rust backend + migration

frontend/Dockerfile

@@ -31,43 +31,10 @@ COPY --from=build-stage /app/dist /usr/share/nginx/html
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
-# Custom Nginx config to handle React Router (SPA) and proxy API requests
-RUN printf 'server {\n\
-    listen 80;\n\
-    location / {\n\
-        root /usr/share/nginx/html;\n\
-        index index.html index.htm;\n\
-        try_files $uri $uri/ /index.html;\n\
-    }\n\
-    location /api/ {\n\
-        proxy_pass http://holy-backend:8000/api/;\n\
-        proxy_set_header Host $host;\n\
-        proxy_set_header X-Real-IP $remote_addr;\n\
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n\
-        proxy_set_header X-Forwarded-Proto $scheme;\n\
-    }\n\
-    location /admin/ {\n\
-        proxy_pass http://holy-backend:8000/admin/;\n\
-        proxy_set_header Host $host;\n\
-        proxy_set_header X-Real-IP $remote_addr;\n\
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n\
-        proxy_set_header X-Forwarded-Proto $scheme;\n\
-    }\n\
-    location /static/ {\n\
-        proxy_pass http://holy-backend:8000/static/;\n\
-        proxy_set_header Host $host;\n\
-        proxy_set_header X-Real-IP $remote_addr;\n\
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n\
-        proxy_set_header X-Forwarded-Proto $scheme;\n\
-    }\n\
-    location /media/ {\n\
-        proxy_pass http://holy-backend:8000/media/;\n\
-        proxy_set_header Host $host;\n\
-        proxy_set_header X-Real-IP $remote_addr;\n\
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n\
-        proxy_set_header X-Forwarded-Proto $scheme;\n\
-    }\n\
-}' > /etc/nginx/conf.d/default.conf
+# Nginx config: SPA + strangler API routing (Django/Rust per-group). See
+# nginx.conf for the cutover layout. proxy_params.conf holds shared headers.
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+COPY proxy_params.conf /etc/nginx/proxy_params.conf
 
 EXPOSE 80
 ENTRYPOINT ["/entrypoint.sh"]

frontend/nginx.conf

@@ -0,0 +1,88 @@
+# =========================================================================
+# Strangler routing: Django (holy-backend) and Rust (holy-rust) run side by
+# side, sharing one SQLite DB + media dir + SECRET_KEY. Every endpoint group
+# below can be served by EITHER backend, so cutover is per-group and instant:
+# change a `proxy_pass` target, then `docker exec holy-frontend nginx -s reload`
+# (or recreate the container). Rollback is the same edit in reverse.
+#
+# Cutover order (see backend-rs/README.md):
+#   Phase 1  reads      -> categories, flavors, banners
+#   Phase 2  auth+write  -> auth/token, ratings, replies, users, notifications, tickets
+#   Phase 3  admin+jobs  -> admin-custom  (THEN stop Django beat + set
+#                           RUST_ENABLE_SCHEDULER=true so exactly one scheduler runs)
+#   Phase 4  retire      -> point catch-all /api/ at rust; serve /media/ from
+#                           nginx; drop Django /admin/ + /static/ if unused.
+# =========================================================================
+
+upstream django_backend {
+    server holy-backend:8000;
+}
+
+upstream rust_backend {
+    server holy-rust:8001;
+}
+
+server {
+    listen 80;
+
+    # --- SPA -------------------------------------------------------------
+    location / {
+        root /usr/share/nginx/html;
+        index index.html index.htm;
+        try_files $uri $uri/ /index.html;
+    }
+
+    # --- API: per-group strangler routing --------------------------------
+    # Longest-prefix match wins, so these specific groups override the
+    # catch-all /api/ below. To cut a group over, swap django_backend ->
+    # rust_backend on its proxy_pass line.
+
+    # Phase 1 — read-only (safe to move first):
+    location /api/categories/ { proxy_pass http://django_backend; include /etc/nginx/proxy_params.conf; }
+    location /api/flavors/    { proxy_pass http://django_backend; include /etc/nginx/proxy_params.conf; }
+    location /api/banners/    { proxy_pass http://django_backend; include /etc/nginx/proxy_params.conf; }
+
+    # Phase 2 — auth + writes:
+    location /api/auth/          { proxy_pass http://django_backend; include /etc/nginx/proxy_params.conf; }
+    location = /api/token/       { proxy_pass http://django_backend; include /etc/nginx/proxy_params.conf; }  # legacy JWT alias
+    location /api/ratings/       { proxy_pass http://django_backend; include /etc/nginx/proxy_params.conf; }
+    location /api/replies/       { proxy_pass http://django_backend; include /etc/nginx/proxy_params.conf; }
+    location /api/users/         { proxy_pass http://django_backend; include /etc/nginx/proxy_params.conf; }
+    location /api/notifications/ { proxy_pass http://django_backend; include /etc/nginx/proxy_params.conf; }
+    location /api/tickets/       { proxy_pass http://django_backend; include /etc/nginx/proxy_params.conf; }
+
+    # Phase 3 — admin + jobs (cut over, THEN flip the scheduler ownership):
+    location /api/admin-custom/  { proxy_pass http://django_backend; include /etc/nginx/proxy_params.conf; }
+
+    # OpenAPI schema / Swagger UI (both backends serve these):
+    location /api/schema { proxy_pass http://django_backend; include /etc/nginx/proxy_params.conf; }
+
+    # Catch-all: anything not explicitly cut over stays on Django.
+    location /api/ {
+        proxy_pass http://django_backend;
+        include /etc/nginx/proxy_params.conf;
+    }
+
+    # --- Django-only paths (retire last) ---------------------------------
+    # Django admin site + its static assets. The app's own admin UI uses
+    # /api/admin-custom/, so these are only the Django admin site + DRF UI.
+    location /admin/ {
+        proxy_pass http://django_backend;
+        include /etc/nginx/proxy_params.conf;
+    }
+    location /static/ {
+        proxy_pass http://django_backend;
+        include /etc/nginx/proxy_params.conf;
+    }
+
+    # --- Media -----------------------------------------------------------
+    # Served straight from the shared bind mount (read-only) so media does not
+    # depend on either backend being up — a prerequisite for retiring Django.
+    location /media/ {
+        alias /usr/share/nginx/media/;
+        access_log off;
+        expires 7d;
+        add_header Cache-Control "public";
+        try_files $uri =404;
+    }
+}

frontend/proxy_params.conf

@@ -0,0 +1,8 @@
+# Shared proxy headers. Both backends rebuild absolute URLs (DRF
+# build_absolute_uri / Rust RequestCtx) from Host + X-Forwarded-Proto, so these
+# must be set on every proxied location.
+proxy_set_header Host $host;
+proxy_set_header X-Real-IP $remote_addr;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_http_version 1.1;