Update port configuration for multi-tenant deployment to avoid conflicts

Co-authored-by: Copilot <copilot@github.com>

MULTITENANT_DEPLOYMENT.md

@@ -14,7 +14,7 @@ Die optimierte Multi-Tenant-Architektur unterstützt **mehrere isolierte Instanz
 └─────────────────────────────────────────────────────────────┘
               ↓               ↓               ↓
     ┌──────────────┐ ┌──────────────┐ ┌──────────────┐
-    │  App :8001   │ │  App :8002   │ │  App :8003   │
+    │  App :10000  │ │  App :10002  │ │  App :10004  │
     │ schule1      │ │ schule2      │ │ schule3      │
     │ Tenant: t1   │ │ Tenant: t2   │ │ Tenant: t3   │
     │ 20 Users     │ │ 20 Users     │ │ 20 Users     │

config.yml

@@ -1,13 +0,0 @@
-tunnel: homeserver
-credentials-file: /etc/cloudflared/credentials.json
-
-ingress:
-  # Repo 1: Inventar
-  - hostname: inventar.maximiliangruendinger.de
-    service: http://inventory-app:3000
-
-  # Repo 2: Key-Service (Buchung)
-  - hostname: booking.maximiliangruendinger.de
-    service: http://key-service-app:8080 
-
-  - service: http_status:404

docker-compose-multitenant.yml

@@ -13,9 +13,7 @@ services:
     image: cloudflare/cloudflared:latest
     container_name: cloudflared
     restart: unless-stopped
-    profiles:
-      - cloudflare
-    command: ["--config", "/etc/cloudflared/config.yml", "tunnel", "run"]
+    command: tunnel run homeserver  # 'homeserver' must match your tunnel name
     volumes:
       - ./docker/cloudflared/config.yml:/etc/cloudflared/config.yml:ro
       - /etc/cloudflared/credentials.json:/etc/cloudflared/credentials.json:ro
@@ -47,8 +45,8 @@ services:
       redis:
         condition: service_started
     ports:
-      - "${INVENTAR_HTTP_PORT:-80}:80"
-      - "${INVENTAR_HTTPS_PORT:-8000}:8000"
+      - "${INVENTAR_HTTP_PORT:-10000}:80"
+      - "${INVENTAR_HTTPS_PORT:-10001}:8000"
     volumes:
       - ./docker/nginx/multitenant.conf:/etc/nginx/conf.d/default.conf
       - ./certs:/etc/nginx/certs:ro

install.sh

@@ -473,8 +473,8 @@ EOF
     if [ ! -f "$PROJECT_DIR/.docker-build.env" ]; then
         cat > "$TMP_DIR/.docker-build.env" <<EOF
 NUITKA_BUILD=0
-INVENTAR_HTTP_PORT=80
-INVENTAR_HTTPS_PORT=443
+INVENTAR_HTTP_PORT=10000
+INVENTAR_HTTPS_PORT=10001
 INVENTAR_APP_IMAGE=ghcr.io/aiirondev/legendary-octo-garbanzo:$tag
 EOF
         sudo install -m 644 "$TMP_DIR/.docker-build.env" "$PROJECT_DIR/.docker-build.env"

start.sh

@@ -15,8 +15,10 @@ if [ "$(id -u)" -ne 0 ] && command -v sudo >/dev/null 2>&1; then
 fi
 
 NUITKA_BUILD_VALUE="0"
-HTTP_PORT_VALUE="8001"
-HTTPS_PORT_VALUE="8443"
+HTTP_PORT_VALUE="10000"
+HTTPS_PORT_VALUE="10001"
+DEFAULT_TENANT_PORT_START="${INVENTAR_TENANT_PORT_START:-10000}"
+DEFAULT_TENANT_TLS_OFFSET="${INVENTAR_TENANT_TLS_OFFSET:-1}"
 CRON_SETUP_VALUE="${INVENTAR_SETUP_CRON:-1}"
 APP_IMAGE_VALUE="${INVENTAR_APP_IMAGE:-$APP_IMAGE_REPO:latest}"
 COMPOSE_FILE="docker-compose-multitenant.yml"
@@ -509,58 +511,49 @@ stop_host_nginx_services() {
     return 1
 }
 
+find_free_port_pair() {
+    local port="${1:-$DEFAULT_TENANT_PORT_START}"
+
+    while port_in_use "$port" || port_in_use "$((port + DEFAULT_TENANT_TLS_OFFSET))"; do
+        port=$((port + 2))
+    done
+
+    echo "$port"
+}
+
 configure_host_ports() {
-    local requested_http requested_https
+    local requested_http requested_https base_port
 
     requested_http=""
-    if [ -f "$ENV_FILE" ]; then
-        requested_http="$(awk -F= '/^INVENTAR_HTTP_PORT=/{print $2}' "$ENV_FILE" | tr -d ' ' || true)"
-    fi
-    if [ -z "$requested_http" ]; then
-        requested_http="8001"
-    fi
-
-    if stack_owns_host_port "$requested_http" "80"; then
-        HTTP_PORT_VALUE="$requested_http"
-    elif port_in_use "$requested_http"; then
-        
-
-        if ! port_in_use "$requested_http"; then
-            HTTP_PORT_VALUE="$requested_http"
-            echo "Freed HTTP port $requested_http by stopping host nginx service"
-        else
-            HTTP_PORT_VALUE="$(find_free_port 8080)"
-            echo "HTTP port is in use. Using fallback HTTP port: $HTTP_PORT_VALUE"
-        fi
-    else
-        HTTP_PORT_VALUE="$requested_http"
-    fi
-
     requested_https=""
     if [ -f "$ENV_FILE" ]; then
+        requested_http="$(awk -F= '/^INVENTAR_HTTP_PORT=/{print $2}' "$ENV_FILE" | tr -d ' ' || true)"
         requested_https="$(awk -F= '/^INVENTAR_HTTPS_PORT=/{print $2}' "$ENV_FILE" | tr -d ' ' || true)"
     fi
 
+    if [ -z "$requested_http" ]; then
+        requested_http="$DEFAULT_TENANT_PORT_START"
+    fi
     if [ -z "$requested_https" ]; then
-        requested_https="8443"
+        requested_https="$((requested_http + DEFAULT_TENANT_TLS_OFFSET))"
     fi
 
-    if stack_owns_host_port "$requested_https" "443"; then
-        HTTPS_PORT_VALUE="$requested_https"
-    elif port_in_use "$requested_https"; then
-        
-
-        if ! port_in_use "$requested_https"; then
-            HTTPS_PORT_VALUE="$requested_https"
-            echo "Freed HTTPS port $requested_https by stopping host nginx service"
-            return
-        fi
-
-        HTTPS_PORT_VALUE="$(find_free_port 8443)"
-        echo "HTTPS port is in use. Using fallback HTTPS port: $HTTPS_PORT_VALUE"
-    else
+    if stack_owns_host_port "$requested_http" "80" && stack_owns_host_port "$requested_https" "443"; then
+        HTTP_PORT_VALUE="$requested_http"
         HTTPS_PORT_VALUE="$requested_https"
+        return
     fi
+
+    if ! port_in_use "$requested_http" && ! port_in_use "$requested_https"; then
+        HTTP_PORT_VALUE="$requested_http"
+        HTTPS_PORT_VALUE="$requested_https"
+        return
+    fi
+
+    base_port="$(find_free_port_pair "$DEFAULT_TENANT_PORT_START")"
+    HTTP_PORT_VALUE="$base_port"
+    HTTPS_PORT_VALUE="$((base_port + DEFAULT_TENANT_TLS_OFFSET))"
+    echo "Tenant host ports are already occupied. Assigned new tenant ports: $HTTP_PORT_VALUE and $HTTPS_PORT_VALUE"
 }
 
 ensure_min_docker_disk_space() {
@@ -631,7 +624,7 @@ verify_stack_health() {
                printf '%s\n' "$running_services" | grep -Fxq nginx && \
                printf '%s\n' "$running_services" | grep -Fxq mongodb; then
                 if docker compose "${compose_args[@]}" exec -T app python3 -c "import flask, pymongo" >/dev/null 2>&1; then
-                    if curl -kfsS "https://127.0.0.1:$HTTPS_PORT_VALUE" >/dev/null 2>&1; then
+                    if curl -kfsSL "https://127.0.0.1:$HTTPS_PORT_VALUE/health" >/dev/null 2>&1; then
                         echo "Health check passed."
                         return 0
                     fi

update.sh

@@ -115,15 +115,42 @@ ensure_nginx_config_mount_source() {
 
     if [ ! -f "$config_path" ]; then
         cat > "$config_path" <<'EOF'
-    fi
-}
-
-server() {
+server {
     listen 80;
     server_name _;
     return 301 https://$host$request_uri;
 }
 
+server {
+    listen 443 ssl;
+    server_name _;
+
+    ssl_certificate /etc/nginx/certs/inventarsystem.crt;
+    ssl_certificate_key /etc/nginx/certs/inventarsystem.key;
+
+    client_max_body_size 50M;
+
+    location / {
+        proxy_pass http://app:8000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 300;
+    }
+
+    error_page 500 502 503 504 /50x.html;
+    location = /50x.html {
+        default_type text/html;
+        return 200 '<!doctype html><html><head><meta charset="utf-8"><title>Server Error</title></head><body><h1>Server Error</h1><p>The service is temporarily unavailable.</p></body></html>';
+    }
+}
+EOF
+        log_message "Recreated missing nginx config at $config_path"
+    fi
+}
+
 ensure_min_root_disk_space() {
     local available_kb available_mb
 
@@ -183,36 +210,6 @@ cleanup_docker_dangling_images() {
     fi
 }
 
-server {
-    listen 443 ssl;
-    server_name _;
-
-    ssl_certificate /etc/nginx/certs/inventarsystem.crt;
-    ssl_certificate_key /etc/nginx/certs/inventarsystem.key;
-
-    client_max_body_size 50M;
-
-    location / {
-        proxy_pass http://app:8000;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_read_timeout 300;
-    }
-
-    error_page 500 502 503 504 /50x.html;
-    location = /50x.html {
-        default_type text/html;
-        return 200 '<!doctype html><html><head><meta charset="utf-8"><title>Server Error</title></head><body><h1>Server Error</h1><p>The service is temporarily unavailable.</p></body></html>';
-    }
-}
-EOF
-        log_message "Recreated missing nginx config at $config_path"
-    fi
-}
-
 usage() {
     cat <<EOF
 Usage: $0 [options]
@@ -472,8 +469,8 @@ deploy() {
     if [ ! -f "$ENV_FILE" ]; then
         cat > "$ENV_FILE" <<EOF
 NUITKA_BUILD=0
-INVENTAR_HTTP_PORT=80
-INVENTAR_HTTPS_PORT=443
+INVENTAR_HTTP_PORT=10000
+INVENTAR_HTTPS_PORT=10001
 INVENTAR_APP_IMAGE=$app_image
 EOF
     elif grep -q '^INVENTAR_APP_IMAGE=' "$ENV_FILE"; then
@@ -511,8 +508,8 @@ verify_stack_health() {
         if printf '%s\n' "$running_services" | grep -Fxq app && \
            printf '%s\n' "$running_services" | grep -Fxq nginx && \
            printf '%s\n' "$running_services" | grep -Fxq mongodb; then
-            # Primary check: HTTP endpoint responds (most reliable)
-            if curl -kfsS "https://127.0.0.1:$https_port" >/dev/null 2>&1; then
+            # Primary check: health endpoint responds (most reliable)
+            if curl -kfsSL "https://127.0.0.1:$https_port/health" >/dev/null 2>&1; then
                 return 0
             fi
         fi