feat(deploy): add Jenkins production deployment pipeline

Reviewed-on: http://gitea.lan:3000/robbond/pleskSaas/pulls/29

.dockerignore

@@ -0,0 +1,13 @@
+node_modules
+.next
+.git
+*.log
+logs
+.env
+.env.*
+!.env.example
+.env.local
+.env.*.local
+.vscode
+.idea
+.DS_Store

.env.example

@@ -1,14 +1,22 @@
-NEXT_PUBLIC_SUPABASE_URL=
-NEXT_PUBLIC_SUPABASE_ANON_KEY=
-SUPABASE_SERVICE_ROLE_KEY=
+NODE_ENV=production
 
 NEXT_PUBLIC_APP_URL=http://localhost:3000
-JOB_SECRET=
-CRON_SECRET=
 
-ENCRYPTION_KEY=
+NEXT_PUBLIC_SUPABASE_URL=
+NEXT_PUBLIC_SUPABASE_ANON_KEY=
+SUPABASE_URL=
+SUPABASE_ANON_KEY=
+SUPABASE_SERVICE_ROLE_KEY=
+
 PLESK_CRED_ENC_KEY=
 
 STRIPE_SECRET_KEY=
 STRIPE_WEBHOOK_SECRET=
+
+CRON_SHARED_SECRET=
+
+# Existing runtime keys used by current codebase
+JOB_SECRET=
+CRON_SECRET=
+ENCRYPTION_KEY=
 STRIPE_PRICE_ID=

Dockerfile

@@ -0,0 +1,32 @@
+FROM cgr.dev/chainguard/node:20-dev AS deps
+WORKDIR /app
+
+COPY package.json package-lock.json ./
+RUN npm ci
+
+FROM cgr.dev/chainguard/node:20-dev AS builder
+WORKDIR /app
+
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+RUN npm run build
+
+FROM cgr.dev/chainguard/node:20-dev AS prod-deps
+WORKDIR /app
+
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev
+
+FROM cgr.dev/chainguard/node:20 AS runner
+WORKDIR /app
+
+ENV NODE_ENV=production
+
+COPY --from=prod-deps /app/node_modules ./node_modules
+COPY --from=builder /app/package.json ./package.json
+COPY --from=builder /app/next.config.mjs ./next.config.mjs
+COPY --from=builder /app/.next ./.next
+
+EXPOSE 3000
+
+CMD ["node", "node_modules/next/dist/bin/next", "start", "-H", "0.0.0.0", "-p", "3000"]

Jenkinsfile

@@ -0,0 +1,85 @@
+pipeline {
+  agent any
+
+  environment {
+    REGISTRY_IMAGE = "plesk-agency-portal"
+    IMAGE_LATEST = "${REGISTRY_IMAGE}:latest"
+    IMAGE_BUILD = "${REGISTRY_IMAGE}:build-${BUILD_NUMBER}"
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        checkout scm
+      }
+    }
+
+    stage('Install dependencies') {
+      steps {
+        sh 'npm ci'
+      }
+    }
+
+    stage('Lint') {
+      steps {
+        script {
+          def hasLint = sh(script: "node -e \"const fs=require('fs');const p=require('./package.json');process.exit(p?.scripts?.lint?0:1)\"", returnStatus: true)
+          if (hasLint == 0) {
+            sh 'npm run lint'
+          } else {
+            echo 'No lint script configured; skipping lint stage.'
+          }
+        }
+      }
+    }
+
+    stage('Build application') {
+      steps {
+        sh 'npm run build'
+      }
+    }
+
+    stage('Build Docker image') {
+      steps {
+        sh 'docker build -t ${IMAGE_LATEST} -t ${IMAGE_BUILD} .'
+      }
+    }
+
+    stage('Deploy') {
+      steps {
+        script {
+          if (!env.DEPLOY_SSH_CREDENTIAL_ID) {
+            error 'DEPLOY_SSH_CREDENTIAL_ID is required'
+          }
+        }
+        sshagent(credentials: ["${env.DEPLOY_SSH_CREDENTIAL_ID}"]) {
+          sh '''
+            set -euo pipefail
+            : "${DEPLOY_SSH_HOST:?Missing DEPLOY_SSH_HOST}"
+            : "${DEPLOY_SSH_USER:?Missing DEPLOY_SSH_USER}"
+            : "${DEPLOY_PATH:?Missing DEPLOY_PATH}"
+
+            rsync -az \
+              docker-compose.prod.yml \
+              scripts/deploy-prod.sh \
+              scripts/smoke-check.sh \
+              scripts/rollback-prod.sh \
+              ${DEPLOY_SSH_USER}@${DEPLOY_SSH_HOST}:${DEPLOY_PATH}/
+
+            docker save ${IMAGE_LATEST} ${IMAGE_BUILD} \
+              | ssh ${DEPLOY_SSH_USER}@${DEPLOY_SSH_HOST} 'docker load'
+
+            ssh ${DEPLOY_SSH_USER}@${DEPLOY_SSH_HOST} \
+              "chmod +x ${DEPLOY_PATH}/deploy-prod.sh ${DEPLOY_PATH}/smoke-check.sh ${DEPLOY_PATH}/rollback-prod.sh && APP_IMAGE='${IMAGE_BUILD}' DEPLOY_PATH='${DEPLOY_PATH}' ${DEPLOY_PATH}/deploy-prod.sh"
+          '''
+        }
+      }
+    }
+
+    stage('Smoke check') {
+      steps {
+        sh 'chmod +x scripts/smoke-check.sh && scripts/smoke-check.sh ${APP_BASE_URL}'
+      }
+    }
+  }
+}

app/api/cron/health/route.ts

@@ -0,0 +1,38 @@
+import { NextResponse } from "next/server";
+
+import { env } from "@/lib/env";
+import { runHealthCheckTick } from "@/lib/plesk/health";
+import { createSupabaseAdminClient } from "@/lib/supabase/admin";
+
+export async function POST(req: Request) {
+  const startedAt = Date.now();
+
+  try {
+    const secret = req.headers.get("x-cron-secret");
+    if (!env.cronSecret || !secret || secret !== env.cronSecret) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+
+    const supabase = createSupabaseAdminClient() as any;
+    const summary = await runHealthCheckTick(supabase);
+
+    return NextResponse.json({
+      ...summary,
+      duration_ms: Date.now() - startedAt,
+    });
+  } catch (error) {
+    console.error("[health cron] failed", error);
+
+    return NextResponse.json(
+      {
+        error: "Health check job failed",
+        checked: 0,
+        ok: 0,
+        degraded: 0,
+        failed: 0,
+        duration_ms: Date.now() - startedAt,
+      },
+      { status: 500 },
+    );
+  }
+}

app/api/health/route.ts

@@ -0,0 +1,13 @@
+import { NextResponse } from "next/server";
+
+export async function GET() {
+  return NextResponse.json(
+    {
+      ok: true,
+      service: "plesk-agency-portal",
+      timestamp: new Date().toISOString(),
+      environment: process.env.NODE_ENV ?? "development",
+    },
+    { status: 200 },
+  );
+}

app/api/plesk/instances/[id]/health/route.ts

@@ -0,0 +1,73 @@
+import { NextResponse } from "next/server";
+
+import { assertAgencyAdmin, getRouteAgencyContextOrThrow } from "@/lib/agency";
+import { assertRateLimit } from "@/lib/api/rate-limit";
+import { assertSameOrigin } from "@/lib/api/security";
+import { runInstanceHealthCheck } from "@/lib/plesk/health";
+import { createSupabaseRouteClient } from "@/lib/supabase/route";
+
+export async function POST(
+  req: Request,
+  { params }: { params: { id: string } },
+) {
+  try {
+    assertSameOrigin(req);
+
+    const context = await getRouteAgencyContextOrThrow();
+    assertAgencyAdmin(context);
+    assertRateLimit(`plesk-health-check:${context.userId}`, 20, 60_000);
+
+    const supabase = createSupabaseRouteClient() as any;
+
+    const { data: instance, error: instanceError } = await supabase
+      .from("plesk_instances")
+      .select(
+        "id, agency_id, base_url, auth_type, encrypted_secret, health_enabled, health_check_frequency_minutes, health_next_check_at, health_lock_until",
+      )
+      .eq("id", params.id)
+      .eq("agency_id", context.agencyId)
+      .single();
+
+    if (instanceError || !instance) {
+      throw new Error("Plesk instance not found");
+    }
+
+    const result = await runInstanceHealthCheck(supabase, instance, {
+      actorUserId: context.userId,
+      force: true,
+      source: "manual",
+    });
+
+    if (!result.checked) {
+      return NextResponse.json(
+        { error: "Health check is already running for this instance" },
+        { status: 409 },
+      );
+    }
+
+    const { data: updated } = await supabase
+      .from("plesk_instances")
+      .select(
+        "id, health_enabled, health_status, health_last_checked_at, health_last_ok_at, health_last_error, health_last_latency_ms, health_check_frequency_minutes, health_next_check_at",
+      )
+      .eq("id", params.id)
+      .eq("agency_id", context.agencyId)
+      .single();
+
+    return NextResponse.json({
+      ok: true,
+      result,
+      instance: updated,
+    });
+  } catch (error) {
+    return NextResponse.json(
+      {
+        error:
+          error instanceof Error
+            ? error.message
+            : "Health check execution failed",
+      },
+      { status: 400 },
+    );
+  }
+}

app/dashboard/page.tsx

@@ -1,6 +1,7 @@
 import { SignOutButton } from "@/components/auth/sign-out-button";
 import { DashboardControls } from "@/components/dashboard/dashboard-controls";
 import { getServerAgencyContextOrRedirect } from "@/lib/agency";
+import { formatDateTime } from "@/lib/dates";
 import type { Database } from "@/lib/types";
 import { createSupabaseServerClient } from "@/lib/supabase/server";
 import Link from "next/link";
@@ -17,6 +18,78 @@ type ActionLogSummary = Pick<
   Database["public"]["Tables"]["actions_log"]["Row"],
   "target_id" | "status" | "action" | "created_at" | "error_message"
 >;
+type AutosyncLatestLogSummary = Pick<
+  Database["public"]["Tables"]["actions_log"]["Row"],
+  "created_at"
+>;
+type HealthLogSummary = Pick<
+  Database["public"]["Tables"]["actions_log"]["Row"],
+  | "id"
+  | "target_id"
+  | "status"
+  | "action"
+  | "created_at"
+  | "error_message"
+  | "metadata"
+>;
+
+const RELATIVE_TIME_FORMATTER = new Intl.RelativeTimeFormat("en", {
+  numeric: "auto",
+});
+
+function getLatestTimestamp(values: Array<string | null | undefined>) {
+  let latestIso: string | null = null;
+  let latestMs = Number.NEGATIVE_INFINITY;
+
+  for (const value of values) {
+    if (!value) continue;
+    const parsed = new Date(value).getTime();
+    if (Number.isNaN(parsed)) continue;
+    if (parsed > latestMs) {
+      latestMs = parsed;
+      latestIso = value;
+    }
+  }
+
+  return latestIso;
+}
+
+function formatRelativeTime(value?: string | null) {
+  if (!value) return null;
+
+  const targetMs = new Date(value).getTime();
+  if (Number.isNaN(targetMs)) return null;
+
+  const deltaSeconds = Math.round((targetMs - Date.now()) / 1000);
+  const absSeconds = Math.abs(deltaSeconds);
+
+  if (absSeconds < 60) {
+    return RELATIVE_TIME_FORMATTER.format(deltaSeconds, "second");
+  }
+
+  const deltaMinutes = Math.round(deltaSeconds / 60);
+  if (Math.abs(deltaMinutes) < 60) {
+    return RELATIVE_TIME_FORMATTER.format(deltaMinutes, "minute");
+  }
+
+  const deltaHours = Math.round(deltaMinutes / 60);
+  if (Math.abs(deltaHours) < 24) {
+    return RELATIVE_TIME_FORMATTER.format(deltaHours, "hour");
+  }
+
+  const deltaDays = Math.round(deltaHours / 24);
+  if (Math.abs(deltaDays) < 30) {
+    return RELATIVE_TIME_FORMATTER.format(deltaDays, "day");
+  }
+
+  const deltaMonths = Math.round(deltaDays / 30);
+  if (Math.abs(deltaMonths) < 12) {
+    return RELATIVE_TIME_FORMATTER.format(deltaMonths, "month");
+  }
+
+  const deltaYears = Math.round(deltaMonths / 12);
+  return RELATIVE_TIME_FORMATTER.format(deltaYears, "year");
+}
 
 function normalizeDomainLike(value: string) {
   return value.trim().toLowerCase().replace(/\.$/, "");
@@ -49,6 +122,8 @@ export default async function DashboardPage() {
     { data: domains },
     { data: billing },
     { data: autoSyncLogs },
+    { data: latestAutoSyncLog },
+    { data: healthLogs },
   ] = (await Promise.all([
     supabase
       .from("agencies")
@@ -58,7 +133,7 @@ export default async function DashboardPage() {
     supabase
       .from("plesk_instances")
       .select(
-        "id, name, base_url, auth_type, status, error_message, last_connected_at, last_sync_at, last_sync_status, last_sync_error, last_sync_subscriptions, last_sync_domains, auto_sync_enabled, auto_sync_frequency_minutes, last_auto_sync_at, next_auto_sync_at, auto_sync_lock_until",
+        "id, name, base_url, auth_type, status, error_message, last_connected_at, last_sync_at, last_sync_status, last_sync_error, last_sync_subscriptions, last_sync_domains, auto_sync_enabled, auto_sync_frequency_minutes, last_auto_sync_at, next_auto_sync_at, auto_sync_lock_until, health_enabled, health_status, health_last_checked_at, health_last_ok_at, health_last_error, health_last_latency_ms, health_check_frequency_minutes, health_next_check_at, health_lock_until",
       )
       .eq("agency_id", context.agencyId)
       .order("created_at", { ascending: false }),
@@ -89,6 +164,31 @@ export default async function DashboardPage() {
       .eq("action", "plesk_sync_auto")
       .order("created_at", { ascending: false })
       .limit(200),
+    supabase
+      .from("actions_log")
+      .select("created_at")
+      .eq("agency_id", context.agencyId)
+      .eq("target_type", "plesk_instance")
+      .eq("action", "autosync_completed")
+      .eq("status", "success")
+      .order("created_at", { ascending: false })
+      .limit(1)
+      .maybeSingle(),
+    supabase
+      .from("actions_log")
+      .select(
+        "id, target_id, status, action, created_at, error_message, metadata",
+      )
+      .eq("agency_id", context.agencyId)
+      .eq("target_type", "plesk_instance")
+      .in("action", [
+        "health_check_started",
+        "health_check_ok",
+        "health_check_degraded",
+        "health_check_failed",
+      ])
+      .order("created_at", { ascending: false })
+      .limit(400),
   ])) as [
     { data: AgencySummary | null },
     {
@@ -110,6 +210,15 @@ export default async function DashboardPage() {
         last_auto_sync_at: string | null;
         next_auto_sync_at: string | null;
         auto_sync_lock_until: string | null;
+        health_enabled: boolean;
+        health_status: "ok" | "degraded" | "down" | "unknown";
+        health_last_checked_at: string | null;
+        health_last_ok_at: string | null;
+        health_last_error: string | null;
+        health_last_latency_ms: number | null;
+        health_check_frequency_minutes: number;
+        health_next_check_at: string | null;
+        health_lock_until: string | null;
       }> | null;
       error: { message: string } | null;
     },
@@ -138,6 +247,8 @@ export default async function DashboardPage() {
     },
     { data: BillingSummary | null },
     { data: ActionLogSummary[] | null },
+    { data: AutosyncLatestLogSummary | null },
+    { data: HealthLogSummary[] | null },
   ];
 
   const domainInstanceIds = Array.from(
@@ -230,6 +341,67 @@ export default async function DashboardPage() {
     });
   }
 
+  const healthEventsByInstance = new Map<
+    string,
+    Array<{
+      id: string;
+      action: string;
+      status: string;
+      created_at: string;
+      error_message: string | null;
+      metadata: unknown;
+    }>
+  >();
+
+  for (const log of healthLogs ?? []) {
+    if (!log.target_id) continue;
+    const existing = healthEventsByInstance.get(log.target_id) ?? [];
+    if (existing.length >= 10) continue;
+    existing.push({
+      id: log.id,
+      action: log.action,
+      status: log.status,
+      created_at: log.created_at,
+      error_message: log.error_message,
+      metadata: log.metadata,
+    });
+    healthEventsByInstance.set(log.target_id, existing);
+  }
+
+  const healthCounts = { ok: 0, degraded: 0, down: 0, unknown: 0 };
+
+  for (const instance of instances ?? []) {
+    const status = (instance.health_status ?? "unknown") as
+      | "ok"
+      | "degraded"
+      | "down"
+      | "unknown";
+    if (status === "ok") healthCounts.ok += 1;
+    else if (status === "degraded") healthCounts.degraded += 1;
+    else if (status === "down") healthCounts.down += 1;
+    else healthCounts.unknown += 1;
+  }
+
+  const latestHealthCheckAt = getLatestTimestamp(
+    (instances ?? []).map((instance) => instance.health_last_checked_at),
+  );
+
+  const autoSyncEnabledCount = (instances ?? []).filter(
+    (instance) => instance.auto_sync_enabled,
+  ).length;
+
+  const latestAutoSyncFromInstances = getLatestTimestamp(
+    (instances ?? []).map((instance) => instance.last_auto_sync_at),
+  );
+
+  const latestAutoSyncAt =
+    latestAutoSyncFromInstances ?? latestAutoSyncLog?.created_at ?? null;
+
+  const downInstanceNames = (instances ?? [])
+    .filter((instance) => instance.health_status === "down")
+    .slice(0, 3)
+    .map((instance) => instance.name || instance.base_url);
+
   return (
     <main className="mx-auto flex w-full max-w-6xl flex-col gap-6 px-6 py-8">
       <header className="flex items-center justify-between">
@@ -250,6 +422,89 @@ export default async function DashboardPage() {
         </div>
       </header>
 
+      <section className="rounded-xl border border-slate-200 bg-white p-4">
+        <div className="space-y-3 text-sm text-slate-700">
+          <div>
+            <p className="text-xs font-semibold uppercase tracking-wide text-slate-500">
+              Instance Health
+            </p>
+            <div className="mt-1 flex flex-wrap gap-2">
+              <span className="rounded bg-emerald-100 px-2 py-0.5 text-xs font-medium text-emerald-700">
+                Ok: {healthCounts.ok}
+              </span>
+              <span className="rounded bg-amber-100 px-2 py-0.5 text-xs font-medium text-amber-700">
+                Degraded: {healthCounts.degraded}
+              </span>
+              <span className="rounded bg-rose-100 px-2 py-0.5 text-xs font-medium text-rose-700">
+                Down: {healthCounts.down}
+              </span>
+              <span className="rounded bg-slate-100 px-2 py-0.5 text-xs font-medium text-slate-700">
+                Unknown: {healthCounts.unknown}
+              </span>
+            </div>
+          </div>
+
+          {healthCounts.down > 0 ? (
+            <div className="rounded border border-rose-200 bg-rose-50 px-3 py-2 text-xs text-rose-700">
+              {healthCounts.down} instance{healthCounts.down === 1 ? "" : "s"}{" "}
+              down
+              {downInstanceNames.length > 0
+                ? `: ${downInstanceNames.join(", ")}${healthCounts.down > downInstanceNames.length ? ", …" : ""}`
+                : ""}
+            </div>
+          ) : null}
+
+          <div className="flex flex-wrap gap-3">
+            <p>
+              <span className="font-medium text-slate-900">
+                Last Health Check:
+              </span>{" "}
+              <span
+                title={
+                  latestHealthCheckAt
+                    ? formatDateTime(latestHealthCheckAt)
+                    : undefined
+                }
+              >
+                {formatRelativeTime(latestHealthCheckAt) ?? "Never"}
+              </span>
+            </p>
+            <p>
+              <span className="font-medium text-slate-900">Auto Sync:</span>{" "}
+              Enabled on {autoSyncEnabledCount} instance
+              {autoSyncEnabledCount === 1 ? "" : "s"}
+            </p>
+            <p>
+              <span className="font-medium text-slate-900">Last run:</span>{" "}
+              <span
+                title={
+                  latestAutoSyncAt
+                    ? formatDateTime(latestAutoSyncAt)
+                    : undefined
+                }
+              >
+                {formatRelativeTime(latestAutoSyncAt) ?? "Not yet run"}
+              </span>
+            </p>
+          </div>
+
+          <div className="flex flex-wrap gap-2 pt-1">
+            <Link
+              href="/dashboard#instances-panel"
+              className="rounded border border-slate-300 px-3 py-1.5 text-xs font-medium text-slate-700"
+            >
+              Instances
+            </Link>
+            <Link
+              href="/dashboard/activity"
+              className="rounded border border-slate-300 px-3 py-1.5 text-xs font-medium text-slate-700"
+            >
+              Activity
+            </Link>
+          </div>
+        </div>
+      </section>
+
       <section className="grid gap-4 md:grid-cols-3">
         <div className="rounded-xl border border-slate-200 bg-white p-4">
           <p className="text-sm text-slate-500">Plesk Instances</p>
@@ -275,6 +530,7 @@ export default async function DashboardPage() {
           Instances query failed: {instancesError.message}
         </div>
       ) : null}
+      <section id="instances-panel">
         <DashboardControls
           instances={instances ?? []}
           subscriptions={subscriptions ?? []}
@@ -312,7 +568,11 @@ export default async function DashboardPage() {
             };
           })}
           autoSyncByInstance={Object.fromEntries(autoSyncByInstance.entries())}
+          healthEventsByInstance={Object.fromEntries(
+            healthEventsByInstance.entries(),
+          )}
         />
+      </section>
     </main>
   );
 }

components/dashboard/dashboard-controls.tsx

@@ -1,6 +1,6 @@
 "use client";
 
-import { useState } from "react";
+import { useEffect, useState } from "react";
 import type { ChangeEvent } from "react";
 import type { FormEvent } from "react";
 import { formatDateTime } from "@/lib/dates";
@@ -23,6 +23,15 @@ type Instance = {
   last_auto_sync_at: string | null;
   next_auto_sync_at: string | null;
   auto_sync_lock_until: string | null;
+  health_enabled: boolean;
+  health_status: "ok" | "degraded" | "down" | "unknown";
+  health_last_checked_at: string | null;
+  health_last_ok_at: string | null;
+  health_last_error: string | null;
+  health_last_latency_ms: number | null;
+  health_check_frequency_minutes: number;
+  health_next_check_at: string | null;
+  health_lock_until: string | null;
 };
 
 type Subscription = {
@@ -54,8 +63,44 @@ type Props = {
     string,
     { status: string; created_at: string; error_message: string | null }
   >;
+  healthEventsByInstance: Record<
+    string,
+    Array<{
+      id: string;
+      action: string;
+      status: string;
+      created_at: string;
+      error_message: string | null;
+      metadata: unknown;
+    }>
+  >;
 };
 
+function getHealthBadge(status: string | null) {
+  const normalized = (status ?? "unknown").toLowerCase();
+
+  if (normalized === "ok") {
+    return { label: "OK", className: "bg-emerald-100 text-emerald-700" };
+  }
+
+  if (normalized === "degraded") {
+    return { label: "Degraded", className: "bg-amber-100 text-amber-700" };
+  }
+
+  if (normalized === "down") {
+    return { label: "Down", className: "bg-rose-100 text-rose-700" };
+  }
+
+  return { label: "Unknown", className: "bg-slate-100 text-slate-600" };
+}
+
+function mapHealthResult(action: string) {
+  if (action === "health_check_ok") return "ok";
+  if (action === "health_check_degraded") return "degraded";
+  if (action === "health_check_failed") return "failed";
+  return "started";
+}
+
 function getDomainStatusBadge(status: string | null) {
   const normalized = (status ?? "unknown").toLowerCase();
 
@@ -115,12 +160,31 @@ function getDomainHref(domainName: string) {
   return `https://${normalized}`;
 }
 
+function getLatestTimestamp(values: Array<string | null | undefined>) {
+  let latest: string | null = null;
+  let latestMs = Number.NEGATIVE_INFINITY;
+
+  for (const value of values) {
+    if (!value) continue;
+    const ms = new Date(value).getTime();
+    if (Number.isNaN(ms)) continue;
+    if (ms > latestMs) {
+      latestMs = ms;
+      latest = value;
+    }
+  }
+
+  return latest;
+}
+
 export function DashboardControls({
   instances,
   subscriptions,
   domains,
   autoSyncByInstance,
+  healthEventsByInstance,
 }: Props) {
+  const hasInstances = instances.length > 0;
   const autoSyncFrequencyOptions = [15, 30, 60, 180, 360, 1440];
   const [instanceName, setInstanceName] = useState("");
   const [baseUrl, setBaseUrl] = useState("");
@@ -136,6 +200,72 @@ export function DashboardControls({
   const [domainStatus, setDomainStatus] = useState("all");
   const [message, setMessage] = useState<string | null>(null);
   const [loading, setLoading] = useState(false);
+  const [isConnectPanelOpen, setIsConnectPanelOpen] = useState(!hasInstances);
+  const [isInstancesPanelOpen, setIsInstancesPanelOpen] = useState(true);
+
+  useEffect(() => {
+    if (!hasInstances) {
+      setIsConnectPanelOpen(true);
+      return;
+    }
+
+    const savedState = window.localStorage.getItem(
+      "dashboard_connect_panel_open",
+    );
+
+    if (savedState === "true") {
+      setIsConnectPanelOpen(true);
+      return;
+    }
+
+    if (savedState === "false") {
+      setIsConnectPanelOpen(false);
+      return;
+    }
+
+    setIsConnectPanelOpen(false);
+  }, [hasInstances]);
+
+  useEffect(() => {
+    if (!hasInstances) return;
+
+    window.localStorage.setItem(
+      "dashboard_connect_panel_open",
+      isConnectPanelOpen ? "true" : "false",
+    );
+  }, [hasInstances, isConnectPanelOpen]);
+
+  useEffect(() => {
+    if (!hasInstances) {
+      setIsInstancesPanelOpen(true);
+      return;
+    }
+
+    const savedState = window.localStorage.getItem(
+      "dashboard_instances_panel_open",
+    );
+
+    if (savedState === "true") {
+      setIsInstancesPanelOpen(true);
+      return;
+    }
+
+    if (savedState === "false") {
+      setIsInstancesPanelOpen(false);
+      return;
+    }
+
+    setIsInstancesPanelOpen(true);
+  }, [hasInstances]);
+
+  useEffect(() => {
+    if (!hasInstances) return;
+
+    window.localStorage.setItem(
+      "dashboard_instances_panel_open",
+      isInstancesPanelOpen ? "true" : "false",
+    );
+  }, [hasInstances, isInstancesPanelOpen]);
 
   const healthCounts = instances.reduce(
     (acc, instance) => {
@@ -165,6 +295,30 @@ export function DashboardControls({
     return statusMatches && searchMatches;
   });
 
+  const instanceHealthSummary = instances.reduce(
+    (acc, instance) => {
+      const status = (instance.health_status ?? "unknown").toLowerCase();
+      if (status === "ok") acc.ok += 1;
+      else if (status === "degraded") acc.degraded += 1;
+      else if (status === "down") acc.down += 1;
+      else acc.unknown += 1;
+      return acc;
+    },
+    { ok: 0, degraded: 0, down: 0, unknown: 0 },
+  );
+
+  const autoSyncEnabledCount = instances.filter(
+    (instance) => instance.auto_sync_enabled,
+  ).length;
+
+  const latestInstanceSyncAt = getLatestTimestamp(
+    instances.map((instance) => instance.last_sync_at),
+  );
+
+  const latestInstanceHealthCheckAt = getLatestTimestamp(
+    instances.map((instance) => instance.health_last_checked_at),
+  );
+
   async function runRequest(url: string, body?: unknown) {
     const response = await fetch(url, {
       method: "POST",
@@ -245,6 +399,22 @@ export function DashboardControls({
     }
   }
 
+  async function onRunHealthCheck(instanceId: string) {
+    setLoading(true);
+    setMessage(null);
+    try {
+      await runRequest(`/api/plesk/instances/${instanceId}/health`);
+      setMessage("Health check completed.");
+      window.location.reload();
+    } catch (error) {
+      setMessage(
+        error instanceof Error ? error.message : "Health check failed",
+      );
+    } finally {
+      setLoading(false);
+    }
+  }
+
   async function onUpdateAutoSync(
     instanceId: string,
     input: { auto_sync_enabled: boolean; auto_sync_frequency_minutes: number },
@@ -354,11 +524,32 @@ export function DashboardControls({
       </div>
 
       <div className="grid gap-4 lg:grid-cols-2">
-        <form
-          onSubmit={onCreateInstance}
-          className="space-y-3 rounded-xl border border-slate-200 bg-white p-4"
+        <div className="rounded-xl border border-slate-200 bg-white p-4">
+          <div className="flex items-center justify-between gap-3">
+            <h2 className="text-lg font-semibold">
+              {hasInstances
+                ? "Connect another Plesk instance"
+                : "Connect Plesk Instance"}
+            </h2>
+            {hasInstances ? (
+              <button
+                type="button"
+                onClick={() => setIsConnectPanelOpen((open) => !open)}
+                className="rounded border border-slate-300 px-3 py-1.5 text-xs font-medium text-slate-700"
               >
-          <h2 className="text-lg font-semibold">Connect Plesk Instance</h2>
+                {isConnectPanelOpen ? "Hide" : "Add instance"}
+              </button>
+            ) : null}
+          </div>
+
+          {!isConnectPanelOpen && hasInstances ? (
+            <p className="mt-2 text-sm text-slate-500">
+              Add another server when needed.
+            </p>
+          ) : null}
+
+          {isConnectPanelOpen ? (
+            <form onSubmit={onCreateInstance} className="mt-3 space-y-3">
               <input
                 required
                 value={instanceName}
@@ -427,10 +618,49 @@ export function DashboardControls({
                 Save & Validate
               </button>
             </form>
+          ) : null}
+        </div>
 
         <div className="space-y-3 rounded-xl border border-slate-200 bg-white p-4">
+          <div className="flex items-center justify-between gap-3">
             <h2 className="text-lg font-semibold">Plesk Instances</h2>
+            {hasInstances ? (
+              <button
+                type="button"
+                onClick={() => setIsInstancesPanelOpen((open) => !open)}
+                className="rounded border border-slate-300 px-3 py-1.5 text-xs font-medium text-slate-700"
+              >
+                {isInstancesPanelOpen ? "Hide" : "Show"}
+              </button>
+            ) : null}
+          </div>
 
+          {!isInstancesPanelOpen && hasInstances ? (
+            <div className="rounded border border-slate-200 bg-slate-50 px-3 py-2 text-xs text-slate-700">
+              <p className="font-medium text-slate-900">
+                {instances.length} instance{instances.length === 1 ? "" : "s"}
+              </p>
+              <p className="mt-1">
+                Health — OK: {instanceHealthSummary.ok}, Degraded:{" "}
+                {instanceHealthSummary.degraded}, Down:{" "}
+                {instanceHealthSummary.down}, Unknown:{" "}
+                {instanceHealthSummary.unknown}
+              </p>
+              <p className="mt-1">
+                Auto-sync enabled on {autoSyncEnabledCount} instance
+                {autoSyncEnabledCount === 1 ? "" : "s"}
+              </p>
+              <p className="mt-1">
+                Last sync: {formatDateTime(latestInstanceSyncAt)}
+              </p>
+              <p className="mt-1">
+                Last health check: {formatDateTime(latestInstanceHealthCheckAt)}
+              </p>
+            </div>
+          ) : null}
+
+          {isInstancesPanelOpen ? (
+            <>
               <div className="space-y-2">
                 {instances.length === 0 ? (
                   <p className="text-sm text-slate-500">
@@ -442,17 +672,23 @@ export function DashboardControls({
                       key={instance.id}
                       className="rounded border border-slate-200 p-3"
                     >
+                      {(() => {
+                        const health = getHealthBadge(instance.health_status);
+
+                        return (
                           <div className="flex items-start justify-between gap-2">
                             <div>
                               {autoSyncByInstance[instance.id] ? (
                                 <span
                                   className={`inline-flex rounded px-2 py-0.5 text-[11px] font-medium ${
-                            autoSyncByInstance[instance.id].status === "success"
+                                    autoSyncByInstance[instance.id].status ===
+                                    "success"
                                       ? "bg-emerald-100 text-emerald-700"
                                       : "bg-rose-100 text-rose-700"
                                   }`}
                                 >
-                          Auto-sync {autoSyncByInstance[instance.id].status}
+                                  Auto-sync{" "}
+                                  {autoSyncByInstance[instance.id].status}
                                 </span>
                               ) : null}
                               <p className="text-sm font-semibold text-slate-900">
@@ -463,10 +699,36 @@ export function DashboardControls({
                               </p>
                               <p className="mt-1 text-xs text-slate-600">
                                 Status:{" "}
-                        <span className="font-medium">{instance.status}</span>
+                                <span className="font-medium">
+                                  {instance.status}
+                                </span>
                               </p>
                               <p className="text-xs text-slate-500">
-                        Subscriptions: {instance.last_sync_subscriptions ?? 0}
+                                Health:{" "}
+                                <span
+                                  title={
+                                    instance.health_last_error ?? undefined
+                                  }
+                                  className={`inline-flex rounded px-2 py-0.5 text-[11px] font-medium ${health.className}`}
+                                >
+                                  {health.label}
+                                </span>
+                              </p>
+                              <p className="text-xs text-slate-500">
+                                Health last checked:{" "}
+                                {formatDateTime(
+                                  instance.health_last_checked_at,
+                                )}
+                              </p>
+                              <p className="text-xs text-slate-500">
+                                Health latency:{" "}
+                                {instance.health_last_latency_ms != null
+                                  ? `${instance.health_last_latency_ms} ms`
+                                  : "—"}
+                              </p>
+                              <p className="text-xs text-slate-500">
+                                Subscriptions:{" "}
+                                {instance.last_sync_subscriptions ?? 0}
                               </p>
                               <p className="text-xs text-slate-500">
                                 Domains: {instance.last_sync_domains ?? 0}
@@ -477,7 +739,8 @@ export function DashboardControls({
                                   className={`inline-flex rounded px-2 py-0.5 text-[11px] font-medium ${
                                     instance.last_sync_status === "success"
                                       ? "bg-emerald-100 text-emerald-700"
-                              : instance.last_sync_status === "failed" ||
+                                      : instance.last_sync_status ===
+                                            "failed" ||
                                           instance.last_sync_status === "error"
                                         ? "bg-rose-100 text-rose-700"
                                         : "bg-slate-100 text-slate-600"
@@ -487,7 +750,8 @@ export function DashboardControls({
                                 </span>
                               </p>
                               <p className="text-xs text-slate-500">
-                        Last sync time: {formatDateTime(instance.last_sync_at)}
+                                Last sync time:{" "}
+                                {formatDateTime(instance.last_sync_at)}
                               </p>
                               <p className="text-xs text-slate-500">
                                 Last connected:{" "}
@@ -497,7 +761,9 @@ export function DashboardControls({
                               </p>
                               <p className="text-xs text-slate-500">
                                 Auto-sync:{" "}
-                        {instance.auto_sync_enabled ? "Enabled" : "Disabled"}
+                                {instance.auto_sync_enabled
+                                  ? "Enabled"
+                                  : "Disabled"}
                               </p>
                               <p className="text-xs text-slate-500">
                                 Auto-sync frequency:{" "}
@@ -514,8 +780,9 @@ export function DashboardControls({
                               <p className="text-xs text-slate-500">
                                 Lock status:{" "}
                                 {instance.auto_sync_lock_until &&
-                        new Date(instance.auto_sync_lock_until).getTime() >
-                          Date.now()
+                                new Date(
+                                  instance.auto_sync_lock_until,
+                                ).getTime() > Date.now()
                                   ? "Sync in progress"
                                   : "Idle"}
                               </p>
@@ -537,10 +804,22 @@ export function DashboardControls({
                                   Last sync error: {instance.last_sync_error}
                                 </p>
                               ) : null}
-                      {autoSyncByInstance[instance.id]?.error_message ? (
+                              {autoSyncByInstance[instance.id]
+                                ?.error_message ? (
                                 <p className="mt-1 text-xs text-rose-600">
                                   Auto-sync error:{" "}
-                          {autoSyncByInstance[instance.id].error_message}
+                                  {
+                                    autoSyncByInstance[instance.id]
+                                      .error_message
+                                  }
+                                </p>
+                              ) : null}
+                              {instance.health_last_error ? (
+                                <p
+                                  className="mt-1 text-xs text-rose-600"
+                                  title={instance.health_last_error}
+                                >
+                                  Health error: {instance.health_last_error}
                                 </p>
                               ) : null}
                             </div>
@@ -552,11 +831,14 @@ export function DashboardControls({
                                 <input
                                   type="checkbox"
                                   checked={instance.auto_sync_enabled}
-                          onChange={(e: ChangeEvent<HTMLInputElement>) =>
+                                  onChange={(
+                                    e: ChangeEvent<HTMLInputElement>,
+                                  ) =>
                                     onUpdateAutoSync(instance.id, {
                                       auto_sync_enabled: e.target.checked,
                                       auto_sync_frequency_minutes:
-                                instance.auto_sync_frequency_minutes ?? 60,
+                                        instance.auto_sync_frequency_minutes ??
+                                        60,
                                     })
                                   }
                                   disabled={loading}
@@ -568,8 +850,11 @@ export function DashboardControls({
                                 )}
                                 onChange={(e: ChangeEvent<HTMLSelectElement>) =>
                                   onUpdateAutoSync(instance.id, {
-                            auto_sync_enabled: instance.auto_sync_enabled,
-                            auto_sync_frequency_minutes: Number(e.target.value),
+                                    auto_sync_enabled:
+                                      instance.auto_sync_enabled,
+                                    auto_sync_frequency_minutes: Number(
+                                      e.target.value,
+                                    ),
                                   })
                                 }
                                 disabled={loading}
@@ -588,6 +873,13 @@ export function DashboardControls({
                               >
                                 Test Connection
                               </button>
+                              <button
+                                onClick={() => onRunHealthCheck(instance.id)}
+                                disabled={loading}
+                                className="rounded border px-3 py-1.5 text-xs"
+                              >
+                                Run Health Check
+                              </button>
                               <button
                                 onClick={() => onSync(instance.id)}
                                 disabled={loading}
@@ -597,13 +889,119 @@ export function DashboardControls({
                               </button>
                             </div>
                           </div>
+                        );
+                      })()}
+
+                      <div className="mt-3 rounded border border-slate-100 bg-slate-50 p-3">
+                        <p className="text-xs font-semibold uppercase tracking-wide text-slate-600">
+                          Health Panel
+                        </p>
+                        <div className="mt-2 grid gap-1 text-xs text-slate-600 sm:grid-cols-2">
+                          <p>
+                            Current Status:{" "}
+                            <span className="font-medium">
+                              {getHealthBadge(instance.health_status).label}
+                            </span>
+                          </p>
+                          <p>
+                            Last Checked:{" "}
+                            <span className="font-medium">
+                              {formatDateTime(instance.health_last_checked_at)}
+                            </span>
+                          </p>
+                          <p>
+                            Last Successful Check:{" "}
+                            <span className="font-medium">
+                              {formatDateTime(instance.health_last_ok_at)}
+                            </span>
+                          </p>
+                          <p>
+                            Latency:{" "}
+                            <span className="font-medium">
+                              {instance.health_last_latency_ms != null
+                                ? `${instance.health_last_latency_ms} ms`
+                                : "—"}
+                            </span>
+                          </p>
+                          <p className="sm:col-span-2">
+                            Last Error:{" "}
+                            <span className="font-medium">
+                              {instance.health_last_error ?? "—"}
+                            </span>
+                          </p>
+                        </div>
+
+                        <div className="mt-3 overflow-x-auto">
+                          <table className="min-w-full text-left text-xs">
+                            <thead>
+                              <tr className="border-b border-slate-200 text-slate-500">
+                                <th className="px-2 py-1">Time</th>
+                                <th className="px-2 py-1">Event</th>
+                                <th className="px-2 py-1">Result</th>
+                                <th className="px-2 py-1">Message</th>
+                              </tr>
+                            </thead>
+                            <tbody>
+                              {(healthEventsByInstance[instance.id] ?? [])
+                                .length === 0 ? (
+                                <tr>
+                                  <td
+                                    className="px-2 py-2 text-slate-500"
+                                    colSpan={4}
+                                  >
+                                    No health events yet.
+                                  </td>
+                                </tr>
+                              ) : (
+                                (healthEventsByInstance[instance.id] ?? []).map(
+                                  (event) => (
+                                    <tr
+                                      key={event.id}
+                                      className="border-b border-slate-100 align-top"
+                                    >
+                                      <td className="px-2 py-1">
+                                        {formatDateTime(event.created_at)}
+                                      </td>
+                                      <td className="px-2 py-1">
+                                        {event.action}
+                                      </td>
+                                      <td className="px-2 py-1">
+                                        {mapHealthResult(event.action)}
+                                      </td>
+                                      <td className="px-2 py-1">
+                                        {event.error_message ?? "—"}
+                                        {event.metadata ? (
+                                          <details>
+                                            <summary className="cursor-pointer text-[11px] text-brand-700">
+                                              metadata
+                                            </summary>
+                                            <pre className="mt-1 max-w-[440px] overflow-auto rounded bg-white p-2 text-[10px] text-slate-700">
+                                              {JSON.stringify(
+                                                event.metadata,
+                                                null,
+                                                2,
+                                              )}
+                                            </pre>
+                                          </details>
+                                        ) : null}
+                                      </td>
+                                    </tr>
+                                  ),
+                                )
+                              )}
+                            </tbody>
+                          </table>
+                        </div>
+                      </div>
                     </div>
                   ))
                 )}
               </div>
 
               <div className="space-y-2">
-            <label className="text-sm font-medium">Subscription Action</label>
+                <label className="text-sm font-medium">
+                  Subscription Action
+                </label>
                 <select
                   value={actionSubId}
                   onChange={(e: ChangeEvent<HTMLSelectElement>) =>
@@ -653,7 +1051,11 @@ export function DashboardControls({
                 </button>
               </div>
 
-          {message ? <p className="text-sm text-slate-600">{message}</p> : null}
+              {message ? (
+                <p className="text-sm text-slate-600">{message}</p>
+              ) : null}
+            </>
+          ) : null}
         </div>
 
         <div className="space-y-3 rounded-xl border border-slate-200 bg-white p-4 lg:col-span-2">

docker-compose.prod.yml

@@ -0,0 +1,24 @@
+services:
+  web:
+    container_name: plesk-agency-portal
+    image: ${APP_IMAGE:-plesk-agency-portal:latest}
+    build:
+      context: .
+      dockerfile: Dockerfile
+    restart: unless-stopped
+    env_file:
+      - .env
+    ports:
+      - "3000:3000"
+    healthcheck:
+      test:
+        [
+          "CMD",
+          "node",
+          "-e",
+          "fetch('http://127.0.0.1:3000/api/health').then((r)=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))",
+        ]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 20s

docs/cline-super-prompt.md

@@ -0,0 +1,202 @@
+# Cline Development Super Prompt
+
+You are acting as a senior software engineer working on this repository.
+
+Before making any modifications you must understand the project structure and current implementation.
+
+Always read:
+
+`docs/ai-project-context.md`
+
+before implementing tasks.
+
+---
+
+## Working Method
+
+When given a task follow this process.
+
+Step 1  
+Search the repository for relevant code.
+
+Step 2  
+Identify the correct extension point for the feature.
+
+Step 3  
+Design the minimal safe implementation.
+
+Step 4  
+Modify only the required files.
+
+Step 5  
+Verify existing functionality remains intact.
+
+Never rewrite large parts of the system unless explicitly instructed.
+
+---
+
+## Repository Exploration Rules
+
+Before editing files:
+
+Search for related implementations.
+
+Look for:
+
+- plesk integration
+- sync logic
+- API routes
+- database queries
+- dashboard components
+
+Use existing patterns instead of creating new ones.
+
+---
+
+## Database Rules
+
+The project uses Supabase Postgres.
+
+Never introduce breaking schema changes.
+
+All schema updates must be done using safe migrations.
+
+Never remove columns that may contain production data.
+
+Always assume the database already contains data.
+
+---
+
+## Multi-Tenant Security
+
+This system is multi-tenant.
+
+Users belong to agencies.
+
+All queries must respect agency boundaries.
+
+Never bypass Supabase Row Level Security.
+
+Never expose data across agencies.
+
+---
+
+## Plesk Integration Safety
+
+The platform interacts with Plesk servers using both REST API and CLI commands.
+
+CLI output can vary between Plesk versions.
+
+Always parse CLI output defensively.
+
+Never assume fixed output formatting.
+
+External integration failures must not crash the application.
+
+---
+
+## Sync Pipeline Rules
+
+The sync system is critical to the platform.
+
+Never break existing sync behaviour.
+
+If one subscription fails during sync:
+
+Continue processing the rest.
+
+Log the failure.
+
+Do not abort the entire sync job.
+
+---
+
+## Logging Requirements
+
+Operational events should be written to:
+
+`actions_log`
+
+Examples include:
+
+- instance_connected
+- sync_started
+- sync_completed
+- subscription_suspended
+- subscription_unsuspended
+
+Logging errors must never break primary workflows.
+
+---
+
+## UI Safety
+
+Frontend components must:
+
+Handle missing or null data safely.
+
+Avoid crashing when API responses change.
+
+Display statuses using badges instead of raw text.
+
+---
+
+## Git Workflow
+
+The repository uses:
+
+`master` as the default branch.
+
+All development must occur in feature branches.
+
+Example workflow:
+
+```bash
+git checkout master
+git pull
+git checkout -b feature/<feature-name>
+```
+
+Commit frequently with clear commit messages.
+
+Never commit directly to master.
+
+---
+
+## Implementation Guidelines
+
+Prefer small modular changes.
+
+Avoid large refactors unless requested.
+
+Keep API routes lightweight.
+
+Place integration logic inside lib folders.
+
+Reuse existing utilities where possible.
+
+---
+
+## Error Handling
+
+External services can fail.
+
+Always implement safe error handling.
+
+Prefer returning partial results over failing the entire operation.
+
+Log unexpected behaviour.
+
+---
+
+## Expected Output
+
+When implementing tasks you should:
+
+Modify only the required files.
+
+Maintain existing architecture.
+
+Add clear commit messages.
+
+Ensure the application remains stable.

docs/deployment-production.md

@@ -0,0 +1,121 @@
+# Production Deployment Runtime Foundation
+
+This project can be deployed in a dedicated Proxmox container using Docker Compose. The files added here establish a minimal production runtime baseline without changing application business logic or Supabase security boundaries.
+
+## Dockerfile purpose
+
+The `Dockerfile` uses a multi-stage build on Node 20:
+
+- installs dependencies
+- runs `next build`
+- prepares a lean runtime image with production dependencies
+- runs the app with `next start` on port `3000`
+
+This keeps the runtime image small and focused on serving the built Next.js app.
+
+## docker-compose.prod.yml purpose
+
+`docker-compose.prod.yml` defines one service:
+
+- service name: `web`
+- container name: `plesk-agency-portal`
+- restart policy: `unless-stopped`
+- environment from `.env`
+- port mapping `3000:3000`
+- health check against `/api/health`
+
+## External Supabase requirement
+
+Supabase remains external to this application container. The app container must only connect to Supabase via environment variables. No local Supabase container is included in this production compose file.
+
+## Health endpoint usage
+
+`GET /api/health` provides a fast, dependency-light runtime check for container orchestration and uptime checks.
+
+Example:
+
+```bash
+curl -s http://localhost:3000/api/health
+```
+
+Expected response shape:
+
+- `ok: true`
+- `service: "plesk-agency-portal"`
+- `timestamp`
+- `environment`
+
+## Production environment expectations
+
+Before deploying, set production-safe values in `.env` (using `.env.example` as the template), including:
+
+- app URL and `NODE_ENV`
+- Supabase public and server credentials
+- Plesk credential encryption key
+- Stripe secrets
+- cron/job shared secrets
+
+Keep secrets out of source control.
+
+## Jenkins pipeline flow
+
+The repository includes a declarative `Jenkinsfile` with the following stages:
+
+1. **Checkout**
+2. **Install dependencies** (`npm ci`)
+3. **Lint** (runs only when `package.json` contains a `lint` script)
+4. **Build application** (`npm run build`)
+5. **Build Docker image** (tags `latest` and `build-${BUILD_NUMBER}`)
+6. **Deploy** over SSH to the app host
+7. **Smoke check** against `/api/health`
+
+## Required Jenkins configuration
+
+Configure these values in Jenkins job/folder/global environment or credentials-backed environment variables:
+
+- `DEPLOY_SSH_HOST` - remote app host
+- `DEPLOY_SSH_USER` - SSH user on remote host
+- `DEPLOY_SSH_CREDENTIAL_ID` - Jenkins SSH Agent credential ID
+- `DEPLOY_PATH` - remote deployment path (for example `/opt/plesk-agency-portal`)
+- `APP_BASE_URL` - externally reachable app URL used by smoke check
+
+The pipeline assumes Jenkins credentials are managed outside this repository.
+
+## Deploy flow
+
+Deployment is intentionally simple and bash-based:
+
+1. Jenkins builds Docker image tags locally.
+2. Jenkins syncs deployment files (`docker-compose.prod.yml`, deploy/smoke/rollback scripts) to the remote deploy path.
+3. Jenkins streams Docker images to the remote host (`docker save | ssh docker load`).
+4. Jenkins runs `scripts/deploy-prod.sh` remotely.
+5. Script applies the selected image tag via:
+
+```bash
+APP_IMAGE=<tag> docker compose -f docker-compose.prod.yml up -d --no-build
+```
+
+6. Script prints `docker compose ps` status.
+
+## Rollback flow
+
+Rollback uses `scripts/rollback-prod.sh` with a previously built image tag:
+
+```bash
+DEPLOY_PATH=/opt/plesk-agency-portal \
+APP_BASE_URL=https://your-app.example.com \
+scripts/rollback-prod.sh plesk-agency-portal:build-123
+```
+
+Rollback redeploys that image with compose, then immediately reruns smoke checks.
+
+## Smoke check behavior
+
+`scripts/smoke-check.sh`:
+
+- accepts a base URL argument
+- requests `${BASE_URL}/api/health`
+- fails on non-200 responses
+- fails on invalid JSON or missing expected fields (`ok: true`, `service` string)
+
+This gives a quick post-deploy validation gate for both deploy and rollback operations.

lib/plesk/health.ts

@@ -0,0 +1,345 @@
+import { randomUUID } from "crypto";
+
+import { testPleskConnection } from "@/lib/plesk/client";
+
+type SupabaseLike = any;
+
+type HealthStatus = "ok" | "degraded" | "down" | "unknown";
+
+type HealthInstance = {
+  id: string;
+  agency_id: string;
+  base_url: string;
+  auth_type: "api_key" | "basic";
+  encrypted_secret: string;
+  health_enabled: boolean;
+  health_check_frequency_minutes: number | null;
+  health_next_check_at: string | null;
+  health_lock_until: string | null;
+};
+
+type HealthCheckResult = {
+  status: Exclude<HealthStatus, "unknown">;
+  latency_ms: number;
+  error_message: string | null;
+};
+
+type RunSingleHealthCheckResult = {
+  checked: boolean;
+  status?: Exclude<HealthStatus, "unknown">;
+  latency_ms?: number;
+  error_message?: string | null;
+};
+
+export type HealthTickSummary = {
+  checked: number;
+  ok: number;
+  degraded: number;
+  failed: number;
+  duration_ms: number;
+};
+
+const MAX_INSTANCES_PER_TICK = 10;
+const MAX_CONCURRENCY = 3;
+const LOCK_LEASE_SECONDS = 5 * 60;
+const HEALTH_TIMEOUT_MS = 15_000;
+const DEGRADED_LATENCY_THRESHOLD_MS = 2_500;
+
+function isDue(instance: HealthInstance, now: number) {
+  if (!instance.health_next_check_at) return true;
+  const dueAt = new Date(instance.health_next_check_at).getTime();
+  return Number.isFinite(dueAt) && dueAt <= now;
+}
+
+function isUnlocked(instance: HealthInstance, now: number) {
+  if (!instance.health_lock_until) return true;
+  const lockUntil = new Date(instance.health_lock_until).getTime();
+  return !Number.isFinite(lockUntil) || lockUntil <= now;
+}
+
+async function insertActionLogBestEffort(
+  supabase: SupabaseLike,
+  payload: Record<string, unknown>,
+) {
+  try {
+    const { error } = await supabase.from("actions_log").insert(payload);
+    if (error) {
+      console.error("[health] actions_log insert failed", error.message);
+    }
+  } catch (error) {
+    console.error("[health] actions_log insert threw", error);
+  }
+}
+
+async function withTimeout<T>(
+  promise: Promise<T>,
+  timeoutMs: number,
+): Promise<T> {
+  let timeout: ReturnType<typeof setTimeout> | null = null;
+
+  const timeoutPromise = new Promise<never>((_, reject) => {
+    timeout = setTimeout(() => {
+      reject(new Error("Health check timed out"));
+    }, timeoutMs);
+  });
+
+  try {
+    return await Promise.race([promise, timeoutPromise]);
+  } finally {
+    if (timeout) clearTimeout(timeout);
+  }
+}
+
+async function checkPleskInstanceHealth(
+  instance: Pick<HealthInstance, "base_url" | "auth_type" | "encrypted_secret">,
+): Promise<HealthCheckResult> {
+  const startedAt = Date.now();
+
+  try {
+    await withTimeout(
+      testPleskConnection({
+        baseUrl: instance.base_url,
+        authType: instance.auth_type,
+        encryptedSecret: instance.encrypted_secret,
+      }),
+      HEALTH_TIMEOUT_MS,
+    );
+
+    const latencyMs = Date.now() - startedAt;
+    const status: "ok" | "degraded" =
+      latencyMs > DEGRADED_LATENCY_THRESHOLD_MS ? "degraded" : "ok";
+
+    return {
+      status,
+      latency_ms: latencyMs,
+      error_message: null,
+    };
+  } catch (error) {
+    return {
+      status: "down",
+      latency_ms: Date.now() - startedAt,
+      error_message:
+        error instanceof Error
+          ? error.message.slice(0, 1000)
+          : "health_check_failed",
+    };
+  }
+}
+
+export async function runInstanceHealthCheck(
+  supabase: SupabaseLike,
+  instance: HealthInstance,
+  input?: {
+    actorUserId?: string | null;
+    force?: boolean;
+    source?: "cron" | "manual";
+  },
+): Promise<RunSingleHealthCheckResult> {
+  const lockToken = randomUUID();
+  const actorUserId = input?.actorUserId ?? null;
+  const source = input?.source ?? "cron";
+
+  const { data: lockAcquired, error: lockError } = await supabase.rpc(
+    "acquire_instance_health_lock",
+    {
+      p_instance_id: instance.id,
+      p_lock_token: lockToken,
+      p_ttl_seconds: LOCK_LEASE_SECONDS,
+      p_force: Boolean(input?.force),
+    },
+  );
+
+  if (lockError || !lockAcquired) {
+    return { checked: false };
+  }
+
+  const startedAt = Date.now();
+  const nowIso = new Date().toISOString();
+  const frequencyMinutes = Math.max(
+    instance.health_check_frequency_minutes ?? 30,
+    5,
+  );
+  const nextCheckAtIso = new Date(
+    Date.now() + frequencyMinutes * 60 * 1000,
+  ).toISOString();
+
+  await insertActionLogBestEffort(supabase, {
+    agency_id: instance.agency_id,
+    actor_user_id: actorUserId,
+    target_type: "plesk_instance",
+    target_id: instance.id,
+    action: "health_check_started",
+    status: "pending",
+    metadata: {
+      instance_id: instance.id,
+      lock_token: lockToken,
+      source,
+    },
+  });
+
+  try {
+    const result = await checkPleskInstanceHealth(instance);
+
+    const updates: Record<string, unknown> = {
+      health_status: result.status,
+      health_last_checked_at: nowIso,
+      health_last_latency_ms: result.latency_ms,
+      health_last_error: result.error_message,
+      health_next_check_at: nextCheckAtIso,
+      health_lock_until: null,
+      health_lock_token: null,
+    };
+
+    if (result.status === "ok") {
+      updates.health_last_ok_at = nowIso;
+    }
+
+    const { error: updateError } = await supabase
+      .from("plesk_instances")
+      .update(updates)
+      .eq("id", instance.id)
+      .eq("health_lock_token", lockToken);
+
+    if (updateError) {
+      throw new Error(updateError.message);
+    }
+
+    const action =
+      result.status === "ok"
+        ? "health_check_ok"
+        : result.status === "degraded"
+          ? "health_check_degraded"
+          : "health_check_failed";
+
+    await insertActionLogBestEffort(supabase, {
+      agency_id: instance.agency_id,
+      actor_user_id: actorUserId,
+      target_type: "plesk_instance",
+      target_id: instance.id,
+      action,
+      status: result.status === "down" ? "failed" : "success",
+      error_message: result.error_message,
+      metadata: {
+        instance_id: instance.id,
+        lock_token: lockToken,
+        source,
+        latency_ms: result.latency_ms,
+        duration_ms: Date.now() - startedAt,
+      },
+    });
+
+    return {
+      checked: true,
+      status: result.status,
+      latency_ms: result.latency_ms,
+      error_message: result.error_message,
+    };
+  } catch (error) {
+    const errorMessage =
+      error instanceof Error
+        ? error.message.slice(0, 1000)
+        : "health_check_failed";
+
+    await supabase
+      .from("plesk_instances")
+      .update({
+        health_status: "down",
+        health_last_checked_at: nowIso,
+        health_last_error: errorMessage,
+        health_next_check_at: nextCheckAtIso,
+      })
+      .eq("id", instance.id);
+
+    await insertActionLogBestEffort(supabase, {
+      agency_id: instance.agency_id,
+      actor_user_id: actorUserId,
+      target_type: "plesk_instance",
+      target_id: instance.id,
+      action: "health_check_failed",
+      status: "failed",
+      error_message: errorMessage,
+      metadata: {
+        instance_id: instance.id,
+        lock_token: lockToken,
+        source,
+        duration_ms: Date.now() - startedAt,
+      },
+    });
+
+    return {
+      checked: true,
+      status: "down",
+      latency_ms: Date.now() - startedAt,
+      error_message: errorMessage,
+    };
+  } finally {
+    await supabase.rpc("release_instance_health_lock", {
+      p_instance_id: instance.id,
+      p_lock_token: lockToken,
+    });
+  }
+}
+
+export async function runHealthCheckTick(
+  supabase: SupabaseLike,
+): Promise<HealthTickSummary> {
+  const startedAt = Date.now();
+  const now = Date.now();
+
+  const { data: rows, error } = await supabase
+    .from("plesk_instances")
+    .select(
+      "id, agency_id, base_url, auth_type, encrypted_secret, health_enabled, health_check_frequency_minutes, health_next_check_at, health_lock_until",
+    )
+    .eq("health_enabled", true)
+    .order("health_next_check_at", { ascending: true, nullsFirst: true })
+    .limit(50);
+
+  if (error) {
+    throw new Error(error.message);
+  }
+
+  const eligible = ((rows ?? []) as HealthInstance[])
+    .filter((instance) => isDue(instance, now) && isUnlocked(instance, now))
+    .slice(0, MAX_INSTANCES_PER_TICK);
+
+  let checked = 0;
+  let ok = 0;
+  let degraded = 0;
+  let failed = 0;
+
+  const queue = [...eligible];
+
+  const workers = Array.from(
+    { length: Math.min(MAX_CONCURRENCY, queue.length) },
+    async () => {
+      while (queue.length > 0) {
+        const instance = queue.shift();
+        if (!instance) break;
+
+        const result = await runInstanceHealthCheck(supabase, instance, {
+          actorUserId: null,
+          force: false,
+          source: "cron",
+        });
+
+        if (!result.checked || !result.status) continue;
+
+        checked += 1;
+        if (result.status === "ok") ok += 1;
+        else if (result.status === "degraded") degraded += 1;
+        else failed += 1;
+      }
+    },
+  );
+
+  await Promise.all(workers);
+
+  return {
+    checked,
+    ok,
+    degraded,
+    failed,
+    duration_ms: Date.now() - startedAt,
+  };
+}

lib/types.ts

@@ -89,6 +89,16 @@ export type Database = {
           next_auto_sync_at: string | null;
           auto_sync_lock_until: string | null;
           auto_sync_lock_token: string | null;
+          health_enabled: boolean;
+          health_status: "ok" | "degraded" | "down" | "unknown";
+          health_last_checked_at: string | null;
+          health_last_ok_at: string | null;
+          health_last_error: string | null;
+          health_last_latency_ms: number | null;
+          health_check_frequency_minutes: number;
+          health_next_check_at: string | null;
+          health_lock_until: string | null;
+          health_lock_token: string | null;
           created_at: string;
         };
         Insert: {
@@ -113,6 +123,16 @@ export type Database = {
           next_auto_sync_at?: string | null;
           auto_sync_lock_until?: string | null;
           auto_sync_lock_token?: string | null;
+          health_enabled?: boolean;
+          health_status?: "ok" | "degraded" | "down" | "unknown";
+          health_last_checked_at?: string | null;
+          health_last_ok_at?: string | null;
+          health_last_error?: string | null;
+          health_last_latency_ms?: number | null;
+          health_check_frequency_minutes?: number;
+          health_next_check_at?: string | null;
+          health_lock_until?: string | null;
+          health_lock_token?: string | null;
           created_at?: string;
         };
         Update: {
@@ -137,6 +157,16 @@ export type Database = {
           next_auto_sync_at?: string | null;
           auto_sync_lock_until?: string | null;
           auto_sync_lock_token?: string | null;
+          health_enabled?: boolean;
+          health_status?: "ok" | "degraded" | "down" | "unknown";
+          health_last_checked_at?: string | null;
+          health_last_ok_at?: string | null;
+          health_last_error?: string | null;
+          health_last_latency_ms?: number | null;
+          health_check_frequency_minutes?: number;
+          health_next_check_at?: string | null;
+          health_lock_until?: string | null;
+          health_lock_token?: string | null;
           created_at?: string;
         };
       };

scripts/deploy-prod.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+DEPLOY_PATH="${DEPLOY_PATH:-/opt/plesk-agency-portal}"
+APP_IMAGE="${APP_IMAGE:-plesk-agency-portal:latest}"
+SOURCE_PATH="${SOURCE_PATH:-${DEPLOY_PATH}}"
+
+mkdir -p "${DEPLOY_PATH}"
+
+for file in docker-compose.prod.yml deploy-prod.sh smoke-check.sh rollback-prod.sh; do
+  if [ -f "${SOURCE_PATH}/${file}" ]; then
+    cp "${SOURCE_PATH}/${file}" "${DEPLOY_PATH}/${file}"
+  fi
+done
+
+chmod +x "${DEPLOY_PATH}/deploy-prod.sh" \
+  "${DEPLOY_PATH}/smoke-check.sh" \
+  "${DEPLOY_PATH}/rollback-prod.sh" 2>/dev/null || true
+
+if [ ! -f "${DEPLOY_PATH}/docker-compose.prod.yml" ]; then
+  echo "Missing docker-compose.prod.yml in ${DEPLOY_PATH}" >&2
+  exit 1
+fi
+
+cd "${DEPLOY_PATH}"
+
+APP_IMAGE="${APP_IMAGE}" docker compose -f docker-compose.prod.yml up -d --no-build
+
+docker compose -f docker-compose.prod.yml ps

scripts/rollback-prod.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+PREVIOUS_IMAGE_TAG="${1:-}"
+DEPLOY_PATH="${DEPLOY_PATH:-/opt/plesk-agency-portal}"
+APP_BASE_URL="${APP_BASE_URL:-}"
+
+if [ -z "${PREVIOUS_IMAGE_TAG}" ]; then
+  echo "Usage: $0 <previous-image-tag>" >&2
+  exit 1
+fi
+
+if [ -z "${APP_BASE_URL}" ]; then
+  echo "APP_BASE_URL is required" >&2
+  exit 1
+fi
+
+if [ ! -f "${DEPLOY_PATH}/docker-compose.prod.yml" ]; then
+  echo "Missing docker-compose.prod.yml in ${DEPLOY_PATH}" >&2
+  exit 1
+fi
+
+cd "${DEPLOY_PATH}"
+
+APP_IMAGE="${PREVIOUS_IMAGE_TAG}" docker compose -f docker-compose.prod.yml up -d --no-build
+
+"${DEPLOY_PATH}/smoke-check.sh" "${APP_BASE_URL}"
+
+docker compose -f docker-compose.prod.yml ps

scripts/smoke-check.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+BASE_URL="${1:-}"
+
+if [ -z "${BASE_URL}" ]; then
+  echo "Usage: $0 <base-url>" >&2
+  exit 1
+fi
+
+URL="${BASE_URL%/}/api/health"
+TMP_FILE="$(mktemp)"
+
+trap 'rm -f "${TMP_FILE}"' EXIT
+
+HTTP_CODE=$(curl -sS -o "${TMP_FILE}" -w "%{http_code}" "${URL}")
+
+if [ "${HTTP_CODE}" != "200" ]; then
+  echo "Smoke check failed: ${URL} returned ${HTTP_CODE}" >&2
+  cat "${TMP_FILE}" >&2 || true
+  exit 1
+fi
+
+node -e "const fs=require('fs');const d=JSON.parse(fs.readFileSync(process.argv[1],'utf8'));if(d?.ok!==true||typeof d?.service!=='string'){process.exit(1)}" "${TMP_FILE}"
+
+echo "Smoke check passed: ${URL}"

supabase/migrations/CL38_instance_health_monitoring.sql

@@ -0,0 +1,78 @@
+-- CL8: instance health monitoring fields + lock helpers
+
+alter table public.plesk_instances
+  add column if not exists health_enabled boolean not null default true,
+  add column if not exists health_status text not null default 'unknown',
+  add column if not exists health_last_checked_at timestamptz,
+  add column if not exists health_last_ok_at timestamptz,
+  add column if not exists health_last_error text,
+  add column if not exists health_last_latency_ms integer,
+  add column if not exists health_check_frequency_minutes integer not null default 30,
+  add column if not exists health_next_check_at timestamptz,
+  add column if not exists health_lock_until timestamptz,
+  add column if not exists health_lock_token text;
+
+alter table public.plesk_instances
+  drop constraint if exists plesk_instances_health_status_check;
+
+alter table public.plesk_instances
+  add constraint plesk_instances_health_status_check
+  check (health_status in ('ok', 'degraded', 'down', 'unknown'));
+
+alter table public.plesk_instances
+  drop constraint if exists plesk_instances_health_check_frequency_minutes_check;
+
+alter table public.plesk_instances
+  add constraint plesk_instances_health_check_frequency_minutes_check
+  check (health_check_frequency_minutes between 5 and 10080);
+
+create index if not exists idx_plesk_instances_health_due
+  on public.plesk_instances (health_enabled, health_next_check_at);
+
+create or replace function public.acquire_instance_health_lock(
+  p_instance_id uuid,
+  p_lock_token text,
+  p_ttl_seconds integer default 300,
+  p_force boolean default false
+)
+returns boolean
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  v_acquired boolean := false;
+begin
+  update public.plesk_instances
+  set
+    health_lock_until = now() + make_interval(secs => p_ttl_seconds),
+    health_lock_token = p_lock_token
+  where id = p_instance_id
+    and health_enabled = true
+    and (
+      p_force = true
+      or health_next_check_at is null
+      or health_next_check_at <= now()
+    )
+    and (health_lock_until is null or health_lock_until < now());
+
+  get diagnostics v_acquired = row_count;
+  return v_acquired;
+end;
+$$;
+
+create or replace function public.release_instance_health_lock(
+  p_instance_id uuid,
+  p_lock_token text
+)
+returns void
+language sql
+security definer
+set search_path = public
+as $$
+  update public.plesk_instances
+  set health_lock_until = null,
+      health_lock_token = null
+  where id = p_instance_id
+    and health_lock_token = p_lock_token;
+$$;