feat: add test server setup and doc

.github/workflows/deploy-test.yml

@@ -0,0 +1,20 @@
+name: Deploy to Test
+
+on:
+  workflow_dispatch: # For manual triggers via the GitHub Actions UI
+    inputs:
+      image-tag:
+        type: string
+        description: 'Image tag to deploy (default: pr-<number> if PR exists, latest for default branch)'
+
+jobs:
+  deploy:
+    uses: ls1intum/.github/.github/workflows/deploy-docker-compose.yml@main
+    with:
+      environment: Test
+      docker-compose-file: './docker/test/docker-compose.yml'
+      main-image-name: ls1intum/memo/memo-app
+      image-tag: ${{ inputs.image-tag }}
+      env-file-name: ./docker/test/.env
+      remove-volumes: false
+    secrets: inherit

.npmrc

@@ -0,0 +1 @@
+legacy-peer-deps=true

DEPLOYMENT_CHECKLIST.md

@@ -0,0 +1,82 @@
+# Deployment Setup Verification Checklist
+
+## ✅ **GitHub Actions Workflows**
+
+- [x] `build-and-push.yml` - Builds and pushes Docker images
+- [x] `deploy-test.yml` - Deploys to test environment (memo-test1.aet.cit.tum.de)
+- [x] `deploy-staging.yml` - Deploys to staging environment
+- [x] `deploy-production.yml` - Deploys to production environment
+- [x] No development deployment workflow (correct!)
+
+## ✅ **Docker Compose Files**
+
+- [x] `docker/development/docker-compose.yml` - Local development (uses build:)
+- [x] `docker/test/docker-compose.yml` - Test environment (memo-test1.aet.cit.tum.de)
+- [x] `docker/staging/docker-compose.yml` - Uses registry image with ${IMAGE_TAG}
+- [x] `docker/production/docker-compose.yml` - Uses registry image with ${IMAGE_TAG}
+
+## ✅ **Environment Files**
+
+- [x] `docker/development/.env` - Local development config (localhost URLs)
+- [x] `docker/test/.env.example` - Test config (memo-test1.aet.cit.tum.de)
+- [x] `docker/staging/.env` - Staging config (staging.memo.aet.cit.tum.de)
+- [x] `docker/production/.env` - Production config (memo.aet.cit.tum.de)
+- [x] All env files have IMAGE_TAG=latest
+- [x] All URLs updated to memo.aet.cit.tum.de domain
+
+## ✅ **Dockerfile**
+
+- [x] Multi-stage Dockerfile with development, builder, and production targets
+- [x] Properly configured for Next.js application
+
+## ✅ **Configuration Files**
+
+- [x] `.dockerignore` - Excludes unnecessary files from build context
+- [x] `docker/test/nginx.conf` - Nginx config for test (HTTP + HTTPS)
+- [x] `docker/staging/nginx.conf` - Nginx config for staging
+- [x] `docker/production/nginx.conf` - Nginx config for production with security
+
+## 🔧 **Next Steps Required (Manual Setup)**
+
+### GitHub Repository Settings:
+
+1. **Create Environments**:
+   - Go to `Settings > Environments`
+   - Create: `Test`, `Staging`, `Production`
+
+2. **For each environment, configure**: **Secrets:**
+   - `VM_SSH_PRIVATE_KEY` - SSH private key for deployment user
+
+   **Variables:**
+   - `VM_HOST` - Server hostname (e.g., `memo-test1.aet.cit.tum.de`, `staging.memo.aet.cit.tum.de`,
+     `memo.aet.cit.tum.de`)
+   - `VM_USERNAME` - `github_deployment`
+
+### VM Setup (for each environment):
+
+1. Create deployment user: `github_deployment`
+2. Add to docker group
+3. Generate SSH keys
+4. Set up deployment directory: `/opt/github`
+
+## 🚀 **Deployment Process**
+
+1. **Code Push** → Automatic image build (`ghcr.io/ls1intum/memo/memo-app:latest` or `pr-<number>`)
+2. **Test Deploy** → Manual trigger via GitHub Actions UI
+3. **Staging Deploy** → Manual trigger via GitHub Actions UI
+4. **Production Deploy** → Manual trigger via GitHub Actions UI
+
+## 🎯 **Environment Usage**
+
+- **Development**: `./docker-manage.sh up development` (local only)
+- **Test**: GitHub Actions deployment (LRZ VM testing at memo-test1.aet.cit.tum.de)
+- **Staging**: GitHub Actions deployment (pre-production testing)
+- **Production**: GitHub Actions deployment (live)
+
+## ✅ **All Issues Fixed**
+
+- [x] Removed redundant development deployment workflow
+- [x] Fixed all domain URLs to memo.aet.cit.tum.de
+- [x] Added IMAGE_TAG to environment files
+- [x] Proper separation of local vs CI environments
+- [x] Clean file structure without duplicates

docker/test/docker-compose.yml

@@ -0,0 +1,58 @@
+version: '3.8'
+
+name: memo-test
+
+services:
+  nginx:
+    container_name: memo-test-nginx
+    image: nginx:alpine
+    ports:
+      - '80:80'
+      - '443:443'
+    volumes:
+      - ./nginx.conf:/etc/nginx/nginx.conf:ro
+      - /etc/letsencrypt:/etc/letsencrypt:ro
+      - /var/www/certbot:/var/www/certbot:ro
+    depends_on:
+      - app
+    networks:
+      - memo-test-network
+    restart: unless-stopped
+
+  app:
+    container_name: memo-test-app
+    image: 'ghcr.io/ls1intum/memo/memo-app:${IMAGE_TAG:-latest}'
+    environment:
+      - NODE_ENV=production
+      - APP_ENV=test
+      - DATABASE_URL=${DATABASE_URL:-postgresql://memo_user:memo_password@db:5432/memo_test}
+      - NEXT_PUBLIC_APP_ENV=${NEXT_PUBLIC_APP_ENV:-test}
+      - NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL:-https://memo-test1.aet.cit.tum.de/api}
+    expose:
+      - '3000'
+    depends_on:
+      - db
+    networks:
+      - memo-test-network
+    restart: unless-stopped
+
+  db:
+    container_name: memo-test-db
+    image: postgres:16-alpine
+    environment:
+      - POSTGRES_DB=memo_test
+      - POSTGRES_USER=memo_user
+      - POSTGRES_PASSWORD=memo_password
+    volumes:
+      - postgres_test_data:/var/lib/postgresql/data
+      - ../../scripts/init-db.sql:/docker-entrypoint-initdb.d/init-db.sql
+    networks:
+      - memo-test-network
+    restart: unless-stopped
+
+volumes:
+  postgres_test_data:
+
+networks:
+  memo-test-network:
+    driver: bridge

docker/test/nginx.conf

@@ -0,0 +1,88 @@
+events {
+    worker_connections 1024;
+}
+
+http {
+    upstream app {
+        server app:3000;
+    }
+
+    # HTTP server - redirect to HTTPS
+    server {
+        listen 80;
+        server_name memo-test1.aet.cit.tum.de;
+
+        # Allow Let's Encrypt ACME challenge
+        location /.well-known/acme-challenge/ {
+            root /var/www/certbot;
+        }
+
+        # Redirect all other HTTP traffic to HTTPS
+        location / {
+            return 301 https://$host$request_uri;
+        }
+    }
+
+    # HTTPS server
+    server {
+        listen 443 ssl http2;
+        server_name memo-test1.aet.cit.tum.de;
+
+        # SSL certificates (managed by Certbot)
+        ssl_certificate /etc/letsencrypt/live/memo-test1.aet.cit.tum.de/fullchain.pem;
+        ssl_certificate_key /etc/letsencrypt/live/memo-test1.aet.cit.tum.de/privkey.pem;
+
+        # SSL configuration
+        ssl_protocols TLSv1.2 TLSv1.3;
+        ssl_prefer_server_ciphers on;
+        ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
+
+        # Security headers
+        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-referrer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
+
+        # Gzip compression
+        gzip on;
+        gzip_vary on;
+        gzip_min_length 1024;
+        gzip_proxied expired no-cache no-store private must-revalidate auth;
+        gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml+rss application/javascript;
+
+        # API routes
+        location /api/ {
+            proxy_pass http://app;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection 'upgrade';
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_cache_bypass $http_upgrade;
+        }
+
+        # All other routes (Next.js app)
+        location / {
+            proxy_pass http://app;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection 'upgrade';
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_cache_bypass $http_upgrade;
+        }
+
+        # Health check endpoint
+        location /health {
+            access_log off;
+            return 200 "healthy\n";
+            add_header Content-Type text/plain;
+        }
+    }
+}