HTTP on port 80 internally.

### 3. Configure Environment

Edit the generated `.env` file:

```bash
nano .env
```

Add your API keys:

```env
# Get from Tautulli: Settings > Web Interface > API
TAUTULLI_API_KEY=your-tautulli-api-key

# Get from Overseer: Settings > General > API Key
OVERSEER_API_KEY=your-overseer-api-key

# Get from https://plex.tv/claim or Plex settings
PLEX_CLIENT_ID=your-plex-client-id
PLEX_CLIENT_SECRET=your-plex-client-secret
```

### 4. Setup Solana

```bash
npm run setup:solana
```

This will:
- Install Solana CLI
- Create a devnet wallet
- Request airdrop
- Output the private key for your `.env` file

Copy the `SOLANA_MINT_AUTHORITY_KEYPAIR` into your `.env` file.

### 5. Deploy Solana Program

```bash
cd anchor-program
anchor build
anchor deploy
```

Update `SOLANA_PROGRAM_ID` in `.env` with the deployed program ID.

### 6. Deploy

```bash
./deployment/deploy-production.sh
```

### 8. Configure Tautulli Webhook

1. Open Tautulli: http://172.20.1.255:8181
2. Go to **Settings > Notification Agents**
3. Click **Add a new notification agent > Webhook**

**Configuration:**
- Webhook URL: `https://coop.hobokenchicken.com/webhooks/tautulli`
- Webhook Method: `POST`
- Content Type: `application/json`

**JSON Payload:**
```json
{
  "action": "watched",
  "user_id": "{user_id}",
  "username": "{username}",
  "rating_key": "{rating_key}",
  "session_key": "{session_key}",
  "media_type": "{media_type}",
  "title": "{title}",
  "grandparent_title": "{grandparent_title}",
  "started": "{started}",
  "stopped": "{stopped}",
  "percent_complete": "{percent_complete}",
  "is_new": "{is_new}"
}
```

**Triggers:** Enable **Watched**

### 9. Configure Overseer Webhook

1. Open Overseer: http://172.20.1.225:5055
2. Go to **Settings > Notifications**
3. Enable **Webhook**

**Configuration:**
- Webhook URL: `https://coop.hobokenchicken.com/webhooks/overseer`
- Authorization Header: `Bearer your-webhook-secret-from-env`

**JSON Payload:**
```json
{
  "request_id": "{{request.id}}",
  "status": "{{request.status}}",
  "media_type": "{{media.media_type}}",
  "title": "{{media.title}}"
}
```

**Events:** Enable **Request Approved** and **Request Declined**

## Verification

### Test Connectivity

```bash
./deployment/health-check.sh
```

### Watch Mode

```bash
./deployment/health-check.sh --watch
```

### Manual Tests

**Test Tautulli webhook:**
```bash
curl -X POST https://coop.hobokenchicken.com/webhooks/tautulli \
  -H "Content-Type: application/json" \
  -d '{
    "action": "watched",
    "user_id": "12345",
    "username": "testuser",
    "rating_key": "1234",
    "session_key": "abc123",
    "media_type": "movie",
    "title": "Test Movie",
    "started": "'$(date +%s)'",
    "stopped": "'$(($(date +%s) + 3600))'",
    "percent_complete": "90"
  }'
```

**Test API:**
```bash
curl https://coop.hobokenchicken.com/api/health
```

## Firewall Configuration

If using UFW:

```bash
# Allow web traffic
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Allow backend to reach local network
sudo ufw allow from 172.20.2.0/16 to 172.20.1.0/24

# Deny direct access to internal services
sudo ufw deny 3000/tcp
sudo ufw deny 3001/tcp
sudo ufw deny 5432/tcp
sudo ufw deny 6379/tcp

# Enable firewall
sudo ufw enable
```

## Troubleshooting

### Cannot reach local services

1. Check Docker network:
   ```bash
   docker network inspect coop-credits_coop-external
   ```

2. Test connectivity from container:
   ```bash
   docker exec coop-backend ping 172.20.1.255
   ```

3. Verify firewall rules:
   ```bash
   sudo ufw status verbose
   ```

### Webhooks not working

1. Check Nginx logs:
   ```bash
   tail -f docker/nginx/logs/access.log
   ```

2. Check backend logs:
   ```bash
   docker-compose -f docker-compose.prod.yml logs -f backend
   ```

3. Test webhook manually:
   ```bash
   curl -X POST https://coop.hobokenchicken.com/webhooks/tautulli \
     -H "Content-Type: application/json" \
     -d '{"test": true}'
   ```

### Database connection issues

1. Check database status:
   ```bash
   docker-compose -f docker-compose.prod.yml ps postgres
   ```

2. View database logs:
   ```bash
   docker-compose -f docker-compose.prod.yml logs postgres
   ```

3. Test connection:
   ```bash
   docker-compose -f docker-compose.prod.yml exec postgres pg_isready -U coop
   ```

## Maintenance

### Update Application

```bash
cd /opt/coop-credits
git pull
./deployment/deploy-production.sh
```

### Backup Database

```bash
# Automated backup
docker-compose -f docker-compose.prod.yml exec -T postgres pg_dump -U coop coop_credits > backup_$(date +%Y%m%d).sql
```

### View Logs

```bash
# All services
docker-compose -f docker-compose.prod.yml logs -f

# Specific service
docker-compose -f docker-compose.prod.yml logs -f backend
```

### Restart Services

```bash
docker-compose -f docker-compose.prod.yml restart backend
```

## Security Checklist

- [ ] Changed all default passwords in `.env`
- [ ] External reverse proxy (Caddy) configured for SSL
- [ ] Firewall rules configured
- [ ] Tautulli webhook secret set
- [ ] Overseer webhook secret set
- [ ] JWT secret is random and secure
- [ ] Database not exposed externally
- [ ] Redis password set
- [ ] Encryption key is random and backed up
- [ ] Solana mint authority key backed up securely

## Support

For issues:
1. Check health: `./deployment/health-check.sh`
2. Review logs: `docker-compose -f docker-compose.prod.yml logs`
3. Check documentation in `docs/INFRASTRUCTURE.md`