feat: Initial commit - Train tracking system

Complete real-time train tracking system for Spanish railways (Renfe/Cercanías):

- Backend API (Node.js/Express) with GTFS-RT polling workers
- Frontend dashboard (React/Vite) with Leaflet maps
- Real-time updates via Socket.io WebSocket
- PostgreSQL/PostGIS database with Flyway migrations
- Redis caching layer
- Docker Compose configuration for development and production
- Gitea CI/CD workflows (lint, auto-tag, release)
- Production deployment with nginx + Let's Encrypt SSL

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

nginx/conf.d/default.conf

@@ -0,0 +1,159 @@
+# Upstream para el backend API
+upstream api_backend {
+    server api:3000;
+    keepalive 32;
+}
+
+# Upstream para el frontend
+upstream frontend_app {
+    server frontend:80;
+    keepalive 16;
+}
+
+# Configuración del servidor principal
+server {
+    listen 80;
+    server_name localhost;
+
+    # Logs
+    access_log /var/log/nginx/access.log;
+    error_log /var/log/nginx/error.log;
+
+    # Health check endpoint
+    location /health {
+        access_log off;
+        return 200 "healthy\n";
+        add_header Content-Type text/plain;
+    }
+
+    # API REST endpoints
+    location /api {
+        # Reescribir la URL quitando el prefijo /api
+        rewrite ^/api/(.*)$ /$1 break;
+
+        proxy_pass http://api_backend;
+        proxy_http_version 1.1;
+
+        # Headers
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Connection "";
+
+        # Timeouts
+        proxy_connect_timeout 60s;
+        proxy_send_timeout 60s;
+        proxy_read_timeout 60s;
+
+        # Buffering
+        proxy_buffering on;
+        proxy_buffer_size 4k;
+        proxy_buffers 8 4k;
+        proxy_busy_buffers_size 8k;
+
+        # CORS headers (si es necesario)
+        add_header Access-Control-Allow-Origin * always;
+        add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always;
+        add_header Access-Control-Allow-Headers "Authorization, Content-Type" always;
+
+        if ($request_method = 'OPTIONS') {
+            return 204;
+        }
+    }
+
+    # WebSocket endpoint
+    location /ws {
+        proxy_pass http://api_backend;
+        proxy_http_version 1.1;
+
+        # WebSocket upgrade headers
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+
+        # Headers estándar
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Timeouts más largos para WebSocket
+        proxy_connect_timeout 7d;
+        proxy_send_timeout 7d;
+        proxy_read_timeout 7d;
+
+        # Deshabilitar buffering para WebSocket
+        proxy_buffering off;
+    }
+
+    # Socket.io endpoint
+    location /socket.io/ {
+        proxy_pass http://api_backend;
+        proxy_http_version 1.1;
+
+        # WebSocket upgrade headers
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+
+        # Headers estándar
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Timeouts más largos para WebSocket
+        proxy_connect_timeout 7d;
+        proxy_send_timeout 7d;
+        proxy_read_timeout 7d;
+
+        # Deshabilitar buffering para WebSocket
+        proxy_buffering off;
+    }
+
+    # Frontend - SPA con fallback para React Router
+    location / {
+        proxy_pass http://frontend_app;
+        proxy_http_version 1.1;
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Cache de activos estáticos
+        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+            proxy_pass http://frontend_app;
+            expires 1y;
+            add_header Cache-Control "public, immutable";
+        }
+    }
+
+    # Denegar acceso a archivos ocultos
+    location ~ /\. {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+}
+
+# Configuración HTTPS (descomentar cuando tengas certificados)
+# server {
+#     listen 443 ssl http2;
+#     server_name localhost;
+#
+#     ssl_certificate /etc/nginx/ssl/cert.pem;
+#     ssl_certificate_key /etc/nginx/ssl/key.pem;
+#     ssl_protocols TLSv1.2 TLSv1.3;
+#     ssl_ciphers HIGH:!aNULL:!MD5;
+#     ssl_prefer_server_ciphers on;
+#
+#     # Incluir las mismas configuraciones de location que arriba
+#     # ...
+# }
+
+# Redirección HTTP a HTTPS (descomentar cuando tengas HTTPS configurado)
+# server {
+#     listen 80;
+#     server_name localhost;
+#     return 301 https://$server_name$request_uri;
+# }

nginx/nginx.conf

@@ -0,0 +1,40 @@
+user nginx;
+worker_processes auto;
+error_log /var/log/nginx/error.log warn;
+pid /var/run/nginx.pid;
+
+events {
+    worker_connections 1024;
+    use epoll;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+                    '$status $body_bytes_sent "$http_referer" '
+                    '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log /var/log/nginx/access.log main;
+
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+    keepalive_timeout 65;
+    types_hash_max_size 2048;
+    client_max_body_size 20M;
+
+    # Gzip compression
+    gzip on;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_types text/plain text/css text/xml text/javascript
+               application/json application/javascript application/xml+rss
+               application/x-javascript application/xhtml+xml
+               image/svg+xml;
+
+    # Incluir configuraciones de sitios
+    include /etc/nginx/conf.d/*.conf;
+}

nginx/prod.conf

@@ -0,0 +1,148 @@
+# Configuración nginx para producción con SSL
+#
+# IMPORTANTE: Reemplazar YOUR_DOMAIN.com con tu dominio real
+#
+# Lecciones aprendidas del despliegue:
+# 1. Usar resolver 127.0.0.11 para DNS de Docker (evita errores al iniciar)
+# 2. Usar variables con set $backend para que nginx arranque aunque los upstreams no estén listos
+# 3. http2 debe ir como directiva separada, no en listen (nginx moderno)
+# 4. Socket.io añade /socket.io/ automáticamente, la URL base debe ser https://dominio sin path
+
+# DNS resolver de Docker - CRÍTICO para arranque correcto
+resolver 127.0.0.11 valid=30s;
+
+# Redirección HTTP a HTTPS + endpoint ACME para Let's Encrypt
+server {
+    listen 80;
+    server_name YOUR_DOMAIN.com;
+
+    # Endpoint para verificación de Let's Encrypt
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    # Health check (también útil para load balancers)
+    location /health {
+        access_log off;
+        return 200 "healthy\n";
+        add_header Content-Type text/plain;
+    }
+
+    # Redirección a HTTPS para todo lo demás
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+# Servidor HTTPS principal
+server {
+    listen 443 ssl;
+    http2 on;  # NOTA: En nginx moderno, http2 va como directiva separada
+    server_name YOUR_DOMAIN.com;
+
+    # Certificados SSL de Let's Encrypt
+    ssl_certificate /etc/letsencrypt/live/YOUR_DOMAIN.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/YOUR_DOMAIN.com/privkey.pem;
+
+    # Configuración SSL moderna y segura
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
+    ssl_prefer_server_ciphers off;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 1d;
+
+    # Logs
+    access_log /var/log/nginx/access.log;
+    error_log /var/log/nginx/error.log;
+
+    # Health check
+    location /health {
+        access_log off;
+        return 200 "healthy\n";
+        add_header Content-Type text/plain;
+    }
+
+    # Socket.io endpoint - CRÍTICO para WebSocket en tiempo real
+    # NOTA: Socket.io añade /socket.io/ automáticamente a la URL base
+    # Por eso VITE_WS_URL debe ser https://dominio sin /ws o /socket.io
+    location /socket.io/ {
+        set $backend_socketio api:3000;
+        proxy_pass http://$backend_socketio;
+        proxy_http_version 1.1;
+
+        # Headers para WebSocket upgrade
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+
+        # Headers estándar
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Timeouts largos para conexiones WebSocket persistentes
+        proxy_connect_timeout 7d;
+        proxy_send_timeout 7d;
+        proxy_read_timeout 7d;
+
+        # Deshabilitar buffering para WebSocket
+        proxy_buffering off;
+    }
+
+    # API REST endpoints
+    # NOTA: Cuando se usa variable en proxy_pass, nginx NO hace reemplazo automático de URI
+    # Por eso necesitamos el rewrite explícito
+    location /api/ {
+        set $backend_api api:3000;
+
+        # Reescribir la URL quitando el prefijo /api
+        rewrite ^/api/(.*)$ /$1 break;
+
+        proxy_pass http://$backend_api;
+        proxy_http_version 1.1;
+
+        # Headers
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Connection "";
+
+        # Timeouts
+        proxy_connect_timeout 60s;
+        proxy_send_timeout 60s;
+        proxy_read_timeout 60s;
+
+        # Buffering
+        proxy_buffering on;
+        proxy_buffer_size 4k;
+        proxy_buffers 8 4k;
+    }
+
+    # Frontend - SPA React
+    location / {
+        set $backend_frontend frontend:80;
+        proxy_pass http://$backend_frontend;
+        proxy_http_version 1.1;
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # Cache de activos estáticos
+    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+        set $backend_frontend frontend:80;
+        proxy_pass http://$backend_frontend;
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+
+    # Denegar acceso a archivos ocultos
+    location ~ /\. {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+}