@openfactu/cli 0.0.6 → 0.0.8

package/dist/src/commands/deploy.js

@@ -13,6 +13,7 @@ const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
 const logger_1 = require("../utils/logger");
 const paths_1 = require("../utils/paths");
+const helpers_1 = require("../utils/helpers");
 function getLocalIPs() {
     const interfaces = os_1.default.networkInterfaces();
     const ips = [];
@@ -27,6 +28,26 @@ function getLocalIPs() {
     }
     return ips;
 }
+function checkPortInUse(port) {
+    try {
+        const output = (0, child_process_1.execSync)(`lsof -i :${port} -sTCP:LISTEN -t 2>/dev/null | grep -v 'docker-pr' || true`, {
+            stdio: 'pipe',
+        }).toString().trim();
+        if (output) {
+            const pid = output.split('\n')[0].trim();
+            let processName = 'desconocido';
+            try {
+                processName = (0, child_process_1.execSync)(`ps -p ${pid} -o comm= 2>/dev/null || echo 'desconocido'`, { stdio: 'pipe' }).toString().trim();
+            }
+            catch { }
+            return { inUse: true, process: `${processName} (PID: ${pid})` };
+        }
+        return { inUse: false };
+    }
+    catch {
+        return { inUse: false };
+    }
+}
 function readEnv(envPath) {
     const env = {};
     if (!fs_1.default.existsSync(envPath))
@@ -54,7 +75,8 @@ function registerDeployCommand(program) {
     program
         .command('deploy')
         .description('Configura OpenFactu para producción (acceso externo)')
-        .action(async () => {
+        .option('--with-monitoring', 'Incluir stack de monitoreo (Grafana, Prometheus, etc.)')
+        .action(async (opts) => {
         console.log();
         console.log(chalk_1.default.bold.white('  OpenFactu — Configurar Despliegue'));
         console.log(chalk_1.default.dim('  ────────────────────────────────────'));
@@ -82,6 +104,7 @@ function registerDeployCommand(program) {
             let host = 'localhost';
             let serverPort = '3000';
             let webPort = '8080';
+            let dbPort = '5432';
             let useSSL = false;
             if (mode === 'lan') {
                 const ipChoices = localIPs.map((ip) => ({ name: ip, value: ip }));
@@ -103,6 +126,15 @@ function registerDeployCommand(program) {
                 else {
                     host = selectedIP;
                 }
+                const { ssl } = await inquirer_1.default.prompt([
+                    {
+                        type: 'confirm',
+                        name: 'ssl',
+                        message: '¿Usar HTTPS? (certificado auto-firmado para red local)',
+                        default: false,
+                    },
+                ]);
+                useSSL = ssl;
             }
             else if (mode === 'public') {
                 const { domain } = await inquirer_1.default.prompt([
@@ -123,12 +155,56 @@ function registerDeployCommand(program) {
                 ]);
                 useSSL = ssl;
             }
+            // Verificar conflictos de puertos si se usa SSL
+            let httpPort = '80';
+            let httpsPort = '443';
+            if (useSSL) {
+                const port80 = checkPortInUse(80);
+                const port443 = checkPortInUse(443);
+                if (port80.inUse || port443.inUse) {
+                    logger_1.log.blank();
+                    logger_1.log.warn('Puertos en conflicto detectados:');
+                    if (port80.inUse)
+                        logger_1.log.warn(`  Puerto 80: ocupado por ${port80.process}`);
+                    if (port443.inUse)
+                        logger_1.log.warn(`  Puerto 443: ocupado por ${port443.process}`);
+                    logger_1.log.blank();
+                    const { portAction } = await inquirer_1.default.prompt([
+                        {
+                            type: 'list',
+                            name: 'portAction',
+                            message: '¿Cómo resolver el conflicto?',
+                            choices: [
+                                { name: 'Usar puertos alternativos (8080/8443)', value: 'alternate' },
+                                { name: 'Especificar puertos personalizados', value: 'custom' },
+                                { name: 'Continuar con 80/443 (puede fallar)', value: 'continue' },
+                                { name: 'Desactivar HTTPS', value: 'nossl' },
+                            ],
+                        },
+                    ]);
+                    if (portAction === 'nossl') {
+                        useSSL = false;
+                    }
+                    else if (portAction === 'alternate') {
+                        httpPort = '8080';
+                        httpsPort = '8443';
+                    }
+                    else if (portAction === 'custom') {
+                        const { customHttp, customHttps } = await inquirer_1.default.prompt([
+                            { type: 'input', name: 'customHttp', message: 'Puerto HTTP alternativo:', default: '8080' },
+                            { type: 'input', name: 'customHttps', message: 'Puerto HTTPS alternativo:', default: '8443' },
+                        ]);
+                        httpPort = customHttp;
+                        httpsPort = customHttps;
+                    }
+                }
+            }
             // Puertos
             const { ports } = await inquirer_1.default.prompt([
                 {
                     type: 'confirm',
                     name: 'ports',
-                    message: `¿Usar puertos por defecto? (web: 8080, api: 3000)`,
+                    message: `¿Usar puertos por defecto? (web: 8080, api: 3000, db: 5432)`,
                     default: true,
                 },
             ]);
@@ -136,32 +212,42 @@ function registerDeployCommand(program) {
                 const answers = await inquirer_1.default.prompt([
                     { type: 'input', name: 'webPort', message: 'Puerto web:', default: '8080' },
                     { type: 'input', name: 'serverPort', message: 'Puerto API:', default: '3000' },
+                    { type: 'input', name: 'dbPort', message: 'Puerto BD (host):', default: '5432' },
                 ]);
                 webPort = answers.webPort;
                 serverPort = answers.serverPort;
+                dbPort = answers.dbPort;
             }
-            // Password de BD
-            const { dbPassword } = await inquirer_1.default.prompt([
-                {
-                    type: 'input',
-                    name: 'dbPassword',
-                    message: 'Password de PostgreSQL:',
-                    default: 'openfactu_pass',
-                },
-            ]);
+            // Password de BD: se reutiliza la fijada en `install` (está en el .env).
+            // No se vuelve a preguntar: cambiarla aquí no surte efecto sobre un
+            // volumen de Postgres ya inicializado, así que evitamos esa trampa.
+            const dbPassword = readEnv(envPath).POSTGRES_PASSWORD || (0, helpers_1.generatePassword)(24);
             // 3. Construir configuración
-            const protocol = useSSL ? 'https' : 'http';
-            const webUrl = webPort === '80' || webPort === '443'
-                ? `${protocol}://${host}`
-                : `${protocol}://${host}:${webPort}`;
-            const apiUrl = serverPort === '80' || serverPort === '443'
-                ? `${protocol}://${host}`
-                : `${protocol}://${host}:${serverPort}`;
+            // Con SSL el ÚNICO punto de entrada es Caddy en httpsPort: enruta
+            // "/" → web:80 y "/api/*" → server:3000. Por eso las URLs de cara al
+            // usuario (web, API, VITE_API_URL, CORS_ORIGIN) deben apuntar a Caddy,
+            // no a los puertos HTTP planos web/api (8080/3000).
+            let webUrl;
+            let apiUrl;
+            if (useSSL) {
+                const base = httpsPort === '443' ? `https://${host}` : `https://${host}:${httpsPort}`;
+                webUrl = base;
+                apiUrl = base;
+            }
+            else {
+                webUrl = webPort === '80' || webPort === '443'
+                    ? `http://${host}`
+                    : `http://${host}:${webPort}`;
+                apiUrl = serverPort === '80' || serverPort === '443'
+                    ? `http://${host}`
+                    : `http://${host}:${serverPort}`;
+            }
             logger_1.log.blank();
             logger_1.log.title('  Resumen de configuración');
             logger_1.log.info(`Web:         ${chalk_1.default.cyan(webUrl)}`);
             logger_1.log.info(`API:         ${chalk_1.default.cyan(apiUrl)}`);
-            logger_1.log.info(`BD Password: ${chalk_1.default.dim(dbPassword === 'openfactu_pass' ? '(default)' : '****')}`);
+            logger_1.log.info(`BD Puerto:   ${chalk_1.default.cyan(dbPort)} ${chalk_1.default.dim('(host)')}`);
+            logger_1.log.info(`BD Password: ${chalk_1.default.dim('(reutilizada de install)')}`);
             logger_1.log.info(`SSL:         ${useSSL ? chalk_1.default.green('Si') : chalk_1.default.dim('No')}`);
             logger_1.log.blank();
             const { confirm } = await inquirer_1.default.prompt([
@@ -176,11 +262,11 @@ function registerDeployCommand(program) {
             const env = readEnv(envPath);
             env.SERVER_PORT = serverPort;
             env.WEB_PORT = webPort;
-            env.DB_PORT = env.DB_PORT || '5432';
+            env.DB_PORT = dbPort;
             env.POSTGRES_USER = env.POSTGRES_USER || 'openfactu';
             env.POSTGRES_PASSWORD = dbPassword;
             env.POSTGRES_DB = env.POSTGRES_DB || 'openfactudb';
-            env.DATABASE_URL = `postgresql://${env.POSTGRES_USER}:${dbPassword}@db:5432/${env.POSTGRES_DB}`;
+            env.DATABASE_URL = `postgresql://${env.POSTGRES_USER}:${encodeURIComponent(dbPassword)}@db:5432/${env.POSTGRES_DB}`;
             env.VITE_API_URL = apiUrl;
             env.HOST = host;
             env.CORS_ORIGIN = webUrl;
@@ -240,47 +326,164 @@ function registerDeployCommand(program) {
     restart: unless-stopped
     networks:
       - openfactu_net
+`;
+            // Si SSL, añadir Caddy reverse proxy con Let's Encrypt (servicio dentro de
+            // services:). El bloque top-level networks: se añade SIEMPRE al final.
+            if (useSSL) {
+                composeContent += `
+  caddy:
+    image: caddy:2-alpine
+    container_name: openfactu-caddy
+    ports:
+      - "0.0.0.0:${httpPort}:80"
+      - "0.0.0.0:${httpsPort}:443"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy_data:/data
+      - caddy_config:/config
+    depends_on:
+      - web
+      - server
+    restart: unless-stopped
+    networks:
+      - openfactu_net
 
+volumes:
+  caddy_data:
+  caddy_config:
+`;
+                // Generar Caddyfile
+                const caddyfilePath = path_1.default.join(root, 'Caddyfile');
+                const isLAN = mode === 'lan';
+                const tlsDirective = isLAN ? 'tls internal' : '';
+                const httpRedirect = isLAN ? '' : `
+http://${host} {
+    redir https://{host}{uri} permanent
+}
+`;
+                const caddyfileContent = `${host} {
+    ${tlsDirective}
+    encode gzip
+
+    handle /api/* {
+        reverse_proxy server:3000
+    }
+
+    handle {
+        reverse_proxy web:80
+    }
+
+    log {
+        output file /var/log/caddy/access.log
+    }
+}
+${httpRedirect}`;
+                fs_1.default.writeFileSync(caddyfilePath, caddyfileContent);
+                composeContent += `
 networks:
   openfactu_net:
     driver: bridge
 `;
-            // Si SSL, añadir nginx reverse proxy
-            if (useSSL) {
+                fs_1.default.writeFileSync(prodComposePath, composeContent);
+                prodSpinner.succeed('docker-compose.prod.yml y Caddyfile generados');
+                logger_1.log.blank();
+                if (isLAN) {
+                    logger_1.log.info('Caddy generará certificado auto-firmado para la red local');
+                    logger_1.log.dim('  Los navegadores mostrarán advertencia de seguridad (es normal)');
+                }
+                else {
+                    logger_1.log.info('Caddy obtendrá certificados Let\'s Encrypt automáticamente');
+                    logger_1.log.dim('  El DNS debe apuntar a este servidor');
+                    logger_1.log.dim('  El primer request tardará unos segundos mientras se obtiene el certificado');
+                }
+                if (httpPort !== '80' || httpsPort !== '443') {
+                    logger_1.log.blank();
+                    logger_1.log.info(`Puertos alternativos: HTTP=${httpPort}, HTTPS=${httpsPort}`);
+                    logger_1.log.dim('  Asegúrate de abrir estos puertos en el firewall');
+                }
+            }
+            else {
                 composeContent += `
-  # Para SSL, configura un reverse proxy (nginx, traefik, caddy) delante.
-  # Ejemplo con Caddy (descomentar):
-  #
-  # caddy:
-  #   image: caddy:2-alpine
-  #   ports:
-  #     - "0.0.0.0:80:80"
-  #     - "0.0.0.0:443:443"
-  #   volumes:
-  #     - ./Caddyfile:/etc/caddy/Caddyfile
-  #     - caddy_data:/data
-  #   depends_on:
-  #     - web
-  #     - server
-  #   networks:
-  #     - openfactu_net
-  #
-  # volumes:
-  #   caddy_data:
-  #
-  # Caddyfile:
-  #   ${host} {
-  #     handle /api/* {
-  #       reverse_proxy server:3000
-  #     }
-  #     handle {
-  #       reverse_proxy web:80
-  #     }
-  #   }
+networks:
+  openfactu_net:
+    driver: bridge
 `;
+                fs_1.default.writeFileSync(prodComposePath, composeContent);
+                prodSpinner.succeed('docker-compose.prod.yml generado');
+            }
+            // Generar docker-compose.prod.monitoring.yml si se pidió monitoreo
+            if (opts.withMonitoring) {
+                const monSpinner = (0, ora_1.default)('Generando docker-compose.prod.monitoring.yml...').start();
+                const monitoringComposePath = path_1.default.join(root, 'docker-compose.prod.monitoring.yml');
+                const monitoringCompose = `services:
+  pgadmin:
+    image: dpage/pgadmin4:latest
+    environment:
+      PGADMIN_DEFAULT_EMAIL: \${PGADMIN_EMAIL:-admin@openfactu.local}
+      PGADMIN_DEFAULT_PASSWORD: \${PGADMIN_PASSWORD:-admin}
+      PGADMIN_CONFIG_SERVER_MODE: 'False'
+    ports:
+      - "0.0.0.0:\${PGADMIN_PORT:-5050}:80"
+    volumes:
+      - ./storage/pgadmin_data:/var/lib/pgadmin
+    depends_on:
+      - db
+    restart: unless-stopped
+    networks:
+      - openfactu_net
+
+  grafana:
+    image: grafana/grafana:latest
+    environment:
+      - GF_SECURITY_ADMIN_USER=\${GRAFANA_USER:-admin}
+      - GF_SECURITY_ADMIN_PASSWORD=\${GRAFANA_PASSWORD:-admin}
+      - GF_USERS_ALLOW_SIGN_UP=false
+    ports:
+      - "0.0.0.0:\${GRAFANA_PORT:-3001}:3000"
+    volumes:
+      - ./storage/grafana_data:/var/lib/grafana
+    depends_on:
+      - prometheus
+    restart: unless-stopped
+    networks:
+      - openfactu_net
+
+  prometheus:
+    image: prom/prometheus:latest
+    command:
+      - '--config.file=/etc/prometheus/prometheus.yml'
+      - '--storage.tsdb.path=/prometheus'
+      - '--storage.tsdb.retention.time=15d'
+      - '--web.enable-lifecycle'
+    ports:
+      - "0.0.0.0:\${PROMETHEUS_PORT:-9090}:9090"
+    volumes:
+      - ./monitoring/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
+      - ./storage/prometheus_data:/prometheus
+    restart: unless-stopped
+    networks:
+      - openfactu_net
+
+  portainer:
+    image: portainer/portainer-ce:latest
+    command: -H unix:///var/run/docker.sock
+    ports:
+      - "0.0.0.0:\${PORTAINER_PORT:-9000}:9000"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./storage/portainer_data:/data
+    restart: unless-stopped
+    networks:
+      - openfactu_net
+
+networks:
+  openfactu_net:
+    name: openfactu_net
+    driver: bridge
+`;
+                fs_1.default.writeFileSync(monitoringComposePath, monitoringCompose);
+                monSpinner.succeed('docker-compose.prod.monitoring.yml generado');
             }
-            fs_1.default.writeFileSync(prodComposePath, composeContent);
-            prodSpinner.succeed('docker-compose.prod.yml generado');
             // 6. Preguntar si levantar
             logger_1.log.blank();
             const { start } = await inquirer_1.default.prompt([
@@ -319,7 +522,9 @@ networks:
             else if (mode === 'public') {
                 logger_1.log.info('Asegúrate de que los puertos estén abiertos en el firewall');
                 if (useSSL) {
-                    logger_1.log.info('Configura el reverse proxy (Caddy/Nginx) para SSL');
+                    logger_1.log.info('Caddy obtendrá certificado Let\'s Encrypt automáticamente');
+                    logger_1.log.dim('  El DNS debe apuntar a este servidor para que funcione');
+                    logger_1.log.dim('  Puertos requeridos: 80 (HTTP) y 443 (HTTPS)');
                 }
             }
             logger_1.log.blank();
@@ -334,31 +539,223 @@ networks:
             process.exitCode = 1;
         }
     });
+    // ── openfactu deploy:ssl ──
+    program
+        .command('deploy:ssl')
+        .description('Activa HTTPS en un despliegue existente con Caddy')
+        .option('--domain <domain>', 'Dominio para el certificado')
+        .option('--lan', 'Usar certificado auto-firmado para red local')
+        .option('--port <port>', 'Puerto HTTPS (default: 443)', '443')
+        .action(async (opts) => {
+        console.log();
+        console.log(chalk_1.default.bold.white('  OpenFactu — Activar HTTPS'));
+        console.log(chalk_1.default.dim('  ────────────────────────────────────'));
+        console.log();
+        try {
+            const root = (0, paths_1.getProjectRoot)();
+            const envPath = path_1.default.join(root, '.env');
+            const env = readEnv(envPath);
+            const host = opts.domain || env.HOST || 'localhost';
+            const isLAN = opts.lan || false;
+            if (!isLAN && !opts.domain) {
+                const { domain } = await inquirer_1.default.prompt([
+                    {
+                        type: 'input',
+                        name: 'domain',
+                        message: 'Dominio para el certificado Let\'s Encrypt:',
+                        default: host,
+                    },
+                ]);
+                opts.domain = domain;
+            }
+            const finalHost = opts.domain || host;
+            let httpsPort = opts.port || '443';
+            let httpPort = '80';
+            // Verificar conflictos de puertos
+            const port80 = checkPortInUse(80);
+            const port443 = checkPortInUse(443);
+            if (port80.inUse || port443.inUse) {
+                logger_1.log.blank();
+                logger_1.log.warn('Puertos en conflicto detectados:');
+                if (port80.inUse)
+                    logger_1.log.warn(`  Puerto 80: ocupado por ${port80.process}`);
+                if (port443.inUse)
+                    logger_1.log.warn(`  Puerto 443: ocupado por ${port443.process}`);
+                logger_1.log.blank();
+                const { portAction } = await inquirer_1.default.prompt([
+                    {
+                        type: 'list',
+                        name: 'portAction',
+                        message: '¿Cómo resolver el conflicto?',
+                        choices: [
+                            { name: 'Usar puertos alternativos (8080/8443)', value: 'alternate' },
+                            { name: 'Especificar puertos personalizados', value: 'custom' },
+                            { name: 'Continuar con 80/443 (puede fallar)', value: 'continue' },
+                        ],
+                    },
+                ]);
+                if (portAction === 'alternate') {
+                    httpPort = '8080';
+                    httpsPort = '8443';
+                }
+                else if (portAction === 'custom') {
+                    const { customHttp, customHttps } = await inquirer_1.default.prompt([
+                        { type: 'input', name: 'customHttp', message: 'Puerto HTTP alternativo:', default: '8080' },
+                        { type: 'input', name: 'customHttps', message: 'Puerto HTTPS alternativo:', default: '8443' },
+                    ]);
+                    httpPort = customHttp;
+                    httpsPort = customHttps;
+                }
+            }
+            // Generar Caddyfile
+            const tlsDirective = isLAN ? 'tls internal' : '';
+            const httpRedirect = isLAN ? '' : `
+http://${finalHost} {
+    redir https://${finalHost}{uri} permanent
+}
+`;
+            const caddyfileContent = `${finalHost} {
+    ${tlsDirective}
+    encode gzip
+
+    handle /api/* {
+        reverse_proxy server:3000
+    }
+
+    handle {
+        reverse_proxy web:80
+    }
+
+    log {
+        output file /var/log/caddy/access.log
+    }
+}
+${httpRedirect}`;
+            const caddyfilePath = path_1.default.join(root, 'Caddyfile');
+            fs_1.default.writeFileSync(caddyfilePath, caddyfileContent);
+            // Actualizar docker-compose.prod.yml para añadir Caddy
+            const prodComposePath = path_1.default.join(root, 'docker-compose.prod.yml');
+            let composeContent = fs_1.default.existsSync(prodComposePath)
+                ? fs_1.default.readFileSync(prodComposePath, 'utf-8')
+                : '';
+            if (!composeContent.includes('caddy:')) {
+                const caddyBlock = `
+  caddy:
+    image: caddy:2-alpine
+    container_name: openfactu-caddy
+    ports:
+      - "0.0.0.0:${httpPort}:80"
+      - "0.0.0.0:${httpsPort}:443"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy_data:/data
+      - caddy_config:/config
+    depends_on:
+      - web
+      - server
+    restart: unless-stopped
+    networks:
+      - openfactu_net
+`;
+                const volumesBlock = `
+volumes:
+  caddy_data:
+  caddy_config:
+`;
+                // Insertar caddy DENTRO de services (antes del bloque top-level
+                // "networks:"), no al final, para que no quede anidado bajo networks:.
+                if (/\nnetworks:/.test(composeContent)) {
+                    composeContent = composeContent.replace(/\nnetworks:/, () => `${caddyBlock}${volumesBlock}\nnetworks:`);
+                }
+                else {
+                    composeContent += caddyBlock + volumesBlock;
+                }
+                fs_1.default.writeFileSync(prodComposePath, composeContent);
+            }
+            // Actualizar .env
+            const protocol = 'https';
+            const webUrl = httpsPort === '443'
+                ? `${protocol}://${finalHost}`
+                : `${protocol}://${finalHost}:${httpsPort}`;
+            env.VITE_API_URL = webUrl;
+            env.CORS_ORIGIN = webUrl;
+            env.HOST = finalHost;
+            writeEnv(envPath, env);
+            logger_1.log.blank();
+            logger_1.log.success('HTTPS configurado');
+            logger_1.log.blank();
+            logger_1.log.info(`URL: ${chalk_1.default.cyan(webUrl)}`);
+            if (httpPort !== '80' || httpsPort !== '443') {
+                logger_1.log.info(`Puertos: HTTP=${httpPort}, HTTPS=${httpsPort}`);
+            }
+            if (isLAN) {
+                logger_1.log.dim('  Certificado auto-firmado (los navegadores mostrarán advertencia)');
+            }
+            else {
+                logger_1.log.dim('  Caddy obtendrá certificado Let\'s Encrypt en el primer request');
+                logger_1.log.dim('  El DNS debe apuntar a este servidor');
+            }
+            logger_1.log.blank();
+            const { restart } = await inquirer_1.default.prompt([
+                {
+                    type: 'confirm',
+                    name: 'restart',
+                    message: '¿Reiniciar servicios para aplicar HTTPS?',
+                    default: true,
+                },
+            ]);
+            if (restart) {
+                const spinner = (0, ora_1.default)('Reiniciando servicios...').start();
+                try {
+                    (0, child_process_1.execSync)('docker compose -f docker-compose.prod.yml up -d', {
+                        cwd: root,
+                        stdio: 'pipe',
+                        timeout: 120000,
+                    });
+                    spinner.succeed('Servicios reiniciados');
+                }
+                catch (err) {
+                    spinner.fail('Error: ' + err.message);
+                }
+            }
+        }
+        catch (err) {
+            logger_1.log.error(err.message);
+            process.exitCode = 1;
+        }
+    });
     // ── openfactu deploy:status ──
     program
         .command('deploy:status')
         .description('Muestra el estado de los servicios Docker')
-        .action(async () => {
+        .option('--with-monitoring', 'Incluir servicios de monitoreo')
+        .action(async (opts) => {
         try {
             const root = (0, paths_1.getProjectRoot)();
             const prodCompose = path_1.default.join(root, 'docker-compose.prod.yml');
             const composeFile = fs_1.default.existsSync(prodCompose) ? 'docker-compose.prod.yml' : 'docker-compose.yml';
+            const monitoringCompose = path_1.default.join(root, 'docker-compose.prod.monitoring.yml');
+            const useMonitoring = opts.withMonitoring && fs_1.default.existsSync(monitoringCompose);
             logger_1.log.info(`Usando: ${chalk_1.default.dim(composeFile)}`);
+            if (useMonitoring)
+                logger_1.log.info(`Monitoreo: ${chalk_1.default.dim('docker-compose.prod.monitoring.yml')}`);
             logger_1.log.blank();
-            const output = (0, child_process_1.execSync)(`docker compose -f ${composeFile} ps`, {
+            const files = useMonitoring
+                ? `-f ${composeFile} -f docker-compose.prod.monitoring.yml`
+                : `-f ${composeFile}`;
+            const output = (0, child_process_1.execSync)(`docker compose ${files} ps`, {
                 cwd: root,
             }).toString();
             console.log(output);
-            // Mostrar URLs
+            // Mostrar URLs realmente configuradas en .env (correctas con o sin SSL/Caddy)
             const envPath = path_1.default.join(root, '.env');
             const env = readEnv(envPath);
             const host = env.HOST || 'localhost';
-            const webPort = env.WEB_PORT || '8080';
-            const serverPort = env.SERVER_PORT || '3000';
-            const protocol = env.VITE_API_URL?.startsWith('https') ? 'https' : 'http';
+            const webUrl = env.CORS_ORIGIN || `http://${host}:${env.WEB_PORT || '8080'}`;
+            const apiUrl = env.VITE_API_URL || `http://${host}:${env.SERVER_PORT || '3000'}`;
             logger_1.log.blank();
-            logger_1.log.info(`Web: ${chalk_1.default.cyan(`${protocol}://${host}:${webPort}`)}`);
-            logger_1.log.info(`API: ${chalk_1.default.cyan(`${protocol}://${host}:${serverPort}`)}`);
+            logger_1.log.info(`Web: ${chalk_1.default.cyan(webUrl)}`);
+            logger_1.log.info(`API: ${chalk_1.default.cyan(apiUrl)}`);
         }
         catch (err) {
             logger_1.log.error('Docker no disponible o servicios no levantados');
@@ -371,18 +768,26 @@ networks:
         .description('Reconstruye y reinicia los contenedores Docker')
         .option('--service <name>', 'Reconstruir solo un servicio (web, server, db)')
         .option('--no-cache', 'Construir sin cache de Docker')
+        .option('--with-monitoring', 'Incluir servicios de monitoreo')
         .action(async (opts) => {
         try {
             const root = (0, paths_1.getProjectRoot)();
             const prodCompose = path_1.default.join(root, 'docker-compose.prod.yml');
             const composeFile = fs_1.default.existsSync(prodCompose) ? 'docker-compose.prod.yml' : 'docker-compose.yml';
+            const monitoringCompose = path_1.default.join(root, 'docker-compose.prod.monitoring.yml');
+            const useMonitoring = opts.withMonitoring && fs_1.default.existsSync(monitoringCompose);
             const service = opts.service || '';
             const noCache = opts.cache === false ? ' --no-cache' : '';
             logger_1.log.info(`Usando: ${chalk_1.default.dim(composeFile)}`);
+            if (useMonitoring)
+                logger_1.log.info(`Monitoreo: ${chalk_1.default.dim('docker-compose.prod.monitoring.yml')}`);
             logger_1.log.blank();
+            const files = useMonitoring
+                ? `-f ${composeFile} -f docker-compose.prod.monitoring.yml`
+                : `-f ${composeFile}`;
             const buildSpinner = (0, ora_1.default)(`Construyendo${service ? ' ' + service : ' todos los servicios'}...`).start();
             try {
-                (0, child_process_1.execSync)(`docker compose -f ${composeFile} build${noCache} ${service}`, {
+                (0, child_process_1.execSync)(`docker compose ${files} build${noCache} ${service}`, {
                     cwd: root,
                     stdio: 'pipe',
                     timeout: 600000,
@@ -404,7 +809,7 @@ networks:
             }
             const upSpinner = (0, ora_1.default)('Reiniciando servicios...').start();
             try {
-                (0, child_process_1.execSync)(`docker compose -f ${composeFile} up -d ${service}`, {
+                (0, child_process_1.execSync)(`docker compose ${files} up -d ${service}`, {
                     cwd: root,
                     stdio: 'pipe',
                     timeout: 60000,
@@ -437,14 +842,20 @@ networks:
         .description('Muestra los logs de los servicios Docker')
         .option('--service <name>', 'Logs de un servicio especifico (web, server, db)')
         .option('-n, --lines <number>', 'Numero de lineas', '50')
+        .option('--with-monitoring', 'Incluir servicios de monitoreo')
         .action(async (opts) => {
         try {
             const root = (0, paths_1.getProjectRoot)();
             const prodCompose = path_1.default.join(root, 'docker-compose.prod.yml');
             const composeFile = fs_1.default.existsSync(prodCompose) ? 'docker-compose.prod.yml' : 'docker-compose.yml';
+            const monitoringCompose = path_1.default.join(root, 'docker-compose.prod.monitoring.yml');
+            const useMonitoring = opts.withMonitoring && fs_1.default.existsSync(monitoringCompose);
             const service = opts.service || '';
             const lines = opts.lines || '50';
-            (0, child_process_1.execSync)(`docker compose -f ${composeFile} logs --tail ${lines} ${service}`, {
+            const files = useMonitoring
+                ? `-f ${composeFile} -f docker-compose.prod.monitoring.yml`
+                : `-f ${composeFile}`;
+            (0, child_process_1.execSync)(`docker compose ${files} logs --tail ${lines} ${service}`, {
                 cwd: root,
                 stdio: 'inherit',
             });
@@ -457,13 +868,19 @@ networks:
     program
         .command('stop')
         .description('Para todos los servicios Docker')
-        .action(async () => {
+        .option('--with-monitoring', 'Incluir servicios de monitoreo')
+        .action(async (opts) => {
         try {
             const root = (0, paths_1.getProjectRoot)();
             const prodCompose = path_1.default.join(root, 'docker-compose.prod.yml');
             const composeFile = fs_1.default.existsSync(prodCompose) ? 'docker-compose.prod.yml' : 'docker-compose.yml';
+            const monitoringCompose = path_1.default.join(root, 'docker-compose.prod.monitoring.yml');
+            const useMonitoring = opts.withMonitoring && fs_1.default.existsSync(monitoringCompose);
+            const files = useMonitoring
+                ? `-f ${composeFile} -f docker-compose.prod.monitoring.yml`
+                : `-f ${composeFile}`;
             const spinner = (0, ora_1.default)('Parando servicios...').start();
-            (0, child_process_1.execSync)(`docker compose -f ${composeFile} down`, { cwd: root, stdio: 'pipe' });
+            (0, child_process_1.execSync)(`docker compose ${files} down`, { cwd: root, stdio: 'pipe' });
             spinner.succeed('Servicios parados');
         }
         catch (err) {
@@ -475,14 +892,20 @@ networks:
         .command('restart')
         .description('Reinicia los servicios Docker (sin rebuild)')
         .option('--service <name>', 'Reiniciar solo un servicio')
+        .option('--with-monitoring', 'Incluir servicios de monitoreo')
         .action(async (opts) => {
         try {
             const root = (0, paths_1.getProjectRoot)();
             const prodCompose = path_1.default.join(root, 'docker-compose.prod.yml');
             const composeFile = fs_1.default.existsSync(prodCompose) ? 'docker-compose.prod.yml' : 'docker-compose.yml';
+            const monitoringCompose = path_1.default.join(root, 'docker-compose.prod.monitoring.yml');
+            const useMonitoring = opts.withMonitoring && fs_1.default.existsSync(monitoringCompose);
+            const files = useMonitoring
+                ? `-f ${composeFile} -f docker-compose.prod.monitoring.yml`
+                : `-f ${composeFile}`;
             const service = opts.service || '';
             const spinner = (0, ora_1.default)('Reiniciando...').start();
-            (0, child_process_1.execSync)(`docker compose -f ${composeFile} restart ${service}`, { cwd: root, stdio: 'pipe' });
+            (0, child_process_1.execSync)(`docker compose ${files} restart ${service}`, { cwd: root, stdio: 'pipe' });
             spinner.succeed('Servicios reiniciados');
         }
         catch (err) {