<!-- BEGIN CHANGE: multi-ambiente portal (dev / test / beta) -->

# Portal multi-ambiente (opcao C)

Mesmo codigo, **deploys isolados**. Zero mistura de DB/sessao/secret.

| Target | URL | Pasta | API | OT path default (env.php) |
|---|---|---|---|---|
| `dev` | https://dev.whiteantidote.com | `/home/ubuntu/dev-portal` | `:8083` | `/home/ubuntu/otx2_reseted/` |
| `test` | https://ot-test.whiteantidote.com | `/home/ubuntu/test-portal` | `:8084` | `/home/ubuntu/otx2_reseted_2/` |
| `beta` | https://ot-beta.whiteantidote.com | `/home/ubuntu/beta-portal` | `:8085` | `/home/ubuntu/otx2_reseted_beta/` |
| `prod` | https://ot.whiteantidote.com | `/home/ubuntu/portal` | `:8086` | `/home/ubuntu/otx2_reseted/` |

DB isoladas: test=`ot-test-server`, beta=`ot-beta-server`, prod/dev=`ot_new`.

**DNS:** `ot-test` / `beta` / `dev` / `ot` do **portal web** devem apontar para o host do site (`164.152.58.219`). O IP no `config.lua` do OT de teste e so o anunciado ao cliente do jogo.

## Deploy

**Automatico (recomendado):** push em `master` com mudancas em `portal/**` dispara GitHub Actions (`.github/workflows/deploy-portal.yml`) -> `git pull` + build no servidor + publica em runtime. Ver `docs/deploy-workflow.md`.

**Manual no servidor:**

```bash
bash /home/ubuntu/www/html/portal/deploy/deploy.sh --pull prod
```

**Fallback Windows (build local + rsync):**

```powershell
cd portal
./deploy/deploy.ps1                 # dev
./deploy/deploy.ps1 -Target test
./deploy/deploy.ps1 -Target beta
./deploy/deploy.ps1 -Target prod    # prod + espelha test e beta
./deploy/deploy.ps1 -Target prod -SkipMirror  # so prod
```

O script `deploy.ps1` / `deploy.sh`:
- builda com `NEXT_PUBLIC_ENV_ID` / `NEXT_PUBLIC_ENV_LABEL` (banner TEST/BETA)
- envia `out/` + `api/*.php`
- cria `secret.key` e `env.php` **somente se nao existirem** (nao sobrescreve)
- **`-Target prod`** tambem faz deploy em **test** e **beta** (mesmo codigo; rebuild com banner do ambiente). Use `-SkipMirror` para subir so prod.

Edite no servidor: `/home/ubuntu/{test|beta}-portal/env.php` (`OT_SERVER_PATH`, flags de pagamento).

## Bootstrap Apache + systemd (uma vez por ambiente)

```bash
# Test
sudo cp portal/deploy/ot-test.whiteantidote.com.conf /etc/apache2/sites-available/
sudo cp portal/deploy/test-portal-api.service /etc/systemd/system/
sudo a2ensite ot-test.whiteantidote.com.conf
sudo systemctl daemon-reload
sudo systemctl enable --now test-portal-api
sudo systemctl reload apache2
sudo certbot --apache -d ot-test.whiteantidote.com

# Beta (idem com ot-beta.whiteantidote.com + beta-portal-api)
sudo cp portal/deploy/ot-beta.whiteantidote.com.conf /etc/apache2/sites-available/
sudo cp portal/deploy/beta-portal-api.service /etc/systemd/system/
sudo a2ensite ot-beta.whiteantidote.com.conf
sudo systemctl enable --now beta-portal-api
sudo certbot --apache -d ot-beta.whiteantidote.com
```

DNS A/AAAA dos subdominios deve apontar para o host do portal (`164.152.58.219`) antes do certbot.

## Isolamento

- `secret.key` por pasta (token de um ambiente nao autentica no outro)
- `env.php` define DB via `config.lua` do OT daquele path
- `WA_ALLOW_PAYMENTS` / `WA_ALLOW_SHOP_BUY` default `false` em test/beta
- Cache parsers: `{root}/cache/`

## Checklist OT/DB

1. OT de teste no host: `/home/ubuntu/otx2_reseted_2/` (DB `ot-test-server`)
2. OT beta: `/home/ubuntu/otx2_reseted_beta/` (DB `ot-beta-server`)
3. Schema alinhado ao primary (ver `portal/sql/create_test_beta_dbs.sh` + `seed_core_accounts.py`)
4. `OT_SERVER_PATH` no `env.php` do portal (deploy ja usa os paths acima)
5. DNS do subdominio = IP publico do portal (`164.152.58.219`), nao o IP do `config.lua` do jogo
6. Deploy `-Target test|beta`
7. systemd `test-portal-api` / `beta-portal-api` + a2ensite + certbot

<!-- END CHANGE -->