Revert "Merge pull request 'Dev' (#60) from Dev into production"

This reverts commit 01fc2582b6, reversing
changes made to 821e96e011.

deploy/env/erpcore.env.example

@@ -0,0 +1,34 @@
+# /etc/erpcore/erpcore.env — settings + secrets for erpcore.service (production, erp.hexdive.com).
+#
+# Create once (docs/40-DEPLOYMENT.md, "Active" A.2):
+#   install -m 640 -o root -g erp deploy/env/erpcore.env.example /etc/erpcore/erpcore.env
+# then replace every CHANGE_ME / <port>. Never commit real values.
+#
+# Format rules (systemd EnvironmentFile, not a shell):
+#   • comments only on their own line — a trailing "# ..." becomes part of the value
+#   • ':' in a .NET config key becomes '__'
+#   • wrap a value in double quotes if it contains spaces, quotes or backslashes
+# After editing: Actions → "CI/CD - ERP Core" → Run workflow with deploy_backend.
+# (The test environment is on hold — see deploy/on-hold/README.md.)
+
+ASPNETCORE_ENVIRONMENT=Production
+# Must match deploy/apache/erp.hexdive.com.conf and BACKEND_PORT in .gitea/workflows/ci-cd.yml
+ASPNETCORE_URLS=http://127.0.0.1:5220
+
+ConnectionStrings__DefaultConnection=Host=127.0.0.1;Port=5432;Database=ERPCore;Username=erpcore;Password=CHANGE_ME
+
+AuthHex__BaseUrl=http://127.0.0.1:<authhex-port>
+# Door policy — set the real AuthHex user type / role codes.
+Auth__RequiredUserTypeCode=
+Auth__RequiredRoleCode=
+
+GeneralLedgerService__BaseUrl=http://127.0.0.1:<gl-port>/api/v1/
+GeneralLedgerService__ApiKey=CHANGE_ME
+
+# MUST be absolute and OUTSIDE /home/erp/core/publish — every backend deploy empties that folder.
+# The workflow's "Guard data paths" step refuses to deploy otherwise.
+FileStorage__RootPath=/var/lib/erpcore/hr-documents
+LogFile__Path=/var/log/erpcore/erpcore-.log
+
+# Production never seeds demo data.
+Seed__DemoData=false

deploy/systemd/erpcore.service

@@ -1,38 +1,32 @@
 # ERP-Core API — production (erp.hexdive.com).
 #
-# This unit holds only what never changes. Everything configurable — listening URL, connection
-# string, AuthHex/GL URLs, storage paths — is written by .gitea/workflows/ci-cd.yml into
-#   /etc/systemd/system/erpcore.service.d/10-erpcore-env.conf
-# on every backend deploy, from the values in that workflow's `env:` block plus Gitea secrets.
-# There is no /etc/erpcore/erpcore.env any more. To change a setting, edit the workflow and
-# redeploy (docs/40-DEPLOYMENT.md, "Active" A.2/A.3).
-#
-# The workflow installs this file itself, so editing it here and deploying is enough.
+# Install once (docs/40-DEPLOYMENT.md, "Active" A.2):
+#   cp deploy/systemd/erpcore.service /etc/systemd/system/
+#   systemctl daemon-reload && systemctl enable erpcore.service
+# .gitea/workflows/ci-cd.yml stops it, replaces /home/erp/core/publish, then starts it again.
 
 [Unit]
-Description=ERP core service
+Description=ERP-Core API (production)
 After=network-online.target postgresql-16.service
 Wants=network-online.target
-# Stop hammering the database if a release crash-loops: give up after 5 starts in 5 minutes
-# (systemd then reports "failed", which is what wait-healthy.sh watches for).
+# Stop hammering the database if a release crash-loops.
 StartLimitIntervalSec=300
 StartLimitBurst=5
 
 [Service]
 Type=simple
-User=erpuser
-Group=erpuser
+User=erp
+Group=erp
 WorkingDirectory=/home/erp/core/publish
 ExecStart=/home/erp/core/publish/ERPCore
-SyslogIdentifier=erpcore
-Environment=ASPNETCORE_ENVIRONMENT=Production
-Environment=DOTNET_PRINT_TELEMETRY_MESSAGE=false
+# Secrets + settings (template: deploy/env/erpcore.env.example).
+EnvironmentFile=/etc/erpcore/erpcore.env
 Environment=DOTNET_CLI_TELEMETRY_OPTOUT=1
-Restart=always
-RestartSec=10
+Restart=on-failure
+RestartSec=5
 TimeoutStopSec=30
 
-# Shared 8 GB VPS: a runaway process must not take Gitea/Postgres/AuthHex down with it.
+# Shared 8 GB VPS: a runaway process must not take Gitea/Postgres down with it.
 MemoryMax=768M
 
 # Hardening. No ProtectHome: the app itself lives under /home/erp.