[CANOFY-112] Production Config (nginx, supervisor, SSL)¶

Type: Story
Epic: New Client Onboarding — Automated AWS + Frappe Provisioning
Stage key: production_setup (pipeline stage 12 of 15)
Component: utils/onboarding_executor.py

User Story¶

As an operations engineer,
I want the site switched into production mode with a valid SSL
certificate automatically,
so that the client's site is served over HTTPS by nginx/supervisor
without a manual bench setup production + Certbot session per client.

Description¶

Via SSM:

1. Fix the nginx log path issue (sed-based fix noted in prior operational
   experience — nginx's default log directory permissions/paths need
   adjusting before bench setup production succeeds cleanly).
2. bench setup production (non-interactively — pipe y to any prompts),
   bench setup supervisor, enable the scheduler.
3. Run Certbot non-interactively for the site's domain, only if real DNS
   is in place (i.e. only when the dns_record stage actually resolves
   the domain to this instance's IP — Certbot's HTTP-01 challenge fails
   without it).
4. If Certbot fails or DNS isn't ready (e.g. an IP-only test provision),
   record that SSL wasn't configured (ssl_configured=False in pipeline
   context) so later stages (frappe_config, smoke_test) fall back to
   reaching the site via http://<elastic_ip> with an explicit Host
   header instead of https://<site_name>.

Configuration / Prerequisites¶

• Depends on stage 4 (DNS record, if SSL is expected to succeed) and stage
  11 (apps installed — production config should happen after the app set is
  final, not before).
• Let's Encrypt/Certbot is rate-limited per domain — repeated failed retries
  against the same domain in a short window can exhaust the rate limit.

Acceptance Criteria¶

• nginx serves the site (HTTP at minimum, HTTPS when DNS/Certbot
  succeeded).
• Supervisor manages all Frappe processes (web, worker, scheduler) and
  they're running after this stage.
• Certbot failure does not fail the whole onboarding — falls back
  gracefully to the IP-override path for subsequent stages.
• Retrying this stage does not re-trigger Certbot unnecessarily if a
  valid cert already exists (avoid burning Let's Encrypt rate limit on
  retries).

Test Cases¶