site: pin deps to Nexus-available versions + regenerate lockfile via Nexus

The Docker build 404'd on @types/react@19.2.17 (not in the Nexus mirror; npmjs
is blocked upstream). Pin shared deps to the exact versions the main app uses
(@types/react 19.2.16, etc.) and regenerate package-lock.json against the Nexus
registry so every resolved tarball is one Nexus can serve.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/nginx-full.example.conf

@@ -0,0 +1,433 @@
+events { worker_connections 1024; }
+
+http {
+
+    upstream nexus_http         { server nexus:8081; }
+    upstream nexus_docker       { server nexus:5000; }
+    upstream nexus_ghcr         { server nexus:5001; }
+    upstream nexus_docker_group { server nexus:8082; }
+    upstream nexus_docker_host  { server nexus:8083; }
+
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        ''      close;
+    }
+
+    proxy_read_timeout    300s;
+    proxy_connect_timeout  60s;
+    proxy_send_timeout    300s;
+    client_max_body_size  1g;
+
+    # =========================================================
+    # Nexus UI — nexus.soroushasadi.com
+    # =========================================================
+    server {
+        listen 80;
+        server_name nexus.soroushasadi.com;
+        return 301 https://$host$request_uri;
+    }
+    server {
+        listen 443 ssl;
+        http2 on;
+        server_name nexus.soroushasadi.com;
+        client_max_body_size 1g;
+
+        ssl_certificate     /etc/ssl/soroushasadi/fullchain.pem;
+        ssl_certificate_key /etc/ssl/soroushasadi/privateKey.pem;
+
+        location / {
+            proxy_pass http://nexus_http;
+            proxy_set_header Host              $host;
+            proxy_set_header X-Real-IP         $remote_addr;
+            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+    }
+
+    # =========================================================
+    # Docker registry — mirror.soroushasadi.com
+    # =========================================================
+    server {
+        listen 80;
+        server_name mirror.soroushasadi.com;
+        return 301 https://$host$request_uri;
+    }
+    server {
+        listen 443 ssl;
+        http2 on;
+        server_name mirror.soroushasadi.com;
+
+        ssl_certificate     /etc/ssl/soroushasadi/fullchain.pem;
+        ssl_certificate_key /etc/ssl/soroushasadi/privateKey.pem;
+
+        client_max_body_size 0;
+        proxy_read_timeout   3600s;
+        proxy_send_timeout   3600s;
+        proxy_request_buffering off;
+
+        location /v2/token {
+            proxy_pass         http://nexus_docker_group;
+            proxy_set_header   Host              $http_host;
+            proxy_set_header   X-Real-IP         $remote_addr;
+            proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
+            proxy_set_header   X-Forwarded-Proto https;
+            proxy_buffering    off;
+        }
+
+        location /v2/docker-host/ {
+            proxy_pass         http://nexus_docker_host;
+            proxy_set_header   Host              $http_host;
+            proxy_set_header   X-Real-IP         $remote_addr;
+            proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
+            proxy_set_header   X-Forwarded-Proto https;
+            proxy_buffering    off;
+            proxy_hide_header  WWW-Authenticate;
+            add_header         WWW-Authenticate "Bearer realm=\"https://mirror.soroushasadi.com/v2/token\",service=\"mirror.soroushasadi.com\"" always;
+        }
+
+        location /v2/ {
+            proxy_pass         http://nexus_docker_group;
+            proxy_set_header   Host              $http_host;
+            proxy_set_header   X-Real-IP         $remote_addr;
+            proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
+            proxy_set_header   X-Forwarded-Proto https;
+            proxy_buffering    off;
+            proxy_hide_header  WWW-Authenticate;
+            add_header         WWW-Authenticate "Bearer realm=\"https://mirror.soroushasadi.com/v2/token\",service=\"mirror.soroushasadi.com\"" always;
+        }
+
+        location / {
+            proxy_pass         http://nexus_http;
+            proxy_set_header   Host              $http_host;
+            proxy_set_header   X-Real-IP         $remote_addr;
+            proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
+            proxy_set_header   X-Forwarded-Proto https;
+        }
+    }
+
+    # =========================================================
+    # Gitea — git.soroushasadi.com
+    # =========================================================
+    server {
+        listen 80;
+        server_name git.soroushasadi.com;
+        return 301 https://$host$request_uri;
+    }
+    server {
+        listen 443 ssl;
+        http2 on;
+        server_name git.soroushasadi.com;
+        client_max_body_size 300m;
+
+        ssl_certificate     /etc/ssl/soroushasadi/fullchain.pem;
+        ssl_certificate_key /etc/ssl/soroushasadi/privateKey.pem;
+
+        location / {
+            proxy_pass http://171.22.25.73:3000;
+            proxy_set_header Host              $host;
+            proxy_set_header X-Real-IP         $remote_addr;
+            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+    }
+
+    # =========================================================
+    # Docker Hub proxy (port 5000) — legacy
+    # =========================================================
+    server {
+        listen 5000;
+        server_name _;
+        location / {
+            proxy_pass http://nexus_docker;
+            proxy_set_header Host              $http_host;
+            proxy_set_header X-Real-IP         $remote_addr;
+            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_buffering off;
+        }
+    }
+
+    # =========================================================
+    # GHCR proxy (port 5001) — legacy
+    # =========================================================
+    server {
+        listen 5001;
+        server_name _;
+        location / {
+            proxy_pass http://nexus_ghcr;
+            proxy_set_header Host              $http_host;
+            proxy_set_header X-Real-IP         $remote_addr;
+            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_buffering off;
+        }
+    }
+
+    # =========================================================
+    # DrAletaha — draletaha.ir
+    # =========================================================
+    server {
+        listen 80;
+        server_name draletaha.ir;
+        return 301 https://$host$request_uri;
+    }
+    server {
+        listen 443 ssl;
+        http2 on;
+        server_name draletaha.ir;
+        client_max_body_size 25m;
+
+        ssl_certificate     /etc/ssl/draletaha/fullchain.pem;
+        ssl_certificate_key /etc/ssl/draletaha/privateKey.pem;
+
+        location / {
+            proxy_pass http://171.22.25.73:5010;
+            proxy_http_version 1.1;
+            proxy_set_header Host              $host;
+            proxy_set_header X-Real-IP         $remote_addr;
+            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Upgrade           $http_upgrade;
+            proxy_set_header Connection        $connection_upgrade;
+        }
+    }
+
+    # =========================================================
+    # Barg-e Vasat
+    #   bargevasat.ir / www      → marketing site (hokm-site :1520)
+    #   app.bargevasat.ir        → game (hokm-web :1500)
+    #   api.bargevasat.ir        → API + SignalR (hokm-server :1505)  [CDN bypass]
+    # All four A-records → 185.239.1.100
+    # =========================================================
+    server {
+        listen 80;
+        server_name bargevasat.ir www.bargevasat.ir app.bargevasat.ir api.bargevasat.ir;
+        location /.well-known/acme-challenge/ { root /var/www/certbot; }
+        location / { return 301 https://$host$request_uri; }
+    }
+
+    # Marketing site → hokm-site :1520
+    server {
+        listen 443 ssl;
+        http2 on;
+        server_name bargevasat.ir www.bargevasat.ir;
+        client_max_body_size 25m;
+        ssl_certificate     /etc/ssl/bargevasat/fullchain.pem;
+        ssl_certificate_key /etc/ssl/bargevasat/privateKey.pem;
+        location / {
+            proxy_pass http://171.22.25.73:1520;
+            proxy_set_header Host              $host;
+            proxy_set_header X-Real-IP         $remote_addr;
+            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+    }
+
+    # Game (Next static SPA) → hokm-web :1500
+    server {
+        listen 443 ssl;
+        http2 on;
+        server_name app.bargevasat.ir;
+        client_max_body_size 25m;
+        ssl_certificate     /etc/ssl/bargevasat/fullchain.pem;
+        ssl_certificate_key /etc/ssl/bargevasat/privateKey.pem;
+        location / {
+            proxy_pass http://171.22.25.73:1500;
+            proxy_set_header Host              $host;
+            proxy_set_header X-Real-IP         $remote_addr;
+            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+    }
+
+    # API + SignalR → hokm-server :1505 (WebSocket; keep this host's CDN bypassed)
+    server {
+        listen 443 ssl;
+        http2 on;
+        server_name api.bargevasat.ir;
+        client_max_body_size 50m;
+        ssl_certificate     /etc/ssl/bargevasat/fullchain.pem;
+        ssl_certificate_key /etc/ssl/bargevasat/privateKey.pem;
+        location / {
+            proxy_pass http://171.22.25.73:1505;
+            proxy_http_version 1.1;
+            proxy_set_header Host              $host;
+            proxy_set_header X-Real-IP         $remote_addr;
+            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Upgrade           $http_upgrade;
+            proxy_set_header Connection        $connection_upgrade;
+            proxy_read_timeout 3600s;
+        }
+    }
+
+    # =========================================================
+    # Meezi — meezi.ir + subdomains
+    # =========================================================
+    server {
+        listen 80;
+        server_name meezi.ir app.meezi.ir admin.meezi.ir koja.meezi.ir api.meezi.ir admin-api.meezi.ir;
+        return 301 https://$host$request_uri;
+    }
+    server {
+        listen 443 ssl;
+        http2 on;
+        server_name meezi.ir;
+        client_max_body_size 25m;
+        ssl_certificate     /etc/ssl/meezi/fullchain.pem;
+        ssl_certificate_key /etc/ssl/meezi/privateKey.pem;
+        location / {
+            proxy_pass http://171.22.25.73:3010;
+            proxy_http_version 1.1;
+            proxy_set_header Host              $host;
+            proxy_set_header X-Real-IP         $remote_addr;
+            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Upgrade           $http_upgrade;
+            proxy_set_header Connection        $connection_upgrade;
+        }
+    }
+    server {
+        listen 443 ssl;
+        http2 on;
+        server_name app.meezi.ir;
+        client_max_body_size 25m;
+        ssl_certificate     /etc/ssl/meezi/fullchain.pem;
+        ssl_certificate_key /etc/ssl/meezi/privateKey.pem;
+        location / {
+            proxy_pass http://171.22.25.73:3101;
+            proxy_http_version 1.1;
+            proxy_set_header Host              $host;
+            proxy_set_header X-Real-IP         $remote_addr;
+            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Upgrade           $http_upgrade;
+            proxy_set_header Connection        $connection_upgrade;
+        }
+    }
+    server {
+        listen 443 ssl;
+        http2 on;
+        server_name admin.meezi.ir;
+        client_max_body_size 25m;
+        ssl_certificate     /etc/ssl/meezi/fullchain.pem;
+        ssl_certificate_key /etc/ssl/meezi/privateKey.pem;
+        location / {
+            proxy_pass http://171.22.25.73:3102;
+            proxy_http_version 1.1;
+            proxy_set_header Host              $host;
+            proxy_set_header X-Real-IP         $remote_addr;
+            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Upgrade           $http_upgrade;
+            proxy_set_header Connection        $connection_upgrade;
+        }
+    }
+    server {
+        listen 443 ssl;
+        http2 on;
+        server_name koja.meezi.ir;
+        client_max_body_size 25m;
+        ssl_certificate     /etc/ssl/meezi/fullchain.pem;
+        ssl_certificate_key /etc/ssl/meezi/privateKey.pem;
+        location / {
+            proxy_pass http://171.22.25.73:3103;
+            proxy_http_version 1.1;
+            proxy_set_header Host              $host;
+            proxy_set_header X-Real-IP         $remote_addr;
+            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Upgrade           $http_upgrade;
+            proxy_set_header Connection        $connection_upgrade;
+        }
+    }
+    server {
+        listen 443 ssl;
+        http2 on;
+        server_name api.meezi.ir;
+        client_max_body_size 50m;
+        ssl_certificate     /etc/ssl/meezi/fullchain.pem;
+        ssl_certificate_key /etc/ssl/meezi/privateKey.pem;
+        location / {
+            proxy_pass http://171.22.25.73:5080;
+            proxy_http_version 1.1;
+            proxy_set_header Host              $host;
+            proxy_set_header X-Real-IP         $remote_addr;
+            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Upgrade           $http_upgrade;
+            proxy_set_header Connection        $connection_upgrade;
+            proxy_read_timeout 3600s;
+        }
+    }
+    server {
+        listen 443 ssl;
+        http2 on;
+        server_name admin-api.meezi.ir;
+        client_max_body_size 50m;
+        ssl_certificate     /etc/ssl/meezi/fullchain.pem;
+        ssl_certificate_key /etc/ssl/meezi/privateKey.pem;
+        location / {
+            proxy_pass http://171.22.25.73:5081;
+            proxy_http_version 1.1;
+            proxy_set_header Host              $host;
+            proxy_set_header X-Real-IP         $remote_addr;
+            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Upgrade           $http_upgrade;
+            proxy_set_header Connection        $connection_upgrade;
+            proxy_read_timeout 3600s;
+        }
+    }
+
+    # =========================================================
+    # soroushasadi.com
+    # =========================================================
+    server {
+        listen 80;
+        server_name soroushasadi.com www.soroushasadi.com;
+        return 301 https://$host$request_uri;
+    }
+    server {
+        listen 443 ssl;
+        http2 on;
+        server_name soroushasadi.com www.soroushasadi.com;
+        client_max_body_size 25m;
+        ssl_certificate     /etc/ssl/soroushasadi/fullchain.pem;
+        ssl_certificate_key /etc/ssl/soroushasadi/privateKey.pem;
+        location / {
+            proxy_pass http://171.22.25.73:3020;
+            proxy_set_header Host              $host;
+            proxy_set_header X-Real-IP         $remote_addr;
+            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+    }
+
+    # =========================================================
+    # Hamkadr — hamkadr.ir
+    # =========================================================
+    server {
+        listen 80;
+        server_name hamkadr.ir www.hamkadr.ir;
+        return 301 https://$host$request_uri;
+    }
+    server {
+        listen 443 ssl;
+        http2 on;
+        server_name hamkadr.ir www.hamkadr.ir;
+        client_max_body_size 25m;
+        ssl_certificate     /etc/ssl/soroushasadi/hamkadr/fullchain.pem;
+        ssl_certificate_key /etc/ssl/soroushasadi/hamkadr/privateKey.pem;
+        location / {
+            proxy_pass http://171.22.25.73:2569;
+            proxy_http_version 1.1;
+            proxy_set_header Host              $host;
+            proxy_set_header X-Real-IP         $remote_addr;
+            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Upgrade           $http_upgrade;
+            proxy_set_header Connection        $connection_upgrade;
+        }
+    }
+}

site/package.json

@@ -9,21 +9,21 @@
     "lint": "eslint"
   },
   "dependencies": {
-    "@fontsource-variable/vazirmatn": "^5.2.8",
-    "clsx": "^2.1.1",
-    "lucide-react": "^1.17.0",
+    "@fontsource-variable/vazirmatn": "5.2.8",
+    "clsx": "2.1.1",
+    "lucide-react": "1.17.0",
     "next": "16.2.7",
     "react": "19.2.4",
     "react-dom": "19.2.4"
   },
   "devDependencies": {
-    "@tailwindcss/postcss": "^4",
-    "@types/node": "^20",
-    "@types/react": "^19",
-    "@types/react-dom": "^19",
-    "eslint": "^9",
+    "@tailwindcss/postcss": "4.3.0",
+    "@types/node": "20.19.41",
+    "@types/react": "19.2.16",
+    "@types/react-dom": "19.2.3",
+    "eslint": "9.39.4",
     "eslint-config-next": "16.2.7",
-    "tailwindcss": "^4",
-    "typescript": "^5"
+    "tailwindcss": "4.3.0",
+    "typescript": "5.9.3"
   }
 }