Dharma ERP — OCI Infrastructure Operations Manual

Step 1 — Create a Bastion Session

1. OCI Console → Identity & Security → Bastion → bastion108dharma108erp
2. Create Session → Session type: Managed SSH
3. Target host: 10.0.2.89 · OS username: ubuntu
4. Upload public key: ~/.ssh/dharma-erp-prod.pub
5. Copy the SSH command shown after the session activates

Step 2 — Connect

Replace <SESSION-OCID> with the OCID from the new session:

ssh -i ~/.ssh/dharma-erp-prod \
  -o ProxyCommand="ssh -i ~/.ssh/dharma-erp-prod -W %h:%p -p 22 \
    <SESSION-OCID>@host.bastion.ap-hyderabad-1.oci.oraclecloud.com" \
  -p 22 ubuntu@10.0.2.89

Architecture

git push → GitHub → Actions workflow trigger
                         ↓
               Self-hosted runner (ON the OCI server — /opt/actions-runner)
                         ↓
               git pull → docker compose build → restart → health check

Pipeline

Runner Maintenance

sudo systemctl status actions.runner.*    # check runner is running
sudo systemctl restart actions.runner.*   # restart if needed
sudo journalctl -u actions.runner.* -f   # view live logs

Re-Installing the Runner (new server)

1. GitHub → Settings → Actions → Runners → New self-hosted runner (Linux/x64)
2. Run the config command with the registration token on the server in /opt/actions-runner
3. sudo ./svc.sh install ubuntu && sudo ./svc.sh start

The original ERP cert erp-letsencrypt was stored in OCI Certificate Service and covered only erp.srigaurangasamaj.com. It is no longer active on the listener — superseded by the combined cert below.

Current Certificate

DNS (Hostinger)

1. SSH to server via Bastion. Run:

   ~/.acme.sh/acme.sh --issue --dns \
     --yes-I-know-dns-manual-mode-enough-go-ahead-please \
     --server letsencrypt --keylength 2048 \
     -d srigaurangasamaj.com \
     -d www.srigaurangasamaj.com \
     -d erp.srigaurangasamaj.com

2. Add the three _acme-challenge TXT records to Hostinger DNS (values printed by acme.sh). Wait 5 min.
3. Run --renew (same flags). Then extract files:

   CERT_DIR=~/.acme.sh/srigaurangasamaj.com_ecc
   cat $CERT_DIR/srigaurangasamaj.com.cer   # leaf cert
   cat $CERT_DIR/fullchain.cer              # chain (intermediates)
   cat $CERT_DIR/srigaurangasamaj.com.key   # RSA private key

4. OCI Console → LB → Certificates → Add certificate → name all-domains-rsa-YYYYMMDD → type: Load balancer → paste leaf, chain, key.
5. OCI Console → LB → Listeners → https_443 → Edit → select new cert → Save.
6. Delete the three _acme-challenge TXT records from Hostinger.

Compose file: /opt/dharma-erp/dharma_erp/03_PLATFORM/infrastructure/config/docker-compose.yml

cd /opt/dharma-erp/dharma_erp/03_PLATFORM/infrastructure/config
sudo docker compose ps                          # check all containers
sudo docker compose logs -f fastapi             # tail backend logs
sudo docker compose exec nginx nginx -s reload  # hot-reload nginx config

# Run all migrations:
sudo bash /opt/dharma-erp/dharma_erp/03_PLATFORM/infrastructure/scripts/run-migrations.sh

# Run a specific seed (all seeds are idempotent — safe to re-run):
sudo docker exec -i dharma-postgres psql -U postgres dharma_erp \
  < /opt/dharma-erp/dharma_erp/03_PLATFORM/backend/seeds/013_trial_entity.sql

Rollback a Bad Deploy

cd /opt/dharma-erp
git log --oneline -10
git checkout <good-commit-hash>
cd dharma_erp/03_PLATFORM/infrastructure/config
sudo docker compose build fastapi nextjs website
sudo docker compose up -d --no-deps fastapi nextjs nginx website

Restore Database from Backup

oci os object list --bucket-name dharma-erp-backups --prefix backups/
oci os object get --bucket-name dharma-erp-backups \
  --name backups/daily/dharma_erp_<DATE>.sql.gz --file /tmp/restore.sql.gz
gunzip /tmp/restore.sql.gz
sudo docker exec -i dharma-postgres psql -U postgres dharma_erp < /tmp/restore.sql