@cicore/cli 1.0.0

package/dist/commands/server/index.js

@@ -0,0 +1,2524 @@
+/**
+ * CiCore CLI - Server Management Commands
+ *
+ * Full server setup, installation, and management
+ */
+import { log, spinner, formatTable } from '../../lib/logger.js';
+import { exec } from '../../lib/shell.js';
+import { paths, getDockerRegistry } from '../../lib/config.js';
+import { confirm, input, select } from '../../lib/prompts.js';
+import { getSSHHost, listSSHHosts, buildSSHCommand, buildSCPCommand } from '../../lib/ssh-config.js';
+import { getCloudflareToken, setupDomainForVuCore } from '../../lib/cloudflare.js';
+import fs from 'fs-extra';
+import path from 'path';
+export function registerServerCommands(program) {
+    const server = program
+        .command('server')
+        .description('Server management commands');
+    // ========================================
+    // PHASE 1: vu server setup - Docker & Services
+    // ========================================
+    server
+        .command('setup')
+        .description('Phase 1: Install Docker, pull images, start base services')
+        .option('-h, --host <host>', 'SSH host name from ~/.ssh/config')
+        .option('--local', 'Run directly on this server (no SSH)')
+        .option('--skip-docker', 'Skip Docker installation (if already installed)')
+        .action(async (options) => {
+        await serverSetup(options);
+    });
+    // ========================================
+    // PHASE 2: vu server deploy - ciCore Files
+    // ========================================
+    server
+        .command('deploy')
+        .description('Phase 2: Deploy ciCore files to server (templates, configs)')
+        .option('-h, --host <host>', 'SSH host name from ~/.ssh/config')
+        .option('--local', 'Run directly on this server (no SSH)')
+        .option('-c, --core <name>', 'Core name to create', 'core1')
+        .action(async (options) => {
+        await serverDeploy(options);
+    });
+    // ========================================
+    // PHASE 3: vu server domain - Domain Setup
+    // ========================================
+    server
+        .command('domain')
+        .description('Phase 3: Configure domain for a core (nginx config)')
+        .option('-h, --host <host>', 'SSH host name from ~/.ssh/config')
+        .option('--local', 'Run directly on this server (no SSH)')
+        .option('-c, --core <name>', 'Core name', 'core1')
+        .option('-d, --domain <domain>', 'Root domain')
+        .action(async (options) => {
+        await serverDomain(options);
+    });
+    // ========================================
+    // PHASE 4: vu server ssl - SSL Certificate
+    // ========================================
+    server
+        .command('ssl')
+        .description('Phase 4: Setup SSL certificate for domain')
+        .option('-h, --host <host>', 'SSH host name from ~/.ssh/config')
+        .option('--local', 'Run directly on this server (no SSH)')
+        .option('-d, --domain <domain>', 'Domain for SSL')
+        .option('--cloudflare', 'Use Cloudflare Origin Certificate')
+        .option('--letsencrypt', 'Use Let\'s Encrypt certificate')
+        .option('-e, --email <email>', 'Email for Let\'s Encrypt')
+        .action(async (options) => {
+        await serverSSL(options);
+    });
+    // ========================================
+    // FULL INSTALL (runs all phases)
+    // ========================================
+    server
+        .command('install')
+        .description('Full installation: setup + deploy + domain + ssl')
+        .option('-h, --host <host>', 'SSH host name from ~/.ssh/config')
+        .option('--local', 'Run directly on this server (no SSH)')
+        .option('-c, --core <name>', 'Core name to create', 'core1')
+        .option('-d, --domain <domain>', 'Root domain')
+        .option('--skip-docker', 'Skip Docker installation')
+        .option('--skip-ssl', 'Skip SSL certificate setup')
+        .option('--cloudflare', 'Use Cloudflare for SSL')
+        .action(async (options) => {
+        await serverInstallFull(options);
+    });
+    // ========================================
+    // UTILITY COMMANDS
+    // ========================================
+    server
+        .command('list')
+        .alias('ls')
+        .description('List configured SSH hosts')
+        .action(async () => {
+        await listServers();
+    });
+    server
+        .command('status')
+        .description('Check server status')
+        .option('-h, --host <host>', 'SSH host name', 'cicore')
+        .action(async (options) => {
+        await serverStatus(options);
+    });
+    server
+        .command('logs')
+        .description('View server logs')
+        .option('-h, --host <host>', 'SSH host name', 'cicore')
+        .option('-s, --service <service>', 'Service name (nuxt, php, nginx)')
+        .option('-f, --follow', 'Follow log output')
+        .option('-n, --lines <n>', 'Number of lines', '100')
+        .action(async (options) => {
+        await serverLogs(options);
+    });
+    server
+        .command('reset')
+        .alias('factory-reset')
+        .description('Factory reset server - removes all ciCore data and containers')
+        .option('-h, --host <host>', 'SSH host name')
+        .option('-f, --force', 'Skip confirmation prompts')
+        .option('--keep-images', 'Keep Docker images (only remove containers and data)')
+        .action(async (options) => {
+        await factoryReset(options);
+    });
+    // ========================================
+    // PHASE 0: vu server prepare - System Requirements
+    // ========================================
+    server
+        .command('prepare')
+        .description('Phase 0: Install system requirements (Node.js 20, Docker, tree)')
+        .option('-h, --host <host>', 'SSH host name from ~/.ssh/config')
+        .action(async (options) => {
+        await serverPrepare(options);
+    });
+    // ========================================
+    // SYSTEM CHECK
+    // ========================================
+    server
+        .command('check')
+        .description('Check server health: services, SSL, API, CORS')
+        .option('-h, --host <host>', 'SSH host name from ~/.ssh/config')
+        .option('--fix', 'Attempt to fix issues automatically')
+        .action(async (options) => {
+        await serverCheck(options);
+    });
+    // ========================================
+    // CLI REMOTE EXECUTION
+    // ========================================
+    server
+        .command('cli')
+        .description('Install and run CLI on remote server')
+        .option('-h, --host <host>', 'SSH host name')
+        .option('--install', 'Install/update CLI on server')
+        .option('--run <command>', 'Run CLI command on server')
+        .action(async (options) => {
+        await serverCLI(options);
+    });
+    server
+        .command('remote')
+        .description('Run any vu command on remote server')
+        .option('-h, --host <host>', 'SSH host name')
+        .argument('<cmd...>', 'Command to run (e.g., "server deploy --core core1")')
+        .action(async (cmd, options) => {
+        await runRemoteCLI(options.host, cmd.join(' '));
+    });
+}
+// ============================================
+// HELPER: Get SSH Host
+// ============================================
+async function getHost(hostOption) {
+    if (hostOption) {
+        const host = await getSSHHost(hostOption);
+        if (!host) {
+            log.error(`SSH host "${hostOption}" not found in ~/.ssh/config`);
+            return null;
+        }
+        return host;
+    }
+    const hosts = await listSSHHosts();
+    if (hosts.length === 0) {
+        log.error('No SSH hosts found in ~/.ssh/config');
+        return null;
+    }
+    const hostName = await select('Select SSH host:', hosts.map(h => ({ name: `${h.name} (${h.hostname})`, value: h.name })));
+    return hosts.find(h => h.name === hostName) || null;
+}
+// ============================================
+// LOCAL COMMAND EXECUTION HELPER
+// ============================================
+async function runLocal(command, label) {
+    if (label)
+        log.info(`  → ${label}`);
+    try {
+        const { execSync } = await import('child_process');
+        const output = execSync(command, {
+            encoding: 'utf-8',
+            timeout: 300000, // 5 min timeout
+            stdio: ['pipe', 'pipe', 'pipe'],
+            shell: '/bin/sh'
+        });
+        return { success: true, stdout: output || '', stderr: '' };
+    }
+    catch (error) {
+        // execSync throws on non-zero exit, but we still want the output
+        const stdout = error.stdout?.toString() || '';
+        const stderr = error.stderr?.toString() || error.message || '';
+        // If command produced output, consider it partially successful
+        return { success: error.status === 0, stdout, stderr };
+    }
+}
+// ============================================
+// PHASE 1: SERVER SETUP (Docker & Services)
+// ============================================
+async function serverSetup(options) {
+    log.title('🔧 Phase 1: Server Setup');
+    log.info('Docker installation, image pull, base services');
+    log.blank();
+    // Check if running locally on server (no host specified and no SSH hosts available)
+    const isLocal = options.local || (!options.host && (await listSSHHosts()).length === 0);
+    let runCmd;
+    if (isLocal) {
+        log.info('Running in LOCAL mode (directly on this server)');
+        runCmd = runLocal;
+    }
+    else {
+        const host = await getHost(options.host);
+        if (!host)
+            return;
+        log.info(`Target: ${host.name} (${host.user}@${host.hostname})`);
+        runCmd = (cmd, label) => runSSHLive(host, cmd, label);
+    }
+    log.blank();
+    const shouldContinue = await confirm('Start server setup?', true);
+    if (!shouldContinue) {
+        log.warn('Cancelled');
+        return;
+    }
+    const startTime = Date.now();
+    // Step 1: System check
+    log.step(1, 5, 'Checking system...');
+    const testResult = await runCmd('uname -a', 'System info:');
+    if (!testResult.success) {
+        log.error('❌ System check failed');
+        return;
+    }
+    log.success('✅ System OK');
+    // Step 2: System Update
+    log.blank();
+    log.step(2, 5, 'Updating system packages...');
+    const updateResult = await runCmd('export DEBIAN_FRONTEND=noninteractive ; apt-get update ; apt-get -y -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold upgrade', 'Updating...');
+    if (!updateResult.success) {
+        log.error('❌ System update failed');
+        return;
+    }
+    log.success('✅ System updated');
+    // Step 3: Install Dependencies
+    log.blank();
+    log.step(3, 5, 'Installing dependencies...');
+    const depsResult = await runCmd('export DEBIAN_FRONTEND=noninteractive ; apt-get install -y curl git tree openssl apt-transport-https ca-certificates software-properties-common', 'Installing...');
+    if (!depsResult.success) {
+        log.error('❌ Dependencies installation failed');
+        return;
+    }
+    log.success('✅ Dependencies installed');
+    // Step 4: Install Docker
+    if (!options.skipDocker) {
+        log.blank();
+        log.step(4, 5, 'Installing Docker...');
+        // Check if Docker exists
+        const dockerCheck = await runCmd('docker --version 2>/dev/null || echo NOT_INSTALLED');
+        if (dockerCheck.success && !dockerCheck.stdout.includes('NOT_INSTALLED')) {
+            log.info('Docker already installed');
+        }
+        else {
+            const dockerResult = await runCmd('curl -fsSL https://get.docker.com | sh ; systemctl enable docker ; systemctl start docker', 'Installing Docker...');
+            if (!dockerResult.success) {
+                log.error('❌ Docker installation failed');
+                return;
+            }
+        }
+        log.success('✅ Docker ready');
+    }
+    // Step 5: Create networks, pull images, start base services
+    log.blank();
+    log.step(5, 5, 'Setting up Docker environment...');
+    // Create networks
+    log.info('Creating Docker networks...');
+    await runCmd('docker network create vucore_global 2>/dev/null || true', 'Creating vucore_global...');
+    await runCmd('docker network create vucore_proxy 2>/dev/null || true', 'Creating vucore_proxy...');
+    // Verify networks
+    const netCheck = await runCmd('docker network ls --format "{{.Name}}" | grep vucore || true');
+    log.info(`  Networks: ${netCheck.stdout.trim().replace(/\n/g, ', ') || 'creating...'}`);
+    if (!netCheck.stdout.includes('vucore_global')) {
+        await runCmd('docker network create vucore_global');
+    }
+    if (!netCheck.stdout.includes('vucore_proxy')) {
+        await runCmd('docker network create vucore_proxy');
+    }
+    log.success('✅ Docker networks ready');
+    // Create directories
+    log.info('Creating directories...');
+    await runCmd('mkdir -p /home/cores /home/services/nginx/conf.d /home/services/nginx/ssl /home/services/postgres/data /home/services/postgres/backups /home/services/redis/data /home/services/scripts/addons');
+    // Pull images
+    log.blank();
+    log.info('Pulling Docker images (this may take a few minutes)...');
+    const registry = getDockerRegistry();
+    await runCmd(`docker pull ${registry}/vucore-nuxt:latest`, 'Pulling vucore-nuxt...');
+    await runCmd(`docker pull ${registry}/vucore-php:latest`, 'Pulling vucore-php...');
+    await runCmd('docker pull postgres:16-alpine', 'Pulling postgres...');
+    await runCmd('docker pull redis:7-alpine', 'Pulling redis...');
+    await runCmd('docker pull nginx:alpine', 'Pulling nginx...');
+    log.success('✅ Docker images pulled');
+    // Summary
+    const elapsed = ((Date.now() - startTime) / 1000 / 60).toFixed(1);
+    log.blank();
+    log.box('✅ Phase 1 Complete', [
+        `Mode: ${isLocal ? 'LOCAL' : 'REMOTE'}`,
+        `Time: ${elapsed} minutes`,
+        '',
+        'Next: vu server deploy --core core1',
+    ]);
+    process.exit(0);
+}
+// ============================================
+// PHASE 2: SERVER DEPLOY (ciCore Files)
+// ============================================
+async function serverDeploy(options) {
+    log.title('📦 Phase 2: Deploy VuCore');
+    log.info('Upload templates, configs, shared files');
+    log.blank();
+    // Check if running locally
+    const isLocal = options.local || (!options.host && (await listSSHHosts()).length === 0);
+    let host = null;
+    let runCmd;
+    if (isLocal) {
+        log.info('Running in LOCAL mode (directly on this server)');
+        runCmd = runLocal;
+    }
+    else {
+        host = await getHost(options.host);
+        if (!host)
+            return;
+        log.info(`Target: ${host.name} (${host.user}@${host.hostname})`);
+        runCmd = (cmd, label) => runSSHLive(host, cmd, label);
+    }
+    const coreName = options.core || await input('Core name:', 'core1');
+    log.info(`Core: ${coreName}`);
+    log.blank();
+    const shouldContinue = await confirm('Start deployment?', true);
+    if (!shouldContinue) {
+        log.warn('Cancelled');
+        return;
+    }
+    const startTime = Date.now();
+    // Step 1: Test connection
+    log.step(1, 4, isLocal ? 'Checking system...' : 'Testing SSH connection...');
+    const testResult = await runCmd('uname -a');
+    if (!testResult.success) {
+        log.error(isLocal ? '❌ System check failed' : '❌ SSH connection failed');
+        return;
+    }
+    log.success(isLocal ? '✅ System OK' : '✅ SSH connected');
+    // Step 2: Prepare templates
+    log.blank();
+    log.step(2, 4, 'Preparing template files...');
+    // Templates path differs between local (server) and remote (dev machine) modes
+    // Local: /opt/vucore-cli/templates/server (CLI installed on server)
+    // Remote: {dev_root}/cli/templates/server (dev machine)
+    let templatesPath;
+    if (isLocal) {
+        templatesPath = '/opt/vucore-cli/templates/server';
+    }
+    else {
+        templatesPath = path.join(paths.dev.root, 'cli', 'templates', 'server');
+    }
+    if (!await fs.pathExists(templatesPath)) {
+        log.error(`Templates path not found: ${templatesPath}`);
+        return;
+    }
+    const tempDir = isLocal ? '/tmp/vucore-deploy' : path.join(paths.dev.root, '.tmp-server-deploy');
+    await fs.ensureDir(tempDir);
+    // Copy templates
+    await fs.copy(path.join(templatesPath, 'services'), path.join(tempDir, 'services'));
+    await fs.copy(path.join(templatesPath, 'cores', 'core-template'), path.join(tempDir, 'core'));
+    // Generate passwords and process .env files
+    const postgresPassword = generateRandomString(48);
+    const redisPassword = generateRandomString(48);
+    const dbPassword = generateRandomString(48);
+    const servicesEnvPath = path.join(tempDir, 'services', '.env');
+    const coreEnvPath = path.join(tempDir, 'core', '.env');
+    let servicesEnv = await fs.readFile(servicesEnvPath, 'utf-8');
+    servicesEnv = servicesEnv
+        .replace(/\{\{POSTGRES_USER\}\}/g, 'vucore_admin')
+        .replace(/\{\{POSTGRES_PASSWORD\}\}/g, postgresPassword)
+        .replace(/\{\{POSTGRES_DB\}\}/g, 'vucore_global')
+        .replace(/\{\{REDIS_PASSWORD\}\}/g, redisPassword)
+        // NUXT variables - will be properly set by 'vu server domain' command
+        .replace(/\{\{NUXT_PUBLIC_API_BASE\}\}/g, 'https://api.localhost')
+        .replace(/\{\{NUXT_PUBLIC_WS_URL\}\}/g, 'wss://localhost:2346')
+        .replace(/\{\{NUXT_PUBLIC_HOST\}\}/g, 'localhost');
+    await fs.writeFile(servicesEnvPath, servicesEnv);
+    let coreEnv = await fs.readFile(coreEnvPath, 'utf-8');
+    coreEnv = coreEnv
+        .replace(/\{\{CORE_NAME\}\}/g, coreName)
+        .replace(/\{\{DOMAIN\}\}/g, 'localhost')
+        .replace(/\{\{DB_NAME\}\}/g, `vucore_${coreName}`)
+        .replace(/\{\{DB_USER\}\}/g, 'vucore_admin')
+        .replace(/\{\{DB_PASS\}\}/g, dbPassword)
+        .replace(/\{\{DB_GATEWAY\}\}/g, 'local');
+    await fs.writeFile(coreEnvPath, coreEnv);
+    log.success('✅ Templates prepared');
+    // Step 3: Upload/Copy files
+    log.blank();
+    log.step(3, 4, isLocal ? 'Copying files...' : 'Uploading files to server...');
+    if (isLocal) {
+        // LOCAL MODE: Direct file copy
+        log.info('📤 Copying /home/services...');
+        await runCmd('rm -rf /home/services/* 2>/dev/null ; mkdir -p /home/services');
+        await fs.copy(path.join(tempDir, 'services'), '/home/services');
+        log.success('✅ Services copied');
+        log.info(`📤 Copying /home/cores/${coreName}...`);
+        await runCmd(`rm -rf /home/cores/${coreName} ; mkdir -p /home/cores/${coreName}`);
+        await fs.copy(path.join(tempDir, 'core'), `/home/cores/${coreName}`);
+        log.success('✅ Core copied');
+    }
+    else {
+        // REMOTE MODE: SCP upload
+        log.info('📤 Uploading /home/services...');
+        await runCmd('rm -rf /home/services/* 2>/dev/null ; mkdir -p /home/services');
+        const servicesResult = await runSCP(host, path.join(tempDir, 'services'), '/home/', true);
+        if (!servicesResult.success) {
+            log.error('❌ Failed to upload services');
+            await fs.remove(tempDir);
+            return;
+        }
+        log.success('✅ Services uploaded');
+        log.info(`📤 Uploading /home/cores/${coreName}...`);
+        await runCmd(`rm -rf /home/cores/${coreName}`);
+        const coreSourcePath = path.join(tempDir, 'core');
+        const coreRenamedPath = path.join(tempDir, coreName);
+        await fs.rename(coreSourcePath, coreRenamedPath);
+        const coreResult = await runSCP(host, coreRenamedPath, '/home/cores/', true);
+        if (!coreResult.success) {
+            log.error('❌ Failed to upload core');
+            await fs.remove(tempDir);
+            return;
+        }
+        log.success('✅ Core uploaded');
+    }
+    // Verify files exist
+    log.info('🔍 Verifying file structure...');
+    const verifyFiles = [
+        `/home/cores/${coreName}/.env`,
+        `/home/cores/${coreName}/shared`,
+        `/home/cores/${coreName}/addons`,
+        '/home/services/.env',
+        '/home/services/docker-core-php.yml',
+        '/home/services/docker-core-nuxt.yml',
+        '/home/services/docker-server-nginx.yml',
+        '/home/services/nginx/conf.d',
+        '/home/services/nginx/ssl',
+    ];
+    let verifyErrors = [];
+    for (const file of verifyFiles) {
+        const check = await runCmd(`test -e ${file} && echo "OK" || echo "MISSING"`);
+        if (check.stdout.includes('MISSING')) {
+            verifyErrors.push(file);
+            log.error(`  ❌ Missing: ${file}`);
+        }
+    }
+    if (verifyErrors.length > 0) {
+        log.error('❌ File verification failed! Missing files:');
+        verifyErrors.forEach(f => log.error(`  - ${f}`));
+        await fs.remove(tempDir);
+        return;
+    }
+    log.success('✅ Files verified');
+    // Cleanup temp
+    await fs.remove(tempDir);
+    // Step 4: Start services
+    log.blank();
+    log.step(4, 4, 'Starting services...');
+    // Set permissions
+    log.info('Setting permissions...');
+    await runCmd('chmod +x /home/services/scripts/*.sh /home/services/scripts/addons/*.sh 2>/dev/null || true');
+    await runCmd('chmod -R 755 /home/cores /home/services');
+    await runCmd(`chmod 666 /home/cores/${coreName}/.env`);
+    await runCmd('chmod -R 777 /home/services/postgres/data /home/services/redis/data');
+    await runCmd('chown -R 999:999 /home/services/postgres/data 2>/dev/null || true');
+    await runCmd('chown -R 999:999 /home/services/redis/data 2>/dev/null || true');
+    // Start PostgreSQL
+    log.info('▶ Starting PostgreSQL...');
+    await runCmd('cd /home/services ; docker compose -f docker-postgresql.yml up -d');
+    // Start Redis
+    log.info('▶ Starting Redis...');
+    await runCmd('cd /home/services ; docker compose -f docker-redis.yml up -d');
+    // Wait for DB
+    log.info('⏳ Waiting for database (5s)...');
+    await runCmd('sleep 5');
+    // Start PHP
+    log.info('▶ Starting PHP...');
+    await runCmd('cd /home/services ; docker compose -f docker-core-php.yml up -d');
+    // Create storage directories
+    log.info('📁 Creating storage directories...');
+    await runCmd('sleep 2');
+    await runCmd('docker exec -u root cicore_php mkdir -p /var/www/storage/cache /var/www/storage/logs /var/www/storage/sessions /var/www/storage/uploads');
+    await runCmd('docker exec -u root cicore_php chmod -R 777 /var/www/storage');
+    await runCmd('docker exec -u root cicore_php chown -R www-data:www-data /var/www/storage');
+    // Start Nuxt
+    log.info('▶ Starting Nuxt...');
+    await runCmd('cd /home/services ; docker compose -f docker-core-nuxt.yml up -d');
+    // Start Nginx
+    log.info('▶ Starting Nginx...');
+    await runCmd('cd /home/services ; docker compose -f docker-server-nginx.yml up -d');
+    // Wait for containers
+    log.info('⏳ Waiting for containers (3s)...');
+    await runCmd('sleep 3');
+    // Show status
+    log.blank();
+    log.info('📊 Container Status:');
+    const statusResult = await runCmd('docker ps --format "table {{.Names}}\t{{.Status}}"');
+    if (statusResult.success) {
+        console.log(statusResult.stdout);
+    }
+    // Summary
+    const elapsed = ((Date.now() - startTime) / 1000 / 60).toFixed(1);
+    log.blank();
+    log.box('✅ Phase 2 Complete', [
+        `Mode: ${isLocal ? 'LOCAL' : host.hostname}`,
+        `Core: ${coreName}`,
+        `Time: ${elapsed} minutes`,
+        '',
+        `Next: vu server domain ${isLocal ? '--local' : '--host ' + host.name} --core ${coreName} --domain yourdomain.com`,
+    ]);
+    process.exit(0);
+}
+// ============================================
+// PHASE 3: SERVER DOMAIN (Nginx Config)
+// ============================================
+async function serverDomain(options) {
+    log.title('🌐 Phase 3: Domain Setup');
+    log.info('Configure nginx for domain');
+    log.blank();
+    // Check if running locally
+    const isLocal = options.local || (!options.host && (await listSSHHosts()).length === 0);
+    let runCmd;
+    let host = null;
+    if (isLocal) {
+        log.info('Running in LOCAL mode');
+        runCmd = runLocal;
+    }
+    else {
+        host = await getHost(options.host);
+        if (!host)
+            return;
+        log.info(`Target: ${host.name} (${host.user}@${host.hostname})`);
+        runCmd = (cmd, label) => runSSHLive(host, cmd, label);
+    }
+    const coreName = options.core || await input('Core name:', 'core1');
+    const domain = options.domain || await input('Domain (e.g., cicore.com.tr):');
+    if (!domain) {
+        log.error('Domain is required');
+        return;
+    }
+    log.info(`Core: ${coreName}`);
+    log.info(`Domain: ${domain}`);
+    log.blank();
+    const shouldContinue = await confirm('Configure domain?', true);
+    if (!shouldContinue) {
+        log.warn('Cancelled');
+        return;
+    }
+    // Step 1: Update core .env with domain and NUXT settings
+    log.step(1, 4, 'Updating core configuration...');
+    await runCmd(`sed -i 's|DOMAIN=.*|DOMAIN=${domain}|' /home/cores/${coreName}/.env`);
+    await runCmd(`sed -i 's|NUXT_PUBLIC_API_BASE=.*|NUXT_PUBLIC_API_BASE=https://api.${domain}|' /home/cores/${coreName}/.env`);
+    await runCmd(`sed -i 's|NUXT_PUBLIC_HOST=.*|NUXT_PUBLIC_HOST=${domain}|' /home/cores/${coreName}/.env`);
+    await runCmd(`sed -i 's|NUXT_PUBLIC_WS_URL=.*|NUXT_PUBLIC_WS_URL=wss://${domain}:2346|' /home/cores/${coreName}/.env`);
+    await runCmd(`sed -i 's|CORS_ALLOWED_ORIGINS=.*|CORS_ALLOWED_ORIGINS=https://${domain},https://www.${domain},https://api.${domain}|' /home/cores/${coreName}/.env`);
+    log.success('✅ Core .env updated');
+    // Step 1b: Update services .env for Nuxt container
+    log.info('Updating services .env for Nuxt...');
+    await runCmd(`sed -i 's|NUXT_PUBLIC_API_BASE=.*|NUXT_PUBLIC_API_BASE=https://api.${domain}|' /home/services/.env`);
+    await runCmd(`sed -i 's|NUXT_PUBLIC_HOST=.*|NUXT_PUBLIC_HOST=${domain}|' /home/services/.env`);
+    await runCmd(`sed -i 's|NUXT_PUBLIC_WS_URL=.*|NUXT_PUBLIC_WS_URL=wss://${domain}:2346|' /home/services/.env`);
+    // Recreate Nuxt container to pick up new env vars
+    log.info('Restarting Nuxt container with new settings...');
+    await runCmd('cd /home/services && docker compose -f docker-core-nuxt.yml down && docker compose -f docker-core-nuxt.yml up -d');
+    log.success('✅ Nuxt container restarted');
+    // Step 2: Generate nginx config (HTTP only - SSL added in Phase 4)
+    log.blank();
+    log.step(2, 4, 'Generating nginx configuration...');
+    const configName = domain.replace(/\./g, '_');
+    const escapedDomain = domain.replace(/\./g, '\\\\.');
+    const certName = domain.replace(/\./g, '_');
+    // Generate full nginx config with API subdomain, web server, and tenant subdomains
+    const nginxConfig = `# ciCore Domain Config - ${domain} -> ${coreName}
+# Generated by: vu server domain
+# API: api.${domain} -> PHP backend
+# Web: ${domain}, www.${domain} -> Nuxt frontend
+# Tenants: *.${domain} (except api) -> Nuxt frontend
+
+# ======================================================
+# 1. API SUBDOMAIN SERVER (api.${domain})
+# ======================================================
+server {
+    listen 80;
+    server_name api.${domain};
+    
+    client_max_body_size 25m;
+
+    location / {
+        # CORS Preflight
+        if (\$request_method = 'OPTIONS') {
+            add_header 'Access-Control-Allow-Origin' \$http_origin always;
+            add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, PATCH, DELETE, OPTIONS' always;
+            add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, X-Requested-With, X-CSRF-Token, X-Core-Path, X-Tenant-Host, Cache-Control, Accept' always;
+            add_header 'Access-Control-Allow-Credentials' 'true' always;
+            add_header 'Access-Control-Max-Age' '86400' always;
+            add_header 'Content-Type' 'text/plain; charset=utf-8' always;
+            add_header 'Content-Length' '0' always;
+            return 204;
+        }
+
+        add_header 'Access-Control-Allow-Origin' \$http_origin always;
+        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, PATCH, DELETE, OPTIONS' always;
+        add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, X-Requested-With, X-CSRF-Token, X-Core-Path, X-Tenant-Host, Accept' always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'Access-Control-Expose-Headers' 'X-CSRF-Token' always;
+
+        fastcgi_pass php_backend;
+        fastcgi_param SCRIPT_FILENAME /var/www/public/index.php;
+        fastcgi_param CORE_PATH /var/www/cores/${coreName};
+        include fastcgi_params;
+        fastcgi_param REQUEST_URI \$request_uri;
+        fastcgi_param SCRIPT_NAME /index.php;
+        fastcgi_param HTTP_HOST \$host;
+        fastcgi_param HTTP_TENANT_HOST \$host;
+
+        fastcgi_connect_timeout 300s;
+        fastcgi_send_timeout 300s;
+        fastcgi_read_timeout 300s;
+        fastcgi_buffer_size 128k;
+        fastcgi_buffers 4 256k;
+        fastcgi_busy_buffers_size 256k;
+    }
+}
+
+# ======================================================
+# 2. TENANT SUBDOMAIN SERVER (*.${domain} except api)
+# ======================================================
+server {
+    listen 80;
+    server_name ~^(?!api\\.)(?<subdomain>[^.]+)\\.${escapedDomain}\$;
+
+    client_max_body_size 25m;
+
+    # Health Check
+    location /health {
+        access_log off;
+        return 200 "healthy\\n";
+        add_header Content-Type text/plain;
+    }
+
+    # Shared API Files
+    location ^~ /shared/ {
+        alias /home/cores/${coreName}/shared/;
+        autoindex off;
+        types { application/javascript js mjs; application/json json; }
+        default_type application/javascript;
+        add_header 'Access-Control-Allow-Origin' \$http_origin always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'Cache-Control' 'public, max-age=3600' always;
+        try_files \$uri =404;
+    }
+
+    # Addon ESM Files
+    location ^~ /cores/ {
+        alias /home/cores/;
+        autoindex off;
+        types { application/javascript js mjs; application/json json; text/css css; }
+        default_type application/javascript;
+        add_header 'Access-Control-Allow-Origin' \$http_origin always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        try_files \$uri =404;
+    }
+
+    # Frontend (Nuxt SSR)
+    location / {
+        proxy_pass http://nuxt_frontend;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+        proxy_set_header X-Core-Path /var/www/cores/${coreName};
+        proxy_set_header X-Tenant-Host \$host;
+        proxy_set_header X-Tenant-Subdomain \$subdomain;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade \$http_upgrade;
+        proxy_set_header Connection \$connection_upgrade;
+        proxy_buffering off;
+    }
+}
+
+# ======================================================
+# 3. MAIN WEB SERVER (${domain}, www.${domain})
+# ======================================================
+server {
+    listen 80;
+    server_name ${domain} www.${domain};
+
+    client_max_body_size 25m;
+
+    # Health Check
+    location /health {
+        access_log off;
+        return 200 "healthy\\n";
+        add_header Content-Type text/plain;
+    }
+
+    # Shared API Files
+    location ^~ /shared/ {
+        alias /home/cores/${coreName}/shared/;
+        autoindex off;
+        types { application/javascript js mjs; application/json json; }
+        default_type application/javascript;
+        add_header 'Access-Control-Allow-Origin' \$http_origin always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'Cache-Control' 'public, max-age=3600' always;
+        try_files \$uri =404;
+    }
+
+    # Addon ESM Files
+    location ^~ /cores/ {
+        alias /home/cores/;
+        autoindex off;
+        types { application/javascript js mjs; application/json json; text/css css; }
+        default_type application/javascript;
+        add_header 'Access-Control-Allow-Origin' \$http_origin always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        try_files \$uri =404;
+    }
+
+    # API Endpoints (on web domain)
+    location ~ ^/(api|v1|v2|auth|system|system-settings|upload|addons|core_addons|core|analyzer|summary|metrics|jobs|worker|setup|tenant-manager) {
+        # CORS Preflight
+        if (\$request_method = 'OPTIONS') {
+            add_header 'Access-Control-Allow-Origin' \$http_origin always;
+            add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, PATCH, DELETE, OPTIONS' always;
+            add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, X-Requested-With, X-CSRF-Token, X-Core-Path, X-Tenant-Host, Cache-Control, Accept' always;
+            add_header 'Access-Control-Allow-Credentials' 'true' always;
+            add_header 'Access-Control-Max-Age' '86400' always;
+            add_header 'Content-Type' 'text/plain; charset=utf-8' always;
+            add_header 'Content-Length' '0' always;
+            return 204;
+        }
+
+        add_header 'Access-Control-Allow-Origin' \$http_origin always;
+        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, PATCH, DELETE, OPTIONS' always;
+        add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, X-Requested-With, X-CSRF-Token, X-Core-Path, X-Tenant-Host, Accept' always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'Access-Control-Expose-Headers' 'X-CSRF-Token' always;
+
+        fastcgi_pass php_backend;
+        fastcgi_param SCRIPT_FILENAME /var/www/public/index.php;
+        fastcgi_param CORE_PATH /var/www/cores/${coreName};
+        include fastcgi_params;
+        fastcgi_param REQUEST_URI \$request_uri;
+        fastcgi_param SCRIPT_NAME /index.php;
+        fastcgi_param HTTP_HOST \$host;
+        fastcgi_param HTTP_TENANT_HOST \$host;
+
+        fastcgi_connect_timeout 300s;
+        fastcgi_send_timeout 300s;
+        fastcgi_read_timeout 300s;
+        fastcgi_buffer_size 128k;
+        fastcgi_buffers 4 256k;
+        fastcgi_busy_buffers_size 256k;
+    }
+
+    # Frontend (Nuxt SSR)
+    location / {
+        proxy_pass http://nuxt_frontend;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+        proxy_set_header X-Core-Path /var/www/cores/${coreName};
+        proxy_set_header X-Tenant-Host \$host;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade \$http_upgrade;
+        proxy_set_header Connection \$connection_upgrade;
+        proxy_buffering off;
+    }
+}`;
+    // Write nginx config
+    await runCmd(`cat > /home/services/nginx/conf.d/${configName}.conf << 'NGINX_EOF'
+${nginxConfig}
+NGINX_EOF`);
+    log.success('✅ Nginx config created');
+    log.info(`  - API: api.${domain} -> PHP`);
+    log.info(`  - Web: ${domain}, www.${domain} -> Nuxt`);
+    log.info(`  - Tenants: *.${domain} -> Nuxt`);
+    // Step 3: Test and reload nginx
+    log.blank();
+    log.step(3, 4, 'Testing nginx configuration...');
+    const nginxTest = await runCmd('docker exec cicore_global_nginx nginx -t');
+    if (!nginxTest.success) {
+        log.error('❌ Nginx config test failed');
+        return;
+    }
+    log.success('✅ Nginx config valid');
+    // Step 4: Reload nginx
+    log.step(4, 4, 'Reloading nginx...');
+    await runCmd('docker exec cicore_global_nginx nginx -s reload');
+    log.success('✅ Nginx reloaded');
+    log.blank();
+    log.box('✅ Phase 3 Complete', [
+        `Domain: ${domain}`,
+        `Core: ${coreName}`,
+        '',
+        `Next: vu server ssl --domain ${domain}`,
+    ]);
+}
+// ============================================
+// PHASE 4: SERVER SSL (Certificate)
+// ============================================
+async function serverSSL(options) {
+    log.title('🔒 Phase 4: SSL Setup');
+    log.info('Configure SSL certificate');
+    log.blank();
+    // Check if running locally
+    const isLocal = options.local || (!options.host && (await listSSHHosts()).length === 0);
+    let runCmd;
+    let host = null;
+    if (isLocal) {
+        log.info('Running in LOCAL mode');
+        runCmd = runLocal;
+    }
+    else {
+        host = await getHost(options.host);
+        if (!host)
+            return;
+        log.info(`Target: ${host.name} (${host.user}@${host.hostname})`);
+        runCmd = (cmd, label) => runSSHLive(host, cmd, label);
+    }
+    const domain = options.domain || await input('Domain:');
+    if (!domain) {
+        log.error('Domain is required');
+        return;
+    }
+    const useCloudflare = options.letsencrypt ? false : (options.cloudflare || await confirm('Use Cloudflare Origin Certificate?', true));
+    log.info(`Domain: ${domain}`);
+    log.info(`Method: ${useCloudflare ? 'Cloudflare' : "Let's Encrypt"}`);
+    log.blank();
+    const shouldContinue = await confirm('Setup SSL?', true);
+    if (!shouldContinue) {
+        log.warn('Cancelled');
+        return;
+    }
+    const certName = domain.split('.')[0];
+    const certPath = `/home/services/nginx/ssl/${certName}.crt`;
+    const keyPath = `/home/services/nginx/ssl/${certName}.key`;
+    // Check if SSL exists
+    const sslCheck = await runCmd(`test -f ${certPath} && echo "EXISTS" || echo "MISSING"`);
+    if (sslCheck.stdout.includes('EXISTS')) {
+        log.info(`✅ SSL certificate already exists: ${certPath}`);
+        const overwrite = await confirm('Overwrite existing certificate?', false);
+        if (!overwrite) {
+            log.warn('Cancelled');
+            return;
+        }
+    }
+    if (useCloudflare) {
+        // Cloudflare Origin Certificate
+        log.step(1, 2, 'Creating Cloudflare Origin Certificate...');
+        const cfToken = await getCloudflareToken();
+        if (!cfToken) {
+            log.error('Cloudflare token not configured. Run: vu cloudflare auth');
+            return;
+        }
+        // Get server IP for Cloudflare
+        const serverIP = host?.hostname || '127.0.0.1';
+        const cfResult = await setupDomainForVuCore(domain, serverIP, {
+            createWildcard: true,
+            createApiSubdomain: true,
+            sslMode: 'strict',
+        });
+        if (!cfResult.success || !cfResult.certificate) {
+            log.error('❌ Failed to create Cloudflare certificate');
+            log.error(cfResult.error || 'Unknown error');
+            return;
+        }
+        // Upload certificate
+        log.blank();
+        log.step(2, 2, 'Uploading certificate to server...');
+        await runCmd(`mkdir -p /home/services/nginx/ssl`);
+        await runCmd(`cat > ${certPath} << 'CERT_EOF'
+${cfResult.certificate.certificate}
+CERT_EOF`);
+        await runCmd(`cat > ${keyPath} << 'KEY_EOF'
+${cfResult.certificate.private_key}
+KEY_EOF`);
+        await runCmd(`chmod 600 ${certPath} ${keyPath}`);
+        log.success('✅ Cloudflare SSL configured');
+        log.kv('Certificate', certPath);
+        log.kv('Expires', cfResult.certificate.expires_on);
+    }
+    else {
+        // Let's Encrypt
+        const email = options.email || await input('Email for Let\'s Encrypt:', 'admin@' + domain);
+        log.step(1, 2, 'Obtaining Let\'s Encrypt certificate...');
+        // First install certbot if not present
+        await runCmd('which certbot || apt-get install -y certbot', 'Installing certbot...');
+        // Stop nginx temporarily for standalone mode
+        await runCmd('docker stop cicore_global_nginx 2>/dev/null || true', 'Stopping nginx...');
+        const certbotResult = await runCmd(`certbot certonly --standalone -d ${domain} -d www.${domain} --email ${email} --agree-tos --non-interactive`, 'Getting certificate...');
+        // Restart nginx
+        await runCmd('docker start cicore_global_nginx 2>/dev/null || true', 'Starting nginx...');
+        if (!certbotResult.success) {
+            log.error('❌ Let\'s Encrypt certificate failed');
+            return;
+        }
+        log.blank();
+        log.step(2, 2, 'Copying certificate...');
+        await runCmd(`mkdir -p /home/services/nginx/ssl`);
+        await runCmd(`cp /etc/letsencrypt/live/${domain}/fullchain.pem ${certPath}`);
+        await runCmd(`cp /etc/letsencrypt/live/${domain}/privkey.pem ${keyPath}`);
+        log.success('✅ Let\'s Encrypt SSL configured');
+    }
+    // Update nginx config for SSL - get coreName from existing config
+    log.blank();
+    log.info('Updating nginx for HTTPS...');
+    const configName = domain.replace(/\./g, '_');
+    const escapedDomain = domain.replace(/\./g, '\\\\.');
+    // Try to detect coreName from existing config
+    const coreDetect = await runCmd(`grep -oP 'CORE_PATH /var/www/cores/\\K[^;]+' /home/services/nginx/conf.d/${configName}.conf 2>/dev/null | head -1`);
+    const coreName = coreDetect.stdout.trim() || 'core1';
+    // Read CDN URL from core's .env file (dynamic per-core CDN support)
+    const cdnUrlResult = await runCmd(`grep -oP 'NUXT_PUBLIC_CORE_CDN_URL=\\K.*' /home/cores/${coreName}/.env 2>/dev/null | head -1`);
+    const cdnUrl = cdnUrlResult.stdout.trim() || 'https://cdn.cicore.com.tr/CoreUI/latest';
+    log.info(`CDN URL: ${cdnUrl}`);
+    // Generate comprehensive HTTPS nginx config with API subdomain, wildcard SSL, and CORS
+    const sslNginxConfig = `# ciCore Domain Config - ${domain} -> ${coreName}
+# CDN URL: ${cdnUrl}
+# Generated by: vu server ssl
+# API: api.${domain} -> PHP backend (HTTPS)
+# Web: ${domain}, www.${domain} -> Nuxt frontend (HTTPS)
+# Tenants: *.${domain} (except api) -> Nuxt frontend (HTTPS)
+# Wildcard SSL: Cloudflare Origin Certificate covers *.${domain}
+
+# ======================================================
+# 1. HTTP -> HTTPS Redirect (All domains)
+# ======================================================
+server {
+    listen 80;
+    server_name ${domain} *.${domain};
+    
+    location /health {
+        access_log off;
+        return 200 "healthy\\n";
+        add_header Content-Type text/plain;
+    }
+    
+    location / {
+        return 301 https://\$host\$request_uri;
+    }
+}
+
+# ======================================================
+# 2. API SUBDOMAIN SERVER (api.${domain}) - HTTPS
+# ======================================================
+server {
+    listen 443 ssl;
+    http2 on;
+    server_name api.${domain};
+
+    ssl_certificate /etc/nginx/ssl/${certName}.crt;
+    ssl_certificate_key /etc/nginx/ssl/${certName}.key;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 10m;
+
+    client_max_body_size 25m;
+    server_tokens off;
+
+    # Security Headers
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+
+    location / {
+        # CORS Preflight
+        if (\$request_method = 'OPTIONS') {
+            add_header 'Access-Control-Allow-Origin' \$http_origin always;
+            add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, PATCH, DELETE, OPTIONS' always;
+            add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, X-Requested-With, X-CSRF-Token, X-Core-Path, X-Tenant-Host, Cache-Control, Accept' always;
+            add_header 'Access-Control-Allow-Credentials' 'true' always;
+            add_header 'Access-Control-Max-Age' '86400' always;
+            add_header 'Content-Type' 'text/plain; charset=utf-8' always;
+            add_header 'Content-Length' '0' always;
+            return 204;
+        }
+
+        add_header 'Access-Control-Allow-Origin' \$http_origin always;
+        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, PATCH, DELETE, OPTIONS' always;
+        add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, X-Requested-With, X-CSRF-Token, X-Core-Path, X-Tenant-Host, Accept' always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'Access-Control-Expose-Headers' 'X-CSRF-Token' always;
+
+        fastcgi_pass php_backend;
+        fastcgi_param SCRIPT_FILENAME /var/www/public/index.php;
+        fastcgi_param CORE_PATH /var/www/cores/${coreName};
+        include fastcgi_params;
+        fastcgi_param REQUEST_URI \$request_uri;
+        fastcgi_param SCRIPT_NAME /index.php;
+        fastcgi_param HTTP_HOST \$host;
+        fastcgi_param HTTP_TENANT_HOST \$host;
+        fastcgi_param HTTPS on;
+        fastcgi_param HTTP_X_FORWARDED_PROTO https;
+
+        fastcgi_connect_timeout 300s;
+        fastcgi_send_timeout 300s;
+        fastcgi_read_timeout 300s;
+        fastcgi_buffer_size 128k;
+        fastcgi_buffers 4 256k;
+        fastcgi_busy_buffers_size 256k;
+        fastcgi_temp_file_write_size 256k;
+    }
+}
+
+# ======================================================
+# 3. TENANT SUBDOMAIN SERVER (*.${domain} except api) - HTTPS
+# Wildcard subdomain - her tenant kendi subdomain'inde çalışır
+# ======================================================
+server {
+    listen 443 ssl;
+    http2 on;
+    server_name ~^(?!api\\.)(?<subdomain>[^.]+)\\.${escapedDomain}\$;
+
+    ssl_certificate /etc/nginx/ssl/${certName}.crt;
+    ssl_certificate_key /etc/nginx/ssl/${certName}.key;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 10m;
+
+    client_max_body_size 25m;
+    client_body_timeout 60s;
+    client_header_timeout 60s;
+    server_tokens off;
+
+    # Security Headers
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+
+    # Gzip Compression
+    gzip on;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_min_length 1000;
+    gzip_types text/plain text/css text/xml text/javascript application/json application/javascript application/xml+rss application/rss+xml font/truetype font/opentype application/vnd.ms-fontobject image/svg+xml;
+
+    # Health Check
+    location /health {
+        access_log off;
+        return 200 "healthy\\n";
+        add_header Content-Type text/plain;
+    }
+
+    # CDN Proxy for Nuxt Assets (/_nuxt/ -> CDN)
+    location ^~ /_nuxt/ {
+        proxy_pass ${cdnUrl}/_nuxt/;
+        proxy_ssl_server_name on;
+        proxy_cache_valid 200 365d;
+        proxy_cache_valid 404 1m;
+        add_header 'Cache-Control' 'public, max-age=31536000, immutable' always;
+        add_header 'Access-Control-Allow-Origin' '*' always;
+        proxy_hide_header 'Access-Control-Allow-Origin';
+        proxy_intercept_errors on;
+        error_page 404 = @nuxt_fallback_tenant;
+    }
+
+    # Fallback to Nuxt if CDN file not found
+    location @nuxt_fallback_tenant {
+        proxy_pass http://nuxt_frontend;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+    }
+
+    # Shared API Files
+    location ^~ /shared/ {
+        alias /home/cores/${coreName}/shared/;
+        autoindex off;
+        types { application/javascript js mjs; application/json json; }
+        default_type application/javascript;
+        add_header 'Access-Control-Allow-Origin' \$http_origin always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'Cache-Control' 'public, max-age=3600, immutable' always;
+        try_files \$uri =404;
+    }
+
+    # Vendor Libs
+    location ^~ /vendor/ {
+        alias /home/cores/${coreName}/shared/vendor/;
+        autoindex off;
+        types { application/javascript js mjs; }
+        default_type application/javascript;
+        add_header 'Access-Control-Allow-Origin' \$http_origin always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'Cache-Control' 'public, max-age=31536000, immutable' always;
+        try_files \$uri =404;
+    }
+
+    # Addon ESM Files
+    location ^~ /cores/ {
+        alias /home/cores/;
+        autoindex off;
+        types { application/javascript js mjs; application/json json; text/css css; text/html html vue; image/svg+xml svg; }
+        default_type application/javascript;
+        add_header 'Access-Control-Allow-Origin' \$http_origin always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'X-Content-Type-Options' 'nosniff' always;
+        open_file_cache off;
+        try_files \$uri =404;
+    }
+
+    # Frontend (Nuxt SSR) - Tenant subdomain olarak yönlendir
+    location / {
+        proxy_pass http://nuxt_frontend;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Forwarded-Host \$host;
+        proxy_set_header X-Core-Path /var/www/cores/${coreName};
+        proxy_set_header X-Tenant-Host \$host;
+        proxy_set_header X-Tenant-Subdomain \$subdomain;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade \$http_upgrade;
+        proxy_set_header Connection \$connection_upgrade;
+        proxy_connect_timeout 300s;
+        proxy_send_timeout 300s;
+        proxy_read_timeout 300s;
+        proxy_buffering off;
+        proxy_cache_bypass \$http_upgrade;
+    }
+
+    # Deny Hidden Files
+    location ~ /\\.(?!well-known) {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+}
+
+# ======================================================
+# 4. MAIN WEB SERVER (${domain}, www.${domain}) - HTTPS
+# ======================================================
+server {
+    listen 443 ssl;
+    http2 on;
+    server_name ${domain} www.${domain};
+
+    ssl_certificate /etc/nginx/ssl/${certName}.crt;
+    ssl_certificate_key /etc/nginx/ssl/${certName}.key;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 10m;
+
+    client_max_body_size 25m;
+    client_body_timeout 60s;
+    client_header_timeout 60s;
+    server_tokens off;
+
+    # Security Headers
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+
+    # Gzip Compression
+    gzip on;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_min_length 1000;
+    gzip_types text/plain text/css text/xml text/javascript application/json application/javascript application/xml+rss application/rss+xml font/truetype font/opentype application/vnd.ms-fontobject image/svg+xml;
+
+    # Health Check
+    location /health {
+        access_log off;
+        return 200 "healthy\\n";
+        add_header Content-Type text/plain;
+    }
+
+    # CDN Proxy for Nuxt Assets (/_nuxt/ -> CDN)
+    # Each core can use its own CDN URL from .env (NUXT_PUBLIC_CORE_CDN_URL)
+    location ^~ /_nuxt/ {
+        proxy_pass ${cdnUrl}/_nuxt/;
+        proxy_ssl_server_name on;
+        proxy_cache_valid 200 365d;
+        proxy_cache_valid 404 1m;
+        add_header 'Cache-Control' 'public, max-age=31536000, immutable' always;
+        add_header 'Access-Control-Allow-Origin' '*' always;
+        proxy_hide_header 'Access-Control-Allow-Origin';
+        proxy_intercept_errors on;
+        error_page 404 = @nuxt_fallback;
+    }
+
+    # Fallback to Nuxt if CDN file not found
+    location @nuxt_fallback {
+        proxy_pass http://nuxt_frontend;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+    }
+
+    # Shared API Files
+    location ^~ /shared/ {
+        alias /home/cores/${coreName}/shared/;
+        autoindex off;
+        types { application/javascript js mjs; application/json json; }
+        default_type application/javascript;
+        add_header 'Access-Control-Allow-Origin' \$http_origin always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'Cache-Control' 'public, max-age=3600, immutable' always;
+        try_files \$uri =404;
+    }
+
+    # Vendor Libs
+    location ^~ /vendor/ {
+        alias /home/cores/${coreName}/shared/vendor/;
+        autoindex off;
+        types { application/javascript js mjs; }
+        default_type application/javascript;
+        add_header 'Access-Control-Allow-Origin' \$http_origin always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'Cache-Control' 'public, max-age=31536000, immutable' always;
+        try_files \$uri =404;
+    }
+
+    # Addon ESM Files
+    location ^~ /cores/ {
+        alias /home/cores/;
+        autoindex off;
+        types { application/javascript js mjs; application/json json; text/css css; text/html html vue; image/svg+xml svg; }
+        default_type application/javascript;
+        add_header 'Access-Control-Allow-Origin' \$http_origin always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'X-Content-Type-Options' 'nosniff' always;
+        open_file_cache off;
+        try_files \$uri =404;
+    }
+
+    # API Endpoints (on web domain)
+    location ~ ^/(api|v1|v2|auth|system|system-settings|upload|addons|core_addons|core|analyzer|summary|metrics|jobs|worker|setup|tenant-manager|login|logout|me|public|status) {
+        # CORS Preflight
+        if (\$request_method = 'OPTIONS') {
+            add_header 'Access-Control-Allow-Origin' \$http_origin always;
+            add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, PATCH, DELETE, OPTIONS' always;
+            add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, X-Requested-With, X-CSRF-Token, X-Core-Path, X-Tenant-Host, Cache-Control, Accept' always;
+            add_header 'Access-Control-Allow-Credentials' 'true' always;
+            add_header 'Access-Control-Max-Age' '86400' always;
+            add_header 'Content-Type' 'text/plain; charset=utf-8' always;
+            add_header 'Content-Length' '0' always;
+            return 204;
+        }
+
+        add_header 'Access-Control-Allow-Origin' \$http_origin always;
+        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, PATCH, DELETE, OPTIONS' always;
+        add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, X-Requested-With, X-CSRF-Token, X-Core-Path, X-Tenant-Host, Accept' always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'Access-Control-Expose-Headers' 'X-CSRF-Token' always;
+
+        fastcgi_pass php_backend;
+        fastcgi_param SCRIPT_FILENAME /var/www/public/index.php;
+        fastcgi_param CORE_PATH /var/www/cores/${coreName};
+        include fastcgi_params;
+        fastcgi_param REQUEST_URI \$request_uri;
+        fastcgi_param SCRIPT_NAME /index.php;
+        fastcgi_param HTTP_HOST \$host;
+        fastcgi_param HTTP_TENANT_HOST \$host;
+        fastcgi_param HTTPS on;
+        fastcgi_param HTTP_X_FORWARDED_PROTO https;
+
+        fastcgi_connect_timeout 300s;
+        fastcgi_send_timeout 300s;
+        fastcgi_read_timeout 300s;
+        fastcgi_buffer_size 128k;
+        fastcgi_buffers 4 256k;
+        fastcgi_busy_buffers_size 256k;
+        fastcgi_temp_file_write_size 256k;
+    }
+
+    # Frontend (Nuxt SSR)
+    location / {
+        proxy_pass http://nuxt_frontend;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Forwarded-Host \$host;
+        proxy_set_header X-Core-Path /var/www/cores/${coreName};
+        proxy_set_header X-Tenant-Host \$host;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade \$http_upgrade;
+        proxy_set_header Connection \$connection_upgrade;
+        proxy_connect_timeout 300s;
+        proxy_send_timeout 300s;
+        proxy_read_timeout 300s;
+        proxy_buffering off;
+        proxy_cache_bypass \$http_upgrade;
+    }
+
+    # Deny Hidden Files
+    location ~ /\\.(?!well-known) {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+}`;
+    await runCmd(`cat > /home/services/nginx/conf.d/${configName}.conf << 'NGINX_EOF'
+${sslNginxConfig}
+NGINX_EOF`);
+    // Recreate ALL containers with no-cache to ensure fresh state
+    // This ensures SSL certificates and all configs are properly loaded
+    log.info('Recreating all containers (no-cache)...');
+    // Stop all containers
+    await runCmd('cd /home/services && docker compose -f docker-server-nginx.yml down 2>/dev/null || true');
+    await runCmd('cd /home/services && docker compose -f docker-core-nuxt.yml down 2>/dev/null || true');
+    await runCmd('cd /home/services && docker compose -f docker-core-php.yml down 2>/dev/null || true');
+    await runCmd('cd /home/services && docker compose -f docker-redis.yml down 2>/dev/null || true');
+    await runCmd('cd /home/services && docker compose -f docker-postgresql.yml down 2>/dev/null || true');
+    // Remove any orphan containers
+    await runCmd('docker container prune -f 2>/dev/null || true');
+    // Start all containers fresh (in correct order)
+    log.info('▶ Starting PostgreSQL...');
+    await runCmd('cd /home/services && docker compose -f docker-postgresql.yml up -d --force-recreate');
+    log.info('▶ Starting Redis...');
+    await runCmd('cd /home/services && docker compose -f docker-redis.yml up -d --force-recreate');
+    log.info('⏳ Waiting for database (5s)...');
+    await runCmd('sleep 5');
+    log.info('▶ Starting PHP...');
+    await runCmd('cd /home/services && docker compose -f docker-core-php.yml up -d --force-recreate');
+    log.info('▶ Starting Nuxt...');
+    await runCmd('cd /home/services && docker compose -f docker-core-nuxt.yml up -d --force-recreate');
+    log.info('▶ Starting Nginx...');
+    await runCmd('cd /home/services && docker compose -f docker-server-nginx.yml up -d --force-recreate');
+    // Wait for containers to stabilize
+    log.info('⏳ Waiting for containers (5s)...');
+    await runCmd('sleep 5');
+    // Create storage directories in PHP container (required after recreate)
+    log.info('📁 Creating storage directories...');
+    await runCmd('docker exec -u root cicore_php mkdir -p /var/www/storage/cache /var/www/storage/logs /var/www/storage/sessions /var/www/storage/uploads');
+    await runCmd('docker exec -u root cicore_php chmod -R 777 /var/www/storage');
+    await runCmd('docker exec -u root cicore_php chown -R www-data:www-data /var/www/storage');
+    // Test nginx config
+    const nginxTest = await runCmd('docker exec cicore_global_nginx nginx -t');
+    if (!nginxTest.success) {
+        log.error('❌ Nginx config test failed');
+        return;
+    }
+    log.success('✅ All containers recreated');
+    // Show container status
+    log.blank();
+    log.info('📊 Container Status:');
+    const statusResult = await runCmd('docker ps --format "table {{.Names}}\t{{.Status}}"');
+    if (statusResult.success) {
+        console.log(statusResult.stdout);
+    }
+    log.blank();
+    log.box('✅ Phase 4 Complete', [
+        `Domain: ${domain}`,
+        `SSL: ${useCloudflare ? 'Cloudflare Origin' : "Let's Encrypt"}`,
+        '',
+        `Visit: https://${domain}`,
+    ]);
+}
+// ============================================
+// FULL INSTALL (All Phases)
+// ============================================
+async function serverInstallFull(options) {
+    log.title('🚀 ciCore Full Installation');
+    log.info('Running all phases: setup → deploy → domain → ssl');
+    log.blank();
+    const host = await getHost(options.host);
+    if (!host)
+        return;
+    const coreName = options.core || await input('Core name:', 'core1');
+    const domain = options.domain || await input('Root domain:');
+    if (!domain) {
+        log.error('Domain is required');
+        return;
+    }
+    log.info('Configuration:');
+    log.kv('Host', `${host.name} (${host.hostname})`);
+    log.kv('Core', coreName);
+    log.kv('Domain', domain);
+    log.blank();
+    const shouldContinue = await confirm('Start full installation?', true);
+    if (!shouldContinue) {
+        log.warn('Cancelled');
+        return;
+    }
+    // Phase 1: Setup
+    log.blank();
+    await serverSetup({ host: host.name, skipDocker: options.skipDocker });
+    // Phase 2: Deploy
+    log.blank();
+    await serverDeploy({ host: host.name, core: coreName });
+    // Phase 3: Domain
+    log.blank();
+    await serverDomain({ host: host.name, core: coreName, domain });
+    // Phase 4: SSL (if not skipped)
+    if (!options.skipSsl) {
+        log.blank();
+        await serverSSL({ host: host.name, domain, cloudflare: options.cloudflare });
+    }
+    log.blank();
+    log.box('🎉 Installation Complete!', [
+        `Server: ${host.hostname}`,
+        `Core: ${coreName}`,
+        `Domain: ${domain}`,
+        '',
+        `Visit: https://${domain}`,
+    ]);
+    process.exit(0);
+}
+// ============================================
+// SERVER CLI - Install/Run CLI on Remote Server
+// ============================================
+async function serverCLI(options) {
+    log.title('🖥️ Remote CLI Management');
+    log.blank();
+    const host = await getHost(options.host);
+    if (!host)
+        return;
+    if (options.install) {
+        await installCLIOnServer(host);
+    }
+    else if (options.run) {
+        await runRemoteCLI(host.name, options.run);
+    }
+    else {
+        // Default: check if CLI is installed, if not install it
+        log.info('Checking CLI installation on server...');
+        const checkResult = await runSSH(host, 'which vu 2>/dev/null || echo "NOT_INSTALLED"');
+        if (checkResult.stdout.includes('NOT_INSTALLED')) {
+            log.warn('CLI not installed on server');
+            const shouldInstall = await confirm('Install CLI on server?', true);
+            if (shouldInstall) {
+                await installCLIOnServer(host);
+            }
+        }
+        else {
+            log.success('✅ CLI is installed on server');
+            const versionResult = await runSSH(host, 'vu --version');
+            if (versionResult.success) {
+                log.info(`Version: ${versionResult.stdout.trim()}`);
+            }
+        }
+    }
+    process.exit(0);
+}
+async function installCLIOnServer(host) {
+    const startTime = Date.now();
+    // Helper for live SSH - runs command and shows output in real-time
+    const sshLive = async (cmd, label) => {
+        log.info(`  → ${label}`);
+        const args = buildSSHCommand(host, cmd);
+        const result = await exec('ssh', args, { silent: false, stream: true });
+        return result.success;
+    };
+    log.blank();
+    log.info('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+    log.info('  CiCore CLI Remote Installation');
+    log.info(`  Target: ${host.user}@${host.hostname}`);
+    log.info('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+    // Step 1: Check Node.js
+    log.blank();
+    log.step(1, 6, 'Checking Node.js runtime...');
+    await sshLive('node --version ; npm --version', 'Checking versions...');
+    log.success('  ✅ Node.js check complete');
+    // Step 2: Prepare directory
+    log.blank();
+    log.step(2, 6, 'Preparing directory...');
+    // Use semicolon instead of && for Windows SSH compatibility
+    await sshLive('rm -rf /opt/vucore-cli ; mkdir -p /opt/vucore-cli ; ls -la /opt/vucore-cli', 'Creating /opt/vucore-cli...');
+    log.success('  ✅ Directory ready');
+    // Step 3: Package and upload
+    log.blank();
+    log.step(3, 6, 'Packaging and uploading...');
+    const cliPath = path.join(paths.dev.root, 'cli');
+    const tempTar = path.join(paths.dev.root, '.tmp-cli.tar.gz');
+    log.info('  → Creating local package (including pre-built dist and templates)...');
+    // Include dist folder and templates so we don't need to build on server
+    // Templates are needed for 'vu server deploy --local'
+    await exec('tar', ['-czf', tempTar, '-C', cliPath, '--exclude=node_modules', '--exclude=.git', '.'], { silent: true });
+    const stats = await fs.stat(tempTar);
+    log.info(`  → Package size: ${(stats.size / 1024 / 1024).toFixed(2)} MB`);
+    log.info('  → Uploading to server...');
+    const uploadResult = await runSCP(host, tempTar, '/opt/vucore-cli/cli.tar.gz', false);
+    await fs.remove(tempTar);
+    if (!uploadResult.success) {
+        log.error('  ❌ Upload failed');
+        return;
+    }
+    log.success('  ✅ Uploaded');
+    // Step 4: Extract and install
+    log.blank();
+    log.step(4, 6, 'Installing on server (live output)...');
+    await sshLive('cd /opt/vucore-cli ; tar -xzf cli.tar.gz ; rm cli.tar.gz ; ls -la', 'Extracting package...');
+    log.blank();
+    log.info('  → Running npm install (this will show live output)...');
+    log.blank();
+    if (!await sshLive('cd /opt/vucore-cli ; npm install --production 2>&1', 'npm install')) {
+        log.error('  ❌ npm install failed');
+        return;
+    }
+    log.success('  ✅ Dependencies installed');
+    // Skip build - we already have dist folder from local build
+    await sshLive('ls -la /opt/vucore-cli/dist/', 'Checking dist folder...');
+    // Step 5: Create command
+    log.blank();
+    log.step(5, 6, 'Creating global command...');
+    // Use printf to create wrapper script (works reliably across platforms)
+    const createCmd = `printf '#!/bin/bash\\nnode /opt/vucore-cli/dist/index.js "$$@"\\n' > /usr/local/bin/vu`;
+    await sshLive(createCmd, 'Creating wrapper script...');
+    await sshLive('chmod +x /usr/local/bin/vu', 'Setting permissions...');
+    await sshLive('cat /usr/local/bin/vu', 'Verifying script content...');
+    await sshLive('vu --version', 'Testing vu command...');
+    log.success('  ✅ /usr/local/bin/vu created');
+    // Verify
+    log.blank();
+    log.info('Verifying installation...');
+    await sshLive('node /opt/vucore-cli/dist/index.js --version', 'Running CLI...');
+    // Step 6: Copy config files (Cloudflare token, etc.)
+    log.blank();
+    log.step(6, 6, 'Copying config files...');
+    const homeDir = process.env.HOME || process.env.USERPROFILE || '';
+    const vucoreConfigDir = path.join(homeDir, '.vucore');
+    const cloudflareConfig = path.join(vucoreConfigDir, 'cloudflare.json');
+    // Create .vucore directory on server
+    await sshLive('mkdir -p /root/.vucore', 'Creating config directory...');
+    // Copy Cloudflare token if exists
+    if (await fs.pathExists(cloudflareConfig)) {
+        log.info('  → Copying Cloudflare token...');
+        const cfUpload = await runSCP(host, cloudflareConfig, '/root/.vucore/cloudflare.json', false);
+        if (cfUpload.success) {
+            log.success('  ✅ Cloudflare token copied');
+        }
+        else {
+            log.warn('  ⚠️ Failed to copy Cloudflare token');
+        }
+    }
+    else {
+        log.info('  → No Cloudflare token found locally (skipping)');
+    }
+    // Copy any other config files
+    const configFile = path.join(vucoreConfigDir, 'config.json');
+    if (await fs.pathExists(configFile)) {
+        log.info('  → Copying config.json...');
+        await runSCP(host, configFile, '/root/.vucore/config.json', false);
+        log.success('  ✅ Config copied');
+    }
+    const elapsed = ((Date.now() - startTime) / 1000).toFixed(1);
+    log.blank();
+    log.box('✅ CLI Installation Complete', [
+        `Server: ${host.hostname}`,
+        `Time: ${elapsed}s`,
+        '',
+        'Installed:',
+        '  ✅ CiCore CLI (/usr/local/bin/vu)',
+        '  ✅ Config files (/root/.vucore/)',
+    ]);
+    log.blank();
+    log.info('Next: SSH to server and run "vu server setup"');
+}
+async function runRemoteCLI(hostName, command) {
+    const host = await getHost(hostName);
+    if (!host)
+        return;
+    log.info(`Running on ${host.hostname}: vu ${command}`);
+    log.blank();
+    // Run the command on server
+    const result = await runSSH(host, `vu ${command}`);
+    if (result.stdout) {
+        console.log(result.stdout);
+    }
+    if (result.stderr) {
+        console.error(result.stderr);
+    }
+    process.exit(result.success ? 0 : 1);
+}
+// ============================================
+// LIST SERVERS
+// ============================================
+async function listServers() {
+    log.title('SSH Hosts');
+    const hosts = await listSSHHosts();
+    if (hosts.length === 0) {
+        log.info('No SSH hosts found in ~/.ssh/config');
+        return;
+    }
+    formatTable(['Name', 'Hostname', 'User', 'Port'], hosts.map(h => [h.name, h.hostname, h.user, h.port.toString()]));
+}
+// ============================================
+// SERVER STATUS
+// ============================================
+async function serverStatus(options) {
+    log.title('Server Status');
+    const host = await getSSHHost(options.host);
+    if (!host) {
+        log.error(`SSH host "${options.host}" not found`);
+        return;
+    }
+    log.kv('Host', `${host.name} (${host.hostname})`);
+    log.blank();
+    // Check containers
+    const containerSpinner = spinner('Checking containers...').start();
+    const containerResult = await runSSH(host, 'docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"');
+    containerSpinner.stop();
+    if (containerResult.success) {
+        console.log(containerResult.stdout);
+    }
+    // Check disk
+    log.blank();
+    const diskSpinner = spinner('Checking disk usage...').start();
+    const diskResult = await runSSH(host, 'df -h / | tail -1');
+    diskSpinner.stop();
+    if (diskResult.success) {
+        const parts = diskResult.stdout.trim().split(/\s+/);
+        log.kv('Disk Usage', `${parts[2]} / ${parts[1]} (${parts[4]})`);
+    }
+    // Check memory
+    const memSpinner = spinner('Checking memory...').start();
+    const memResult = await runSSH(host, 'free -h | grep Mem');
+    memSpinner.stop();
+    if (memResult.success) {
+        const parts = memResult.stdout.trim().split(/\s+/);
+        log.kv('Memory', `${parts[2]} / ${parts[1]} used`);
+    }
+}
+// ============================================
+// SERVER LOGS
+// ============================================
+async function serverLogs(options) {
+    const host = await getSSHHost(options.host);
+    if (!host) {
+        log.error(`SSH host "${options.host}" not found`);
+        return;
+    }
+    const service = options.service || 'nuxt';
+    const containerMap = {
+        nuxt: 'cicore_nuxt',
+        php: 'cicore_php',
+        nginx: 'cicore_nginx',
+        postgres: 'cicore_postgres',
+        redis: 'cicore_redis',
+    };
+    const container = containerMap[service] || service;
+    const follow = options.follow ? '-f' : '';
+    const lines = options.lines || '100';
+    log.info(`Logs for ${container} on ${host.name}:`);
+    log.blank();
+    const result = await runSSH(host, `docker logs ${follow} --tail ${lines} ${container}`);
+    console.log(result.stdout);
+    if (result.stderr)
+        console.error(result.stderr);
+}
+// ============================================
+// HELPER FUNCTIONS
+// ============================================
+async function runSSH(host, command, options = {}) {
+    const { timeout = 120000, verbose = false } = options; // 2 min default timeout
+    if (verbose) {
+        log.debug(`[SSH] ${command.substring(0, 100)}...`);
+    }
+    const args = ['-o', 'ConnectTimeout=30', '-o', 'ServerAliveInterval=10', ...buildSSHCommand(host, command)];
+    try {
+        const result = await Promise.race([
+            exec('ssh', args, { silent: !verbose }),
+            new Promise((_, reject) => setTimeout(() => reject(new Error(`SSH command timed out after ${timeout / 1000}s`)), timeout))
+        ]);
+        if (!result.success && verbose) {
+            log.error(`[SSH ERROR] ${result.stderr}`);
+        }
+        return result;
+    }
+    catch (err) {
+        log.error(`[SSH TIMEOUT] ${err.message}`);
+        return { success: false, stdout: '', stderr: err.message };
+    }
+}
+async function runSSHLive(host, command, label) {
+    if (label)
+        log.info(label);
+    const args = ['-o', 'ConnectTimeout=30', '-o', 'ServerAliveInterval=10', ...buildSSHCommand(host, command)];
+    const result = await exec('ssh', args, { silent: true });
+    // Print output
+    if (result.stdout) {
+        console.log(result.stdout);
+    }
+    if (result.stderr && !result.success) {
+        log.error(`❌ Command failed: ${command.substring(0, 50)}...`);
+        console.error(result.stderr);
+    }
+    return result;
+}
+async function runSCP(host, source, dest, recursive = false) {
+    const args = ['-o', 'ConnectTimeout=30', ...buildSCPCommand(host, source, dest, recursive)];
+    const result = await exec('scp', args, { silent: false, stream: true });
+    if (!result.success) {
+        log.error(`❌ SCP failed: ${source} -> ${dest}`);
+        if (result.stderr)
+            log.error(result.stderr);
+    }
+    return result;
+}
+// ============================================
+// CONFIG GENERATORS
+// ============================================
+function generateCoreEnv(coreName, domain) {
+    return `# ciCore Environment - ${coreName}
+# Generated by CiCore CLI
+
+# Application
+APP_NAME=VuCore
+APP_ENV=production
+APP_DEBUG=false
+APP_URL=https://${domain}
+
+# Core
+CORE_NAME=${coreName}
+CORE_DOMAIN=${domain}
+
+# Frontend URLs (Nuxt)
+NUXT_PUBLIC_API_BASE=https://api.${domain}
+NUXT_PUBLIC_WS_URL=wss://${domain}:2346
+NUXT_PUBLIC_HOST=${domain}
+NUXT_PUBLIC_CORE_CDN_URL=https://cdn.cicore.com.tr/CoreUI/latest
+
+# Database
+DB_CONNECTION=pgsql
+DB_HOST=cicore_postgres
+DB_PORT=5432
+DB_DATABASE=vucore_${coreName}
+DB_USERNAME=vucore
+DB_PASSWORD=vucore_secure_password_${Date.now().toString(36)}
+DB_GATEWAY=local
+
+# Redis
+REDIS_HOST=cicore_redis
+REDIS_PORT=6379
+REDIS_PASSWORD=
+
+# CDN
+CDN_URL=https://cdn.cicore.com.tr
+CDN_ENABLED=true
+
+# Security
+JWT_SECRET=${generateRandomString(64)}
+API_KEY=${generateRandomString(32)}
+`;
+}
+function generateNuxtCompose(coreName, domain) {
+    const registry = getDockerRegistry();
+    return `version: '3.8'
+
+services:
+  nuxt:
+    image: ${registry}/vucore-nuxt:latest
+    container_name: cicore_nuxt
+    restart: unless-stopped
+    ports:
+      - "3000:3000"
+    environment:
+      - NODE_ENV=production
+      - NUXT_PUBLIC_API_BASE=https://${domain}/api
+    volumes:
+      - /home/cores:/app/cores:ro
+    networks:
+      - cicore_network
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:3000/api/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+
+networks:
+  cicore_network:
+    external: true
+`;
+}
+function generatePHPCompose(coreName) {
+    const registry = getDockerRegistry();
+    return `version: '3.8'
+
+services:
+  php:
+    image: ${registry}/vucore-php:latest
+    container_name: cicore_php
+    restart: unless-stopped
+    volumes:
+      - /home/cores:/var/www/cores
+    networks:
+      - cicore_network
+    healthcheck:
+      test: ["CMD", "php-fpm", "-t"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+
+  postgres:
+    image: postgres:15-alpine
+    container_name: cicore_postgres
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: vucore
+      POSTGRES_PASSWORD: vucore_secure_password
+      POSTGRES_DB: vucore_${coreName}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    networks:
+      - cicore_network
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U vucore"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  redis:
+    image: redis:7-alpine
+    container_name: cicore_redis
+    restart: unless-stopped
+    networks:
+      - cicore_network
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+volumes:
+  postgres_data:
+
+networks:
+  cicore_network:
+    external: true
+`;
+}
+function generateNginxConfig(coreName, domain) {
+    return `# ciCore Nginx Config - ${coreName}
+# Generated by CiCore CLI
+
+upstream nuxt_backend {
+    server 127.0.0.1:3000;
+    keepalive 64;
+}
+
+upstream php_backend {
+    server 127.0.0.1:9000;
+    keepalive 64;
+}
+
+server {
+    listen 80;
+    server_name ${domain} *.${domain};
+    
+    location / {
+        return 301 https://\$host\$request_uri;
+    }
+}
+`;
+}
+function generateNginxConfigWithSSL(coreName, domain) {
+    return `# ciCore Nginx Config - ${coreName}
+# Generated by CiCore CLI
+
+upstream nuxt_backend {
+    server 127.0.0.1:3000;
+    keepalive 64;
+}
+
+upstream php_backend {
+    server 127.0.0.1:9000;
+    keepalive 64;
+}
+
+server {
+    listen 80;
+    server_name ${domain} *.${domain};
+    return 301 https://\$host\$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name ${domain} *.${domain};
+
+    ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
+    ssl_prefer_server_ciphers off;
+
+    # API routes -> PHP
+    location /api {
+        proxy_pass http://php_backend;
+        proxy_http_version 1.1;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+    }
+
+    # Everything else -> Nuxt
+    location / {
+        proxy_pass http://nuxt_backend;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade \$http_upgrade;
+        proxy_set_header Connection 'upgrade';
+        proxy_set_header Host \$host;
+        proxy_cache_bypass \$http_upgrade;
+    }
+}
+`;
+}
+function generateRebuildNuxtScript() {
+    const registry = getDockerRegistry();
+    return `#!/bin/bash
+# VuCore - Rebuild Nuxt Container
+# Generated by CiCore CLI
+
+set -e
+
+COMPOSE_FILE="/home/services/docker-core-nuxt.yml"
+IMAGE="${registry}/vucore-nuxt:latest"
+
+echo "Stopping Nuxt container..."
+docker compose -f "$COMPOSE_FILE" stop nuxt 2>/dev/null || true
+docker compose -f "$COMPOSE_FILE" rm -f nuxt 2>/dev/null || true
+
+echo "Removing old images..."
+docker images | grep vucore-nuxt | awk '{print $3}' | xargs -r docker rmi -f 2>/dev/null || true
+
+echo "Pulling latest image..."
+docker pull "$IMAGE"
+
+echo "Starting Nuxt container..."
+docker compose -f "$COMPOSE_FILE" up -d nuxt
+
+echo "Waiting for health check..."
+sleep 10
+
+echo "Done!"
+docker ps --filter "name=cicore_nuxt" --format "table {{.Names}}\t{{.Status}}"
+`;
+}
+function generateRebuildPHPScript() {
+    const registry = getDockerRegistry();
+    return `#!/bin/bash
+# VuCore - Rebuild PHP Container
+# Generated by CiCore CLI
+
+set -e
+
+COMPOSE_FILE="/home/services/docker-core-php.yml"
+IMAGE="${registry}/vucore-php:latest"
+
+echo "Stopping PHP container..."
+docker compose -f "$COMPOSE_FILE" stop php 2>/dev/null || true
+docker compose -f "$COMPOSE_FILE" rm -f php 2>/dev/null || true
+
+echo "Removing old images..."
+docker images | grep vucore-php | awk '{print $3}' | xargs -r docker rmi -f 2>/dev/null || true
+
+echo "Pulling latest image..."
+docker pull "$IMAGE"
+
+echo "Starting PHP container..."
+docker compose -f "$COMPOSE_FILE" up -d php
+
+echo "Done!"
+docker ps --filter "name=cicore_php" --format "table {{.Names}}\t{{.Status}}"
+`;
+}
+function generateRandomString(length) {
+    const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
+    let result = '';
+    for (let i = 0; i < length; i++) {
+        result += chars.charAt(Math.floor(Math.random() * chars.length));
+    }
+    return result;
+}
+// ============================================
+// FACTORY RESET
+// ============================================
+async function factoryReset(options) {
+    log.title('🔄 ciCore Factory Reset');
+    log.blank();
+    // Get SSH host
+    let host = null;
+    if (options.host) {
+        host = await getSSHHost(options.host);
+        if (!host) {
+            log.error(`SSH host "${options.host}" not found in ~/.ssh/config`);
+            return;
+        }
+    }
+    else {
+        const hosts = await listSSHHosts();
+        if (hosts.length === 0) {
+            log.error('No SSH hosts found in ~/.ssh/config');
+            return;
+        }
+        const selected = await select('Select SSH host:', hosts.map(h => ({ name: h.name, message: `${h.name} (${h.hostname})` })));
+        host = hosts.find(h => h.name === selected) || null;
+    }
+    if (!host) {
+        log.error('No host selected');
+        return;
+    }
+    log.kv('Server', `${host.name} (${host.hostname})`);
+    log.kv('Keep Images', options.keepImages ? 'Yes' : 'No');
+    log.blank();
+    // Warning message
+    log.box('⚠️  WARNING - DESTRUCTIVE OPERATION', [
+        'This will permanently delete:',
+        '  • All Docker containers (vucore_*)',
+        '  • All data in /home/cores/',
+        '  • All data in /home/services/',
+        options.keepImages ? '' : '  • All Docker images',
+        '  • Docker networks and volumes',
+        '',
+        'This operation CANNOT be undone!',
+    ].filter(Boolean));
+    log.blank();
+    if (!options.force) {
+        const confirmed = await confirm(`Are you ABSOLUTELY sure you want to factory reset ${host.name}?`, false);
+        if (!confirmed) {
+            log.info('Cancelled');
+            return;
+        }
+        // Double confirmation
+        const doubleConfirm = await input(`Type "${host.name}" to confirm factory reset:`);
+        if (doubleConfirm !== host.name) {
+            log.error('Confirmation failed. Aborting.');
+            return;
+        }
+    }
+    log.blank();
+    log.warn('Starting factory reset...');
+    log.blank();
+    const startTime = Date.now();
+    // Step 1: Stop all containers
+    const stopSpinner = spinner('Stopping all ciCore containers...').start();
+    const stopCmd = `
+    docker ps -a --filter "name=vucore" --format "{{.Names}}" | xargs -r docker stop 2>/dev/null || true
+    docker ps -a --filter "name=vucore" --format "{{.Names}}" | xargs -r docker rm -f 2>/dev/null || true
+  `;
+    const stopArgs = buildSSHCommand(host, stopCmd);
+    await exec('ssh', stopArgs, { silent: true });
+    stopSpinner.succeed('Containers stopped and removed');
+    // Step 2: Remove Docker networks
+    const networkSpinner = spinner('Removing Docker networks...').start();
+    const networkCmd = `
+    docker network rm vucore_global 2>/dev/null || true
+    docker network rm vucore_proxy 2>/dev/null || true
+  `;
+    const networkArgs = buildSSHCommand(host, networkCmd);
+    await exec('ssh', networkArgs, { silent: true });
+    networkSpinner.succeed('Docker networks removed');
+    // Step 3: Remove Docker volumes
+    const volumeSpinner = spinner('Removing Docker volumes...').start();
+    const volumeCmd = `
+    docker volume ls --filter "name=vucore" -q | xargs -r docker volume rm 2>/dev/null || true
+    docker volume ls --filter "name=postgres" -q | xargs -r docker volume rm 2>/dev/null || true
+    docker volume ls --filter "name=redis" -q | xargs -r docker volume rm 2>/dev/null || true
+  `;
+    const volumeArgs = buildSSHCommand(host, volumeCmd);
+    await exec('ssh', volumeArgs, { silent: true });
+    volumeSpinner.succeed('Docker volumes removed');
+    // Step 4: Remove Docker images (if not keeping)
+    if (!options.keepImages) {
+        const imageSpinner = spinner('Removing Docker images...').start();
+        const imageCmd = `
+      docker images --filter "reference=*vucore*" -q | xargs -r docker rmi -f 2>/dev/null || true
+      docker images --filter "reference=baynis/*" -q | xargs -r docker rmi -f 2>/dev/null || true
+      docker image prune -af 2>/dev/null || true
+    `;
+        const imageArgs = buildSSHCommand(host, imageCmd);
+        await exec('ssh', imageArgs, { silent: true });
+        imageSpinner.succeed('Docker images removed');
+    }
+    // Step 5: Remove /home directories
+    const dirSpinner = spinner('Removing /home directories...').start();
+    const dirCmd = `
+    rm -rf /home/cores 2>/dev/null || true
+    rm -rf /home/services 2>/dev/null || true
+    rm -rf /home/nginx 2>/dev/null || true
+  `;
+    const dirArgs = buildSSHCommand(host, dirCmd);
+    await exec('ssh', dirArgs, { silent: true });
+    dirSpinner.succeed('/home directories removed');
+    // Step 6: Docker system prune
+    const pruneSpinner = spinner('Running Docker system prune...').start();
+    const pruneCmd = 'docker system prune -af --volumes 2>/dev/null || true';
+    const pruneArgs = buildSSHCommand(host, pruneCmd);
+    await exec('ssh', pruneArgs, { silent: true });
+    pruneSpinner.succeed('Docker system pruned');
+    // Summary
+    const elapsed = ((Date.now() - startTime) / 1000).toFixed(1);
+    log.blank();
+    log.box('✅ Factory Reset Complete', [
+        `Server: ${host.name} (${host.hostname})`,
+        `Duration: ${elapsed}s`,
+        '',
+        'Removed:',
+        '  ✓ All ciCore containers',
+        '  ✓ Docker networks (vucore_global, vucore_proxy)',
+        '  ✓ Docker volumes',
+        options.keepImages ? '  ⊘ Docker images (kept)' : '  ✓ Docker images',
+        '  ✓ /home/cores/',
+        '  ✓ /home/services/',
+        '',
+        'Server is now clean and ready for fresh installation.',
+        `Run: vu server install --host ${host.name} --core core1 --domain yourdomain.com`,
+    ]);
+}
+// ============================================
+// PHASE 0: SERVER PREPARE - System Requirements
+// ============================================
+async function serverPrepare(options) {
+    log.title('🔧 Phase 0: System Requirements');
+    log.info('Installing Node.js 20, Docker, and essential tools');
+    log.blank();
+    // Check if running locally
+    const isLocal = options.local || (!options.host && (await listSSHHosts()).length === 0);
+    let runCmd;
+    let host = null;
+    if (isLocal) {
+        log.info('Running in LOCAL mode');
+        runCmd = runLocal;
+    }
+    else {
+        host = await getHost(options.host);
+        if (!host)
+            return;
+        log.info(`Target: ${host.name} (${host.user}@${host.hostname})`);
+        runCmd = (cmd, label) => runSSHLive(host, cmd, label);
+    }
+    log.blank();
+    const startTime = Date.now();
+    let errors = [];
+    // ========================================
+    // STEP 1: System Update
+    // ========================================
+    log.step(1, 5, 'Updating system packages...');
+    const updateResult = await runCmd('export DEBIAN_FRONTEND=noninteractive && apt-get update -qq', 'Updating apt...');
+    if (!updateResult.success) {
+        errors.push('apt-get update failed');
+        log.error('❌ apt-get update failed');
+    }
+    else {
+        log.success('✅ Package list updated');
+    }
+    // ========================================
+    // STEP 2: Install Essential Tools
+    // ========================================
+    log.blank();
+    log.step(2, 5, 'Installing essential tools (curl, git, tree, openssl)...');
+    const toolsResult = await runCmd('export DEBIAN_FRONTEND=noninteractive && apt-get install -y -qq curl git tree openssl ca-certificates gnupg lsb-release', 'Installing tools...');
+    if (!toolsResult.success) {
+        errors.push('Essential tools installation failed');
+        log.error('❌ Tools installation failed');
+    }
+    else {
+        // Verify
+        const treeCheck = await runCmd('tree --version 2>/dev/null | head -1');
+        log.success(`✅ Tools installed (tree: ${treeCheck.stdout.trim() || 'installed'})`);
+    }
+    // ========================================
+    // STEP 3: Install Node.js 20
+    // ========================================
+    log.blank();
+    log.step(3, 5, 'Installing Node.js 20...');
+    // Check current Node.js version
+    const nodeCheck = await runCmd('node --version 2>/dev/null || echo "NOT_INSTALLED"');
+    const currentNode = nodeCheck.stdout.trim();
+    if (currentNode.startsWith('v20') || currentNode.startsWith('v22')) {
+        log.info(`Node.js already installed: ${currentNode}`);
+        log.success('✅ Node.js OK');
+    }
+    else {
+        log.info(`Current Node.js: ${currentNode === 'NOT_INSTALLED' ? 'Not installed' : currentNode}`);
+        // Remove old Node.js packages if exists
+        log.info('Removing old Node.js packages...');
+        await runCmd('apt-get remove -y nodejs npm libnode-dev 2>/dev/null || true', 'Removing old packages...');
+        await runCmd('apt-get autoremove -y 2>/dev/null || true');
+        // Install Node.js 20 via NodeSource
+        log.info('Adding NodeSource repository...');
+        const nodeSourceResult = await runCmd('curl -fsSL https://deb.nodesource.com/setup_20.x | bash -', 'Adding NodeSource repo...');
+        if (!nodeSourceResult.success) {
+            errors.push('NodeSource setup failed');
+            log.error('❌ NodeSource setup failed');
+        }
+        else {
+            log.info('Installing Node.js 20...');
+            const nodeInstallResult = await runCmd('export DEBIAN_FRONTEND=noninteractive && apt-get install -y nodejs', 'Installing Node.js...');
+            if (!nodeInstallResult.success) {
+                errors.push('Node.js installation failed');
+                log.error('❌ Node.js installation failed');
+            }
+            else {
+                // Verify installation
+                const newNodeCheck = await runCmd('node --version');
+                const npmCheck = await runCmd('npm --version');
+                log.success(`✅ Node.js installed: ${newNodeCheck.stdout.trim()}, npm: ${npmCheck.stdout.trim()}`);
+            }
+        }
+    }
+    // ========================================
+    // STEP 4: Install Docker
+    // ========================================
+    log.blank();
+    log.step(4, 5, 'Installing Docker...');
+    // Check current Docker
+    const dockerCheck = await runCmd('docker --version 2>/dev/null || echo "NOT_INSTALLED"');
+    const currentDocker = dockerCheck.stdout.trim();
+    if (currentDocker.includes('Docker version')) {
+        log.info(`Docker already installed: ${currentDocker}`);
+        log.success('✅ Docker OK');
+    }
+    else {
+        log.info('Installing Docker...');
+        // Install Docker using official script
+        const dockerInstallResult = await runCmd('curl -fsSL https://get.docker.com | sh', 'Installing Docker...');
+        if (!dockerInstallResult.success) {
+            errors.push('Docker installation failed');
+            log.error('❌ Docker installation failed');
+        }
+        else {
+            // Enable and start Docker
+            await runCmd('systemctl enable docker && systemctl start docker', 'Starting Docker...');
+            // Verify
+            const newDockerCheck = await runCmd('docker --version');
+            log.success(`✅ Docker installed: ${newDockerCheck.stdout.trim()}`);
+        }
+    }
+    // ========================================
+    // STEP 5: Verify All Installations
+    // ========================================
+    log.blank();
+    log.step(5, 5, 'Verifying installations...');
+    const verifications = [
+        { name: 'Node.js', cmd: 'node --version', expected: 'v20' },
+        { name: 'npm', cmd: 'npm --version', expected: '' },
+        { name: 'Docker', cmd: 'docker --version', expected: 'Docker' },
+        { name: 'tree', cmd: 'which tree', expected: '/usr/bin/tree' },
+        { name: 'curl', cmd: 'which curl', expected: '/usr/bin/curl' },
+        { name: 'git', cmd: 'which git', expected: '/usr/bin/git' },
+        { name: 'openssl', cmd: 'which openssl', expected: '/usr/bin/openssl' },
+    ];
+    let allOk = true;
+    for (const v of verifications) {
+        const result = await runCmd(v.cmd);
+        const output = result.stdout.trim();
+        const ok = v.expected ? output.includes(v.expected) || result.success : result.success;
+        if (ok) {
+            log.info(`  ✅ ${v.name}: ${output || 'OK'}`);
+        }
+        else {
+            log.error(`  ❌ ${v.name}: FAILED`);
+            allOk = false;
+            errors.push(`${v.name} verification failed`);
+        }
+    }
+    // ========================================
+    // Summary
+    // ========================================
+    const elapsed = ((Date.now() - startTime) / 1000).toFixed(1);
+    log.blank();
+    if (errors.length === 0) {
+        log.box('✅ Phase 0 Complete', [
+            `Mode: ${isLocal ? 'LOCAL' : 'REMOTE'}`,
+            `Time: ${elapsed}s`,
+            '',
+            'Installed:',
+            '  ✅ Node.js 20',
+            '  ✅ Docker',
+            '  ✅ Essential tools (curl, git, tree, openssl)',
+            '',
+            'Next: vu server setup',
+        ]);
+    }
+    else {
+        log.box('⚠️ Phase 0 Completed with Errors', [
+            `Mode: ${isLocal ? 'LOCAL' : 'REMOTE'}`,
+            `Time: ${elapsed}s`,
+            '',
+            'Errors:',
+            ...errors.map(e => `  ❌ ${e}`),
+            '',
+            'Please fix errors before continuing.',
+        ]);
+    }
+    process.exit(errors.length > 0 ? 1 : 0);
+}
+// ============================================
+// SERVER CHECK - Health Check
+// ============================================
+async function serverCheck(options) {
+    log.title('🔍 Server Health Check');
+    log.blank();
+    // Check if running locally
+    const isLocal = options.local || (!options.host && (await listSSHHosts()).length === 0);
+    let runCmd;
+    let host = null;
+    if (isLocal) {
+        log.info('Running in LOCAL mode');
+        runCmd = runLocal;
+    }
+    else {
+        host = await getHost(options.host);
+        if (!host)
+            return;
+        log.info(`Target: ${host.name} (${host.user}@${host.hostname})`);
+        runCmd = (cmd, label) => runSSHLive(host, cmd, label);
+    }
+    log.blank();
+    let issues = [];
+    let warnings = [];
+    // ========================================
+    // 1. System Requirements
+    // ========================================
+    log.info('📦 System Requirements:');
+    const nodeCheck = await runCmd('node --version 2>/dev/null || echo "NOT_INSTALLED"');
+    const nodeVersion = nodeCheck.stdout.trim();
+    if (nodeVersion.startsWith('v20') || nodeVersion.startsWith('v22')) {
+        log.info(`  ✅ Node.js: ${nodeVersion}`);
+    }
+    else if (nodeVersion === 'NOT_INSTALLED') {
+        log.error('  ❌ Node.js: Not installed');
+        issues.push('Node.js not installed');
+    }
+    else {
+        log.warn(`  ⚠️ Node.js: ${nodeVersion} (v20+ recommended)`);
+        warnings.push(`Node.js version ${nodeVersion}`);
+    }
+    const dockerCheck = await runCmd('docker --version 2>/dev/null || echo "NOT_INSTALLED"');
+    if (dockerCheck.stdout.includes('Docker version')) {
+        log.info(`  ✅ Docker: ${dockerCheck.stdout.trim().split(',')[0]}`);
+    }
+    else {
+        log.error('  ❌ Docker: Not installed');
+        issues.push('Docker not installed');
+    }
+    // ========================================
+    // 2. Docker Containers
+    // ========================================
+    log.blank();
+    log.info('🐳 Docker Containers:');
+    const containers = [
+        { name: 'cicore_global_nginx', required: true },
+        { name: 'cicore_global_postgres', required: true },
+        { name: 'cicore_global_redis', required: true },
+        { name: 'cicore_php', required: true },
+        { name: 'cicore_nuxt', required: true },
+    ];
+    for (const c of containers) {
+        const check = await runCmd(`docker ps --filter "name=${c.name}" --format "{{.Status}}" 2>/dev/null`);
+        const status = check.stdout.trim();
+        if (status.includes('Up') && status.includes('healthy')) {
+            log.info(`  ✅ ${c.name}: ${status}`);
+        }
+        else if (status.includes('Up')) {
+            log.warn(`  ⚠️ ${c.name}: ${status} (not healthy yet)`);
+            warnings.push(`${c.name} not healthy`);
+        }
+        else if (status) {
+            log.error(`  ❌ ${c.name}: ${status}`);
+            if (c.required)
+                issues.push(`${c.name} not running`);
+        }
+        else {
+            log.error(`  ❌ ${c.name}: Not found`);
+            if (c.required)
+                issues.push(`${c.name} not found`);
+        }
+    }
+    // ========================================
+    // 3. Docker Networks
+    // ========================================
+    log.blank();
+    log.info('🌐 Docker Networks:');
+    const networks = ['vucore_global', 'vucore_proxy'];
+    for (const net of networks) {
+        const check = await runCmd(`docker network ls --filter "name=${net}" --format "{{.Name}}" 2>/dev/null`);
+        if (check.stdout.includes(net)) {
+            log.info(`  ✅ ${net}`);
+        }
+        else {
+            log.error(`  ❌ ${net}: Not found`);
+            issues.push(`Network ${net} not found`);
+        }
+    }
+    // ========================================
+    // 4. SSL Certificates
+    // ========================================
+    log.blank();
+    log.info('🔒 SSL Certificates:');
+    const sslCheck = await runCmd('ls -la /home/services/nginx/ssl/*.crt 2>/dev/null || echo "NO_CERTS"');
+    if (sslCheck.stdout.includes('NO_CERTS')) {
+        log.warn('  ⚠️ No SSL certificates found');
+        warnings.push('No SSL certificates');
+    }
+    else {
+        const certs = sslCheck.stdout.split('\n').filter(l => l.includes('.crt'));
+        for (const cert of certs) {
+            const certName = cert.split('/').pop()?.replace('.crt', '') || 'unknown';
+            // Check expiry
+            const expiryCheck = await runCmd(`openssl x509 -enddate -noout -in /home/services/nginx/ssl/${certName}.crt 2>/dev/null`);
+            const expiry = expiryCheck.stdout.replace('notAfter=', '').trim();
+            log.info(`  ✅ ${certName}: expires ${expiry}`);
+        }
+    }
+    // ========================================
+    // 5. Nginx Config
+    // ========================================
+    log.blank();
+    log.info('⚙️ Nginx Configuration:');
+    const nginxTest = await runCmd('docker exec cicore_global_nginx nginx -t 2>&1');
+    if (nginxTest.stdout.includes('successful') || nginxTest.stderr.includes('successful')) {
+        log.info('  ✅ Nginx config syntax OK');
+    }
+    else {
+        log.error('  ❌ Nginx config has errors');
+        issues.push('Nginx config invalid');
+    }
+    // Check for escape character issues (literal backslash followed by $)
+    const escapeCheck = await runCmd("grep -rE '\\\\\\\\\\$' /home/services/nginx/conf.d/*.conf 2>/dev/null | head -1");
+    if (escapeCheck.stdout.trim()) {
+        log.warn('  ⚠️ Found escaped $ characters in nginx config');
+        warnings.push('Nginx config has escaped $ characters');
+        if (options.fix) {
+            log.info('  🔧 Fixing escape characters...');
+            await runCmd('for f in /home/services/nginx/conf.d/*.conf; do sed -i "s/\\\\\\\\\\$/\\$/g" "$f"; done');
+            await runCmd('docker exec cicore_global_nginx nginx -s reload');
+            log.success('  ✅ Fixed');
+        }
+    }
+    // ========================================
+    // 6. API Health
+    // ========================================
+    log.blank();
+    log.info('🔌 API Endpoints:');
+    const apiCheck = await runCmd('curl -s -o /dev/null -w "%{http_code}" http://localhost/health 2>/dev/null || echo "FAILED"');
+    if (apiCheck.stdout.trim() === '200') {
+        log.info('  ✅ Health endpoint: OK');
+    }
+    else {
+        log.warn(`  ⚠️ Health endpoint: ${apiCheck.stdout.trim()}`);
+        warnings.push('Health endpoint not responding');
+    }
+    // ========================================
+    // 7. Directory Structure
+    // ========================================
+    log.blank();
+    log.info('📁 Directory Structure:');
+    const dirs = [
+        '/home/cores',
+        '/home/services',
+        '/home/services/nginx/conf.d',
+        '/home/services/nginx/ssl',
+        '/home/services/postgres/data',
+        '/home/services/redis/data',
+    ];
+    for (const dir of dirs) {
+        const check = await runCmd(`test -d ${dir} && echo "EXISTS" || echo "MISSING"`);
+        if (check.stdout.includes('EXISTS')) {
+            log.info(`  ✅ ${dir}`);
+        }
+        else {
+            log.error(`  ❌ ${dir}: Missing`);
+            issues.push(`Directory ${dir} missing`);
+        }
+    }
+    // ========================================
+    // Summary
+    // ========================================
+    log.blank();
+    if (issues.length === 0 && warnings.length === 0) {
+        log.box('✅ All Checks Passed', [
+            'Server is healthy and ready!',
+        ]);
+    }
+    else if (issues.length === 0) {
+        log.box('⚠️ Warnings Found', [
+            `${warnings.length} warning(s):`,
+            ...warnings.map(w => `  ⚠️ ${w}`),
+            '',
+            'Server is functional but may need attention.',
+        ]);
+    }
+    else {
+        log.box('❌ Issues Found', [
+            `${issues.length} issue(s), ${warnings.length} warning(s):`,
+            ...issues.map(i => `  ❌ ${i}`),
+            ...warnings.map(w => `  ⚠️ ${w}`),
+            '',
+            'Run with --fix to attempt automatic fixes.',
+        ]);
+    }
+    process.exit(issues.length > 0 ? 1 : 0);
+}
+//# sourceMappingURL=index.js.map