feat(deploy): add deployment configuration for Liara with Docker and Supervisor

.env.liara.example

@@ -0,0 +1,64 @@
+# ============================================================
+# Liara Environment Variables — ClinicPro (Docker, single app)
+# ------------------------------------------------------------
+# Liara does NOT support docker-compose. The whole app (web + both message
+# consumers) runs as ONE Docker app via Supervisor (docker/supervisord.conf).
+# MariaDB and Redis are SEPARATE Liara managed services on the PRIVATE NETWORK.
+#
+# Set these in the Liara console (Environment tab) or via the CLI:
+#   liara env set KEY=VALUE --app clinicpro-api
+# Build/deploy config (platform, port, disks, healthcheck) lives in liara.json.
+# ============================================================
+
+APP_ENV=prod
+APP_DEBUG=0
+
+# ── Secrets (REQUIRED — set before the first deploy) ──
+APP_SECRET=            # php -r "echo bin2hex(random_bytes(32));"
+JWT_PASSPHRASE=        # openssl rand -hex 32   (JWT keypair is generated with it on first boot)
+
+# ── Database / Redis (point at the Liara MANAGED services via PRIVATE hostnames) ──
+# Create a MariaDB 11.8 service + a Redis service in Liara, enable private network,
+# put both + this app on the SAME private network, then copy their private hosts here.
+# serverVersion MUST match the MariaDB service (11.8).
+DATABASE_URL="mysql://<user>:<pass>@<db-private-host>:3306/<db>?serverVersion=mariadb-11.8.0&charset=utf8mb4"
+REDIS_URL="redis://<redis-private-host>:6379"
+MESSENGER_TRANSPORT_DSN="redis://<redis-private-host>:6379/messages"
+# If the Redis service has a password: redis://:<pass>@<redis-private-host>:6379
+
+# ── JWT key paths (keys live on the persistent 'jwt' disk, see liara.json) ──
+JWT_SECRET_KEY=%kernel.project_dir%/config/jwt/private.pem
+JWT_PUBLIC_KEY=%kernel.project_dir%/config/jwt/public.pem
+
+# ── Backend's own domain (API host — used for payment callbacks & absolute URLs) ──
+APP_BASE_URL=https://<your-liara-domain>
+DEFAULT_URI=https://<your-liara-domain>
+
+# ── Reverse proxy (Liara router) — trust X-Forwarded-* from the private ranges ──
+TRUSTED_PROXIES=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.1
+
+# ── Frontend domains (MANY) — GENERATED from docker/frontend-domains.json ──
+# To add/remove a city domain: edit that file, then run:
+#   ddev exec php docker/gen-cors-env.php     (or: php docker/gen-cors-env.php on the server)
+# and paste the new output into both vars below.
+ALLOWED_FRONTEND_HOSTS=<output of docker/gen-cors-env.php>
+CORS_ALLOW_ORIGIN=<output of docker/gen-cors-env.php>
+
+# ── api.ir identity inquiry (Shahkar + IbanMatch) ──
+# Empty token => fail-closed (representative verification is rejected).
+API_IR_BASE_URL=https://s.api.ir
+API_IR_TOKEN=
+
+# ── Fixed app params (same values as the compose stack) ──
+REFRESH_TOKEN_TTL=2592000
+OTP_TTL=1200
+MAX_FILE_SIZE_BYTES=5242880
+UPLOAD_DIR=var/uploads
+
+# ── Notes ──
+# • Do NOT set RUN_INIT — entrypoint.sh defaults it to 1, and this is a single app,
+#   so JWT keygen + doctrine migrations run once on boot (correct).
+# • SMS keys (kavenegar/rangineh) and payment gateway keys (mellat/sep) are read
+#   from the DB ("Site Settings"), NOT from env. No need to set them here.
+# • Liara exposes only ONE external HTTP port (8080, from liara.json). MariaDB/Redis
+#   are reachable on the private network only.