Production Setup

# Update system
sudo apt update && sudo apt upgrade -y

# Install essential packages
sudo apt install -y python3.10 python3-pip python3-venv \
  nodejs npm postgresql postgresql-contrib \
  nginx supervisor git build-essential

# Create dedicated user for security
sudo useradd -m -s /bin/bash interview
sudo usermod -aG sudo interview

sudo su - interview
git clone <repository-url> /home/interview/app
cd /home/interview/app

cd /home/interview/app/backend
touch .env
chmod 600 .env  # Secure permissions

# AI Configuration
MISTRAL_API_KEY=<your-production-mistral-key>
MISTRAL_MODEL=mistral-large-latest

# Security (GENERATE NEW KEYS!)
SECRET_KEY=$(python3 -c "import secrets; print(secrets.token_hex(32))")
JWT_SECRET_KEY=$(python3 -c "import secrets; print(secrets.token_hex(32))")

# Database
DATABASE_URL=postgresql://interview_user:secure_password@localhost:5432/interview_db

# Optional: AssemblyAI for voice interviews
ASSEMBLYAI_API_KEY=<your-assemblyai-key>

# PostgreSQL should already be installed from Step 1
sudo systemctl start postgresql
sudo systemctl enable postgresql

# Switch to postgres user
sudo -u postgres psql

-- Create database
CREATE DATABASE interview_db;

-- Create user with strong password
CREATE USER interview_user WITH ENCRYPTED PASSWORD 'your_secure_password_here';

-- Grant privileges
GRANT ALL PRIVILEGES ON DATABASE interview_db TO interview_user;

-- Exit
\q

class Config:
    # Use environment variable for database URL
    SQLALCHEMY_DATABASE_URI = os.getenv(
        'DATABASE_URL', 
        'sqlite:///interview_prep.db'  # Fallback for development
    )
    SQLALCHEMY_TRACK_MODIFICATIONS = False

# Export data from SQLite
sqlite3 instance/interview_prep.db .dump > backup.sql

# Convert and import to PostgreSQL
# (This requires manual SQL conversion for schema differences)

cd /home/interview/app/backend
python3 -m venv venv
source venv/bin/activate

pip install --upgrade pip
pip install -r requirements.txt

# For production, also install Gunicorn
pip install gunicorn eventlet

# Prepare knowledge base
python scripts/prepare_kb.py

# Build FAISS indices
python scripts/reindex_mistral.py

# Run migrations and create tables
python backend/app.py
# Press Ctrl+C after seeing "Database initialized"

import multiprocessing

# Server socket
bind = '127.0.0.1:8000'
backlog = 2048

# Worker processes
workers = multiprocessing.cpu_count() * 2 + 1
worker_class = 'eventlet'
worker_connections = 1000
timeout = 300  # 5 minutes for long-running AI operations
keepalive = 2

# Logging
accesslog = '/var/log/interview/gunicorn_access.log'
errorlog = '/var/log/interview/gunicorn_error.log'
loglevel = 'info'

# Process naming
proc_name = 'interview_backend'

# Server mechanics
daemon = False
pidfile = '/var/run/interview/gunicorn.pid'
user = 'interview'
group = 'interview'

sudo mkdir -p /var/log/interview /var/run/interview
sudo chown interview:interview /var/log/interview /var/run/interview

cd /home/interview/app/frontend
npm install --production

npm run build

const API_BASE_URL = process.env.REACT_APP_API_URL || 'https://api.yourdomain.com';
const WS_BASE_URL = process.env.REACT_APP_WS_URL || 'wss://api.yourdomain.com';

sudo apt install nginx -y

# Upstream backend
upstream backend {
    server 127.0.0.1:8000 fail_timeout=0;
}

server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;
    
    # Redirect to HTTPS
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name yourdomain.com www.yourdomain.com;
    
    # SSL Configuration
    ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    
    # Security headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    add_header X-XSS-Protection "1; mode=block" always;
    
    # Static files (React frontend)
    location / {
        root /home/interview/app/frontend/build;
        try_files $uri $uri/ /index.html;
        
        # Cache static assets
        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
            expires 1y;
            add_header Cache-Control "public, immutable";
        }
    }
    
    # Backend API
    location /api {
        proxy_pass http://backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # Increase timeout for AI operations
        proxy_read_timeout 300s;
        proxy_connect_timeout 300s;
    }
    
    # WebSocket support
    location /socket.io {
        proxy_pass http://backend;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # WebSocket timeout
        proxy_read_timeout 3600s;
    }
    
    # File uploads
    client_max_body_size 16M;
}

sudo ln -s /etc/nginx/sites-available/interview /etc/nginx/sites-enabled/
sudo nginx -t  # Test configuration
sudo systemctl restart nginx
sudo systemctl enable nginx

sudo apt install certbot python3-certbot-nginx -y

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

sudo certbot renew --dry-run

[program:interview_backend]
command=/home/interview/app/backend/venv/bin/gunicorn -c gunicorn_config.py app:app
directory=/home/interview/app/backend
user=interview
autostart=true
autorestart=true
startretries=3
redirect_stderr=true
stdout_logfile=/var/log/interview/supervisor.log
stdout_logfile_maxbytes=50MB
stdout_logfile_backups=10
environment=PATH="/home/interview/app/backend/venv/bin"

sudo supervisorctl reread
sudo supervisorctl update
sudo supervisorctl start interview_backend
sudo supervisorctl status

sudo systemctl enable supervisor

from flask_cors import CORS

# Replace:
# CORS(app, supports_credentials=True)

# With:
CORS(app, 
     supports_credentials=True,
     origins=[
         'https://yourdomain.com',
         'https://www.yourdomain.com'
     ],
     allow_headers=['Content-Type', 'Authorization'],
     expose_headers=['Content-Type', 'Authorization'],
     methods=['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS']
)

# View backend logs
sudo tail -f /var/log/interview/gunicorn_access.log
sudo tail -f /var/log/interview/gunicorn_error.log

# View Nginx logs
sudo tail -f /var/nginx/access.log
sudo tail -f /var/nginx/error.log

# Install htop for system monitoring
sudo apt install htop -y

# Install prometheus-node-exporter (optional)
sudo apt install prometheus-node-exporter -y

/var/log/interview/*.log {
    daily
    missingok
    rotate 14
    compress
    delaycompress
    notifempty
    create 0640 interview interview
    sharedscripts
    postrotate
        supervisorctl restart interview_backend > /dev/null 2>&1
    endscript
}

#!/bin/bash
BACKUP_DIR="/home/interview/backups/db"
DATE=$(date +%Y%m%d_%H%M%S)

mkdir -p $BACKUP_DIR
pg_dump -U interview_user interview_db | gzip > $BACKUP_DIR/interview_db_$DATE.sql.gz

# Keep only last 30 days
find $BACKUP_DIR -name "*.sql.gz" -mtime +30 -delete

chmod +x /home/interview/backup_db.sh

# Add to crontab (daily at 2 AM)
crontab -e
0 2 * * * /home/interview/backup_db.sh

#!/bin/bash
BACKUP_DIR="/home/interview/backups/faiss"
SOURCE_DIR="/home/interview/app/data/processed/faiss_mistral"
DATE=$(date +%Y%m%d)

mkdir -p $BACKUP_DIR
tar -czf $BACKUP_DIR/faiss_index_$DATE.tar.gz -C $SOURCE_DIR .

# Keep only last 7 days (large files)
find $BACKUP_DIR -name "*.tar.gz" -mtime +7 -delete

rsync -av --delete /home/interview/app/uploads/ /home/interview/backups/uploads/

# Install UFW
sudo apt install ufw -y

# Allow SSH, HTTP, HTTPS
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Enable firewall
sudo ufw enable
sudo ufw status

sudo apt install fail2ban -y
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

autoindex off;

limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;

location /api {
    limit_req zone=api burst=20 nodelay;
    # ... rest of config
}

location /api/login {
    limit_req zone=login burst=3 nodelay;
    # ... rest of config
}

# Check supervisor logs
sudo supervisorctl tail interview_backend stderr

# Check Gunicorn logs
tail -f /var/log/interview/gunicorn_error.log

# Test manually
cd /home/interview/app/backend
source venv/bin/activate
python app.py

# Verify PostgreSQL is running
sudo systemctl status postgresql

# Test connection
psql -U interview_user -d interview_db -h localhost

# Check DATABASE_URL in .env
cat backend/.env | grep DATABASE_URL

# Check if backend is running
sudo supervisorctl status interview_backend

# Check backend is listening
sudo netstat -tulpn | grep 8000

# Check Nginx error log
sudo tail -f /var/log/nginx/error.log

gzip on;
gzip_vary on;
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

SQLALCHEMY_ENGINE_OPTIONS = {
    'pool_size': 10,
    'pool_recycle': 3600,
    'pool_pre_ping': True,
}

@app.route('/health')
def health_check():
    return jsonify({
        'status': 'healthy',
        'database': 'connected' if db.session.execute('SELECT 1').scalar() == 1 else 'error',
        'timestamp': datetime.utcnow().isoformat()
    })