Add deployment

VigilCareClinicalAPI/Program.cs

@@ -94,8 +94,21 @@ try
         .GetSection(ElasticsearchOptions.Section)
         .Get<ElasticsearchOptions>()!;
 
-    builder.Services.AddSingleton(
-        new ElasticsearchClient(new Uri(esOptions.Uri)));
+    builder.Services.AddSingleton(_ =>
+    {
+        var settings = new ElasticsearchClientSettings(new Uri(esOptions.Uri));
+
+        if (!string.IsNullOrWhiteSpace(esOptions.ApiKey))
+            settings = settings.Authentication(new Elastic.Transport.ApiKey(esOptions.ApiKey));
+        else if (!string.IsNullOrWhiteSpace(esOptions.Username))
+            settings = settings.Authentication(
+                new Elastic.Transport.BasicAuthentication(esOptions.Username, esOptions.Password ?? ""));
+
+        if (esOptions.DisableCertificateValidation)
+            settings = settings.ServerCertificateValidationCallback((_, _, _, _) => true);
+
+        return new ElasticsearchClient(settings);
+    });
 
     builder.Services.Configure<RabbitMqOptions>(
     builder.Configuration.GetSection(RabbitMqOptions.Section));
@@ -326,7 +339,21 @@ try
 
     var app = builder.Build();
 
-    if (!app.Environment.IsEnvironment("Testing"))
+    // One-shot CLI verbs exit before hosting. Skip demo seeding for them so
+    // create-admin / register-gateway never race the demo UserSeeder.
+    var isCliCommand = args.Contains("encrypt-phi")
+                       || args.Contains("create-admin")
+                       || args.Contains("register-gateway");
+
+    // Demo data — including the seeded demo users with well-known passwords —
+    // must never be created in production. Seeding:EnableDemoData defaults to
+    // true so local development and the existing verification scripts are
+    // unaffected; appsettings.Production.json sets it to false.
+    var enableDemoData = builder.Configuration.GetValue("Seeding:EnableDemoData", true)
+                         && !app.Environment.IsEnvironment("Testing")
+                         && !isCliCommand;
+
+    if (enableDemoData)
     {
         using var scope = app.Services.CreateScope();
         var db = scope.ServiceProvider.GetRequiredService<AppDbContext>();
@@ -345,11 +372,14 @@ try
         });
     }
 
-    app.UseSwagger();
-    app.UseSwaggerUI(options =>
+    if (builder.Configuration.GetValue("Swagger:Enabled", !app.Environment.IsProduction()))
     {
-        options.SwaggerEndpoint("/swagger/v1/swagger.json", "VigilCare Clinical API v1");
-    });
+        app.UseSwagger();
+        app.UseSwaggerUI(options =>
+        {
+            options.SwaggerEndpoint("/swagger/v1/swagger.json", "VigilCare Clinical API v1");
+        });
+    }
 
     app.UseMiddleware<CorrelationIdMiddleware>();
     app.UseMiddleware<FhirApiKeyOrJwtMiddleware>();
@@ -372,7 +402,7 @@ try
         ResponseWriter = HealthCheckResponseWriter.WriteAsync
     }).AllowAnonymous();
 
-    app.MapMetrics("/metrics");
+    app.MapMetrics("/metrics").AllowAnonymous();
     app.MapControllers();
 
     if (args.Contains("encrypt-phi"))
@@ -380,7 +410,35 @@ try
         await EncryptPhiCommand.RunAsync(app.Services);
         return;
     }
-    
+
+    if (args.Contains("create-admin"))
+    {
+        try
+        {
+            Environment.ExitCode = await CreateAdminCommand.RunAsync(app.Services, args);
+        }
+        catch (ArgumentException ex)
+        {
+            Console.Error.WriteLine(ex.Message);
+            Environment.ExitCode = 1;
+        }
+        return;
+    }
+
+    if (args.Contains("register-gateway"))
+    {
+        try
+        {
+            Environment.ExitCode = await RegisterGatewayCommand.RunAsync(app.Services, args);
+        }
+        catch (ArgumentException ex)
+        {
+            Console.Error.WriteLine(ex.Message);
+            Environment.ExitCode = 1;
+        }
+        return;
+    }
+
     app.Run();
 
 }