---
description: SSH, Mikrotik, deploy scripts, dan konfigurasi server
globs: scripts/**/*,server/**/*
alwaysApply: false
---

# Infrastructure & Scripts

## PowerShell scripts (`scripts/`)

| Script | Fungsi |
|--------|--------|
| `setup-ssh-mikrotik.ps1` | Daftar SSH key ke Mikrotik (default RSA) |
| `ssh-mikrotik.ps1` | Login Mikrotik tanpa password |
| `ssh-remote.ps1` | SSH ke reverse proxy 10.100.1.24 |
| `deploy-geonet-console.ps1` | Build + deploy geonet-console |
| `deploy-databaselist.ps1` | Build + deploy databaselist |
| `apply-*-mikrotik.ps1` | Terapkan konfig RouterOS |

## Mikrotik

- Port SSH: **255**, MAC: `hmac-sha1`
- RouterOS 7.5: user key **RSA** (`id_rsa_mikrotik`), ed25519 butuh 7.12+
- Import key: upload `.pub` via SCP lalu `/user ssh-keys import`
- Konfig: `server/mikrotik-*.rsc`, checklist: `server/mikrotik-*-checklist.txt`
- Backup sebelum apply: simpan di `server/`

## Server audit

- Simpan hasil audit ke `server/<hostname>_audit.txt`
- Referensi host: `server/host.txt`, `readme.txt`

## Deploy remote

1. Sync kode ke server (tanpa `.env`)
2. `docker compose build` + `up -d` di `/opt/stacks/<app>/`
3. Verifikasi: `docker ps`, curl URL produksi

## Safety

- Backup `.rsc` sebelum ubah Mikrotik
- Rollback script tersedia: `rollback-single-wan-mikrotik.ps1`, `restore-failover-phase1-mikrotik.ps1`
- Jangan commit secret, key private, atau password