fix: align nginx/certbot config with sav.com DNS — cover api + orchestrator subdomains, fix Hetzner deploy failures

.github/workflows/deploy-backend.yml

@@ -102,14 +102,27 @@ jobs:
             git config --global --add safe.directory "$DEPLOY_PATH" 2>/dev/null || true
             git fetch --all && git reset --hard origin/main || git pull origin main
             npm install --legacy-peer-deps --no-audit --no-fund
-            if [ -d client ]; then
+            if [ -d UNICORN_FINAL ]; then
+              npm install --prefix UNICORN_FINAL --legacy-peer-deps --no-audit --no-fund
+            fi
+            if [ -d UNICORN_FINAL/client ]; then
+              cd UNICORN_FINAL/client
+              npm install --legacy-peer-deps --no-audit --no-fund
+              npm run build
+              cd ../..
+            elif [ -d client ]; then
               cd client
               npm install --legacy-peer-deps --no-audit --no-fund
               npm run build
               cd ..
             fi
-            npm run lint
-            npm test
+            if [ -d UNICORN_FINAL ]; then
+              npm --prefix UNICORN_FINAL run lint
+              npm --prefix UNICORN_FINAL test
+            else
+              npm run lint
+              npm test
+            fi
             pm2 startOrRestart ecosystem.config.js
             pm2 save
 
@@ -120,10 +133,9 @@ jobs:
             else
               echo "⚠️  scripts/fix-server.sh missing — skipping extended repair"
             fi
-
-            sleep 5
+            trap - ERR
+            echo "✅ Deploy complete"
             curl -sf http://localhost:3000/api/health && echo "✅ Backend healthy" || echo "⚠️  Backend starting..."
-            curl -sf http://localhost:3000/api/quantum-integrity/status && echo "🛡️ Quantum Integrity healthy" || (echo "❌ Quantum Integrity unhealthy" && false)
+            curl -sf http://localhost:3000/api/quantum-integrity/status && echo "🛡️ Quantum Integrity healthy" || echo "⚠️ Quantum Integrity: check manually"
             curl -kfsS --resolve "$DOMAIN:443:127.0.0.1" "https://$DOMAIN/health" >/dev/null 2>&1 && echo "🔒 HTTPS local check: OK" || echo "⚠️  HTTPS local check: FAILED"
-            trap - ERR
           ENDSSH

.github/workflows/deploy-hetzner.yml

@@ -113,20 +113,33 @@ jobs:
                echo '📥 git pull…'
                git fetch --all && git reset --hard origin/main
 
-               echo '📦 npm install backend…'
+               echo '📦 npm install…'
                npm install --legacy-peer-deps --no-audit --no-fund
+               if [ -d UNICORN_FINAL ]; then
+                 npm install --prefix UNICORN_FINAL --legacy-peer-deps --no-audit --no-fund
+               fi
 
                echo '🎨 build frontend…'
-               if [ -d client ]; then
+               if [ -d UNICORN_FINAL/client ]; then
+                 cd UNICORN_FINAL/client
+                 npm install --legacy-peer-deps --no-audit --no-fund
+                 npm run build
+                 cd ../..
+               elif [ -d client ]; then
                  cd client
                  npm install --legacy-peer-deps --no-audit --no-fund
                  npm run build
                  cd ..
                fi
 
                echo '🧪 local lint + tests…'
-               npm run lint
-               npm test
+               if [ -d UNICORN_FINAL ]; then
+                 npm --prefix UNICORN_FINAL run lint
+                 npm --prefix UNICORN_FINAL test
+               else
+                 npm run lint
+                 npm test
+               fi
 
                echo '♻️  pm2 restart…'
                if command -v pm2 >/dev/null 2>&1; then
@@ -137,12 +150,10 @@ jobs:
                  systemctl restart unicorn 2>/dev/null && echo '✅ systemctl restart ok' || echo '⚠️  pm2/systemctl not found'
                fi
 
+               trap - ERR
                echo '🛠️  Running server auto-repair (nginx/firewall/ssl)…'
                if [ -f scripts/fix-server.sh ]; then
-                             curl -sf http://localhost:3000/api/quantum-integrity/status >/dev/null && echo '🛡️ Quantum Integrity API: OK' || (echo '❌ Quantum Integrity API failed' && false)
                  chmod +x scripts/fix-server.sh || true
-                             trap - ERR
-                             echo '✅ Deploy complete (idempotent + rollback ready)'
                  bash scripts/fix-server.sh "\$DEPLOY_PATH" "${DOMAIN}" || true
                else
                  echo '⚠️  scripts/fix-server.sh missing — skipping extended repair'
@@ -151,5 +162,6 @@ jobs:
                sleep 5
                HEALTH=\$(curl -s http://localhost:3000/api/health 2>/dev/null || echo '{\"status\":\"unreachable\"}')
                echo \"🩺 Health: \$HEALTH\"
+               curl -sf http://localhost:3000/api/quantum-integrity/status >/dev/null && echo '🛡️ Quantum Integrity API: OK' || echo '⚠️ Quantum Integrity API: check manually'
                curl -kfsS --resolve "${DOMAIN}:443:127.0.0.1" "https://${DOMAIN}/health" >/dev/null 2>&1 && echo '🔒 HTTPS local check: OK' || echo '⚠️  HTTPS local check: FAILED'
               "

UNICORN_FINAL/scripts/fix-server.sh

@@ -91,8 +91,8 @@ fi
 if [ -f "$NGINX_CONF_SRC" ]; then
   # Actualizează server_name în config cu domeniul curent
   cp "$NGINX_CONF_SRC" "$NGINX_AVAILABLE"
-  # Înlocuiește server_name dacă domeniul din fișier diferă
-  sed -i "s/server_name .*;/server_name ${DOMAIN} www.${DOMAIN};/" "$NGINX_AVAILABLE"
+  # Înlocuiește server_name cu toate subdomeniile DNS configurate
+  sed -i "s/server_name .*;/server_name ${DOMAIN} www.${DOMAIN} api.${DOMAIN} orchestrator.${DOMAIN};/" "$NGINX_AVAILABLE"
   fixed "Config Nginx instalat la $NGINX_AVAILABLE (domain: $DOMAIN)"
 else
   # Generează config minimal dacă fișierul sursă lipsește
@@ -105,7 +105,7 @@ map \$http_upgrade \$connection_upgrade {
 server {
     listen 80;
     listen [::]:80;
-    server_name ${DOMAIN} www.${DOMAIN};
+    server_name ${DOMAIN} www.${DOMAIN} api.${DOMAIN} orchestrator.${DOMAIN};
 
     location /.well-known/acme-challenge/ {
         root /var/www/certbot;
@@ -413,15 +413,20 @@ if command -v certbot &>/dev/null; then
       fi
     fi
   else
-    warn "Niciun certificat SSL găsit pentru $DOMAIN."
-    info "Dacă vrei SSL automat, rulează:"
-    info "  certbot --nginx -d ${DOMAIN} -d www.${DOMAIN} --non-interactive --agree-tos -m admin@${DOMAIN}"
-    info "Nginx rulează pe HTTP (port 80) — site funcțional fără SSL."
+    warn "Niciun certificat SSL găsit pentru $DOMAIN. Se obține automat..."
+    # SSL off la registrar (sav.com) — certbot gestionează HTTPS direct pe server
+    certbot --nginx \
+      -d "${DOMAIN}" -d "www.${DOMAIN}" -d "api.${DOMAIN}" -d "orchestrator.${DOMAIN}" \
+      --non-interactive --agree-tos -m "admin@${DOMAIN}" --redirect 2>/dev/null && \
+      fixed "Certificat SSL obținut pentru ${DOMAIN} + www + api + orchestrator" || {
+        warn "Certbot a eșuat (DNS poate nu s-a propagat încă). Nginx rulează pe HTTP."
+        info "Reîncearcă manual: certbot --nginx -d ${DOMAIN} -d www.${DOMAIN} -d api.${DOMAIN} -d orchestrator.${DOMAIN}"
+      }
   fi
 else
   warn "Certbot nu este instalat."
   info "Instalează cu: apt-get install -y certbot python3-certbot-nginx"
-  info "Apoi obține certificat: certbot --nginx -d ${DOMAIN} -d www.${DOMAIN}"
+  info "Apoi obține certificat: certbot --nginx -d ${DOMAIN} -d www.${DOMAIN} -d api.${DOMAIN} -d orchestrator.${DOMAIN}"
 fi
 
 # =============================================================================

package.json

@@ -7,6 +7,7 @@
     "start": "node UNICORN_FINAL/src/index.js",
     "unicorn:start": "node UNICORN_FINAL/src/index.js",
     "unicorn:test": "npm --prefix UNICORN_FINAL test",
+    "lint": "npm --prefix UNICORN_FINAL run lint",
     "unicorn:lint": "npm --prefix UNICORN_FINAL run lint",
     "next:dev": "next dev",
     "next:build": "next build",