From a298d0ee1c8fe2230859aded5f65d515285eadf8 Mon Sep 17 00:00:00 2001
From: Chris Chen <yuanson.ch@gmail.com>
Date: Tue, 23 Jun 2026 17:12:17 -0700
Subject: [PATCH] update for signalR

---
 .gitea/workflows/ci-cd-vm.yml     | 33 +++++++++++++++++++++++++++
 .gitea/workflows/ci-cd.yml        | 38 +++++++++++++++++++++++++++++++
 deploy/nginx/conf.d/rolac.conf    | 23 +++++++++++++++++++
 deploy/vm/nginx/conf.d/rolac.conf | 10 ++++++++
 4 files changed, 104 insertions(+)

diff --git a/.gitea/workflows/ci-cd-vm.yml b/.gitea/workflows/ci-cd-vm.yml
index 02c5772..f3e33ab 100644
--- a/.gitea/workflows/ci-cd-vm.yml
+++ b/.gitea/workflows/ci-cd-vm.yml
@@ -50,3 +50,36 @@ jobs:
           docker compose up -d
           sleep 5
           curl -fsS http://localhost:8080/api/health
+
+      # Always runs (success or failure) so the team gets a build result in Rocket.Chat.
+      - name: Notify Rocket.Chat
+        if: always()
+        env:
+          JOB_STATUS: ${{ job.status }}
+          REPO: ${{ github.repository }}
+          REF: ${{ github.ref_name }}
+          SHA: ${{ github.sha }}
+          ACTOR: ${{ github.actor }}
+          COMMIT_URL: ${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }}
+          WEBHOOK: ${{ secrets.ROCKETCHAT_WEBHOOK }}
+        run: |
+          if [ "$JOB_STATUS" = "success" ]; then
+            STATUS_TEXT="✅ Build succeeded"
+            COLOR="#2ecc71"
+          else
+            STATUS_TEXT="❌ Build failed"
+            COLOR="#e74c3c"
+          fi
+          SHORT_SHA="${SHA:0:7}"
+          curl -fsS -X POST -H 'Content-Type: application/json' --data @- "$WEBHOOK" <<JSON
+          {
+            "attachments": [
+              {
+                "title": "$REPO — $STATUS_TEXT",
+                "title_link": "$COMMIT_URL",
+                "color": "$COLOR",
+                "text": "Branch *$REF* · commit $SHORT_SHA · by $ACTOR"
+              }
+            ]
+          }
+          JSON
diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml
index 1a5c7fe..778eaf1 100644
--- a/.gitea/workflows/ci-cd.yml
+++ b/.gitea/workflows/ci-cd.yml
@@ -52,3 +52,41 @@ jobs:
             docker compose pull
             docker compose up -d
             curl -fsS https://manage.rolac.org/api/health
+
+  # Always runs (success or failure) so the team gets a build result in Rocket.Chat.
+  # A failed or skipped upstream job (skipped means an earlier job failed) reports as failed.
+  notify:
+    needs: [test, build-push, deploy]
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Notify Rocket.Chat
+        env:
+          BUILD_FAILED: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped') }}
+          REPO: ${{ github.repository }}
+          REF: ${{ github.ref_name }}
+          SHA: ${{ github.sha }}
+          ACTOR: ${{ github.actor }}
+          COMMIT_URL: ${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }}
+          WEBHOOK: ${{ secrets.ROCKETCHAT_WEBHOOK }}
+        run: |
+          if [ "$BUILD_FAILED" = "true" ]; then
+            STATUS_TEXT="❌ Build failed"
+            COLOR="#e74c3c"
+          else
+            STATUS_TEXT="✅ Build succeeded"
+            COLOR="#2ecc71"
+          fi
+          SHORT_SHA="${SHA:0:7}"
+          curl -fsS -X POST -H 'Content-Type: application/json' --data @- "$WEBHOOK" <<JSON
+          {
+            "attachments": [
+              {
+                "title": "$REPO — $STATUS_TEXT",
+                "title_link": "$COMMIT_URL",
+                "color": "$COLOR",
+                "text": "Branch *$REF* · commit $SHORT_SHA · by $ACTOR"
+              }
+            ]
+          }
+          JSON
diff --git a/deploy/nginx/conf.d/rolac.conf b/deploy/nginx/conf.d/rolac.conf
index 9d82316..96b26e2 100644
--- a/deploy/nginx/conf.d/rolac.conf
+++ b/deploy/nginx/conf.d/rolac.conf
@@ -1,3 +1,10 @@
+# SignalR WebSocket upgrade helper (see /hubs/ block). Must be in http context or
+# nginx fails config test: [emerg] unknown "connection_upgrade" variable.
+map $http_upgrade $connection_upgrade {
+  default upgrade;
+  ''      close;
+}
+
 server {                      # HTTP -> HTTPS
   listen 80;
   server_name app.rolac.org api.rolac.org;
@@ -23,6 +30,22 @@ server {
     proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header   X-Forwarded-Proto $scheme;
   }
+  # SignalR hubs -> api container (Kestrel), same as /api/. Without this, /hubs/*
+  # falls through to "location /" (the static app), whose nginx 405s the negotiate
+  # POST so the connection never reaches the backend. Upgrade/Connection headers +
+  # http_version 1.1 let the WebSocket transport establish instead of long-polling.
+  location /hubs/ {
+    proxy_pass         http://api:8080/hubs/;
+    proxy_http_version 1.1;
+    proxy_set_header   Upgrade $http_upgrade;
+    proxy_set_header   Connection $connection_upgrade;
+    proxy_set_header   Host $host;
+    proxy_set_header   X-Real-IP $remote_addr;
+    proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header   X-Forwarded-Proto $scheme;
+    proxy_buffering    off;
+    proxy_read_timeout 100s;
+  }
   location / {
     proxy_pass http://app:80;
   }
diff --git a/deploy/vm/nginx/conf.d/rolac.conf b/deploy/vm/nginx/conf.d/rolac.conf
index ede2c4c..67660d7 100644
--- a/deploy/vm/nginx/conf.d/rolac.conf
+++ b/deploy/vm/nginx/conf.d/rolac.conf
@@ -1,3 +1,13 @@
+# SignalR WebSocket upgrade. The /hubs/ block below sets the "Connection" header
+# to this variable: "upgrade" when the client sends an Upgrade header (WebSocket),
+# "close" otherwise (long-polling). nginx has no built-in $connection_upgrade, so
+# it MUST be defined here in the http context or nginx fails config test on start
+# ([emerg] unknown "connection_upgrade" variable) and keeps the old config.
+map $http_upgrade $connection_upgrade {
+  default upgrade;
+  ''      close;
+}
+
 server {
   listen 80;
   server_name _;