fix

- Change Dockerfile to run as root instead of peikarband user
- Update Helm values.yaml to use root user (runAsUser: 0, runAsNonRoot: false)
- Improve entrypoint.sh permission handling with reusable function
- Add reflex init before run if packages not installed
- Fix node_modules/.bin permissions for symlinks and targets

This resolves the 'react-router: Permission denied' error by running
containers with root privileges. TODO: Switch back to non-root user
after permission issues are fully resolved.

.dockerignore

@@ -0,0 +1,152 @@
+# Peikarband Platform - Docker Ignore File
+# Optimize Docker build by excluding unnecessary files
+
+# Git
+.git
+.gitignore
+.gitattributes
+
+# CI/CD
+.github/
+.gitlab-ci.yml
+woodpecker.yml
+.drone.yml
+
+# IDE & Editors
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+.DS_Store
+
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.Python
+*.egg-info/
+dist/
+build/
+*.egg
+.pytest_cache/
+.mypy_cache/
+.coverage
+htmlcov/
+.tox/
+.hypothesis/
+*.cover
+
+# Virtual Environment
+venv/
+env/
+ENV/
+virtualenv/
+
+# Database
+*.db
+*.sqlite
+*.sqlite3
+reflex.db
+*.dump
+*.sql
+
+# Logs
+*.log
+logs/
+*.out
+*.err
+
+# Environment & Secrets
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+*.crt
+secrets/
+*.secret
+
+# Documentation (exclude from container, keep only essential)
+peikarband/docs/
+*.md
+!README.md
+LICENSE
+
+# Tests (exclude from production image)
+peikarband/tests/
+peikarband/config/pytest.ini
+.pytest_cache/
+coverage/
+*.coverage
+
+# Development
+Makefile
+docker-compose.yml
+docker-compose.*.yml
+
+# Kubernetes & Helm (exclude from container)
+helm/
+docker/docker-compose.yml
+*.yaml
+*.yml
+!requirements.txt
+!peikarband/**/*.yaml
+!peikarband/**/*.yml
+
+# Backup & Temp Files
+*.bak
+*.tmp
+*.temp
+tmp/
+temp/
+.cache/
+
+# Media & Assets (exclude large files but keep necessary ones)
+# Exclude root level media files
+/wordpress.gif
+/banner-3.gif
+
+# Keep assets directory (now in peikarband/)
+!peikarband/assets/
+
+# Node modules (Reflex might need some)
+node_modules/
+npm-debug.log
+yarn-error.log
+package-lock.json
+yarn.lock
+
+# OS Files
+Thumbs.db
+.DS_Store
+Desktop.ini
+
+# Editor Configs
+.editorconfig
+.prettierrc
+.eslintrc
+
+# Pre-commit & Linters
+.pre-commit-config.yaml
+.flake8
+.pylintrc
+mypy.ini
+.isort.cfg
+
+# Scripts (keep only necessary ones)
+peikarband/tools/scripts/*
+!peikarband/tools/scripts/update-env-json.sh
+*.sh
+!entrypoint.sh
+
+# Jupyter Notebooks
+*.ipynb
+.ipynb_checkpoints/
+
+# Misc
+TODO.md
+CHANGELOG.md
+CONTRIBUTING.md
+.mailmap

.gitignore

@@ -65,7 +65,6 @@ temp/
 *.tmp
 
 # Docker
-.dockerignore
 
 # Kubernetes secrets
 *secret*.yaml

.woodpecker.yml

@@ -14,49 +14,49 @@ steps:
   # Ensure Base Image Exists
   # ============================================
   
-  # ensure-base-image:
+  ensure-base-image:
-  #   image: woodpeckerci/plugin-docker-buildx
+    image: woodpeckerci/plugin-docker-buildx
-  #   settings:
+    settings:
-  #     registry: hub.peikarband.ir
+      registry: hub.peikarband.ir
-  #     repo: *app_image
+      repo: *app_image
-  #     # username:
+      # username:
-  #     #   from_secret: HARBOR_USERNAME
+      #   from_secret: HARBOR_USERNAME
-  #     # password:
+      # password:
-  #     #   from_secret: HARBOR_PASSWORD
+      #   from_secret: HARBOR_PASSWORD
-  #     username: admin
+      username: admin
-  #     password: 5459ed7590d37656410fae38bdf59eb7ee33b68cd4c
+      password: 5459ed7590d37656410fae38bdf59eb7ee33b68cd4c
-  #     dockerfile: docker/Dockerfile.base
+      dockerfile: docker/Dockerfile.base
-  #     context: .
+      context: .
-  #     platforms: linux/amd64
+      platforms: linux/amd64
       
-  #     tags:
+      tags:
-  #       - base
+        - base
       
-  #     build_args:
+      build_args:
-  #       - PYTHON_VERSION=3.11
+        - PYTHON_VERSION=3.11
-  #       - NODE_VERSION=20
+        - NODE_VERSION=20
-  #       - BUILD_DATE=${CI_PIPELINE_CREATED}
+        - BUILD_DATE=${CI_PIPELINE_CREATED}
-  #       - VERSION=${CI_COMMIT_SHA:0:8}
+        - VERSION=${CI_COMMIT_SHA:0:8}
       
-  #     labels:
+      labels:
-  #       - org.opencontainers.image.created=${CI_PIPELINE_CREATED}
+        - org.opencontainers.image.created=${CI_PIPELINE_CREATED}
-  #       - org.opencontainers.image.source=${CI_REPO_LINK}
+        - org.opencontainers.image.source=${CI_REPO_LINK}
-  #       - org.opencontainers.image.title=Peikarband Base
+        - org.opencontainers.image.title=Peikarband Base
-  #       - org.opencontainers.image.description=Base image with Python, Node.js, bun, and build tools
+        - org.opencontainers.image.description=Base image with Python, Node.js, bun, and build tools
       
-  #     cache: inline
+      cache: inline
-  #     provenance: true
+      provenance: true
-  #     sbom: true
+      sbom: true
-  #     push: true 
+      push: true 
      
-  #   when:
+    when:
-  #     event: [push, tag, manual]
+      event: [push, tag, manual]
-  #     branch: [main, develop]
+      branch: [main, develop]
-  #     # Only rebuild base if its definition changed
+      # Only rebuild base if its definition changed
-  #     path:
+      path:
-  #       include:
+        include:
-  #         - docker/Dockerfile.base
+          - docker/Dockerfile.base
-  #         - .woodpecker.yml
+          - .woodpecker.yml
 
   # ============================================
   # Build Application Image
@@ -166,41 +166,41 @@ steps:
   # Notifications
   # ============================================
   
-  notify-success:
+  # notify-success:
-    image: alpine:latest
+  #   image: alpine:latest
-    commands:
+  #   commands:
-      - echo "════════════════════════════════════════"
+  #     - echo "════════════════════════════════════════"
-      - echo "  🎉 Pipeline Completed Successfully!"
+  #     - echo "  🎉 Pipeline Completed Successfully!"
-      - echo "════════════════════════════════════════"
+  #     - echo "════════════════════════════════════════"
-      - echo ""
+  #     - echo ""
-      - echo "Branch:" "${CI_COMMIT_BRANCH}"
+  #     - echo "Branch:" "${CI_COMMIT_BRANCH}"
-      - echo "Commit:" "${CI_COMMIT_SHA:0:8}"
+  #     - echo "Commit:" "${CI_COMMIT_SHA:0:8}"
-      - echo ""
+  #     - echo ""
-      - echo "Images:"
+  #     - echo "Images:"
-      - echo "  • Base:" "hub.peikarband.ir/peikarband/landing:base"
+  #     - echo "  • Base:" "hub.peikarband.ir/peikarband/landing:base"
-      - echo "  • App:" "hub.peikarband.ir/peikarband/landing:${CI_COMMIT_SHA:0:8}"
+  #     - echo "  • App:" "hub.peikarband.ir/peikarband/landing:${CI_COMMIT_SHA:0:8}"
-      - echo ""
+  #     - echo ""
-      - echo "Deploy with:"
+  #     - echo "Deploy with:"
-      - echo "  kubectl set image deployment/peikarband-landing \\"
+  #     - echo "  kubectl set image deployment/peikarband-landing \\"
-      - echo "    peikarband-landing=hub.peikarband.ir/peikarband/landing:${CI_COMMIT_SHA:0:8}"
+  #     - echo "    peikarband-landing=hub.peikarband.ir/peikarband/landing:${CI_COMMIT_SHA:0:8}"
-      - echo ""
+  #     - echo ""
-      - echo "════════════════════════════════════════"
+  #     - echo "════════════════════════════════════════"
-    when:
+  #   when:
-      event: [push, tag]
+  #     event: [push, tag]
-      status: success
+  #     status: success
 
-  notify-failure:
+  # notify-failure:
-    image: alpine:latest
+  #   image: alpine:latest
-    commands:
+  #   commands:
-      - echo "════════════════════════════════════════"
+  #     - echo "════════════════════════════════════════"
-      - echo "  ❌ Pipeline Failed!"
+  #     - echo "  ❌ Pipeline Failed!"
-      - echo "════════════════════════════════════════"
+  #     - echo "════════════════════════════════════════"
-      - echo ""
+  #     - echo ""
-      - echo "Branch:" "${CI_COMMIT_BRANCH}"
+  #     - echo "Branch:" "${CI_COMMIT_BRANCH}"
-      - echo "Commit:" "${CI_COMMIT_SHA:0:8}"
+  #     - echo "Commit:" "${CI_COMMIT_SHA:0:8}"
-      - echo ""
+  #     - echo ""
-      - echo "Please check the logs above"
+  #     - echo "Please check the logs above"
-      - echo "════════════════════════════════════════"
+  #     - echo "════════════════════════════════════════"
-    when:
+  #   when:
-      event: [push, tag]
+  #     event: [push, tag]
-      status: failure
+  #     status: failure

docker/.dockerignore

@@ -0,0 +1,152 @@
+# Peikarband Platform - Docker Ignore File
+# Optimize Docker build by excluding unnecessary files
+
+# Git
+.git
+.gitignore
+.gitattributes
+
+# CI/CD
+.github/
+.gitlab-ci.yml
+woodpecker.yml
+.drone.yml
+
+# IDE & Editors
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+.DS_Store
+
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.Python
+*.egg-info/
+dist/
+build/
+*.egg
+.pytest_cache/
+.mypy_cache/
+.coverage
+htmlcov/
+.tox/
+.hypothesis/
+*.cover
+
+# Virtual Environment
+venv/
+env/
+ENV/
+virtualenv/
+
+# Database
+*.db
+*.sqlite
+*.sqlite3
+reflex.db
+*.dump
+*.sql
+
+# Logs
+*.log
+logs/
+*.out
+*.err
+
+# Environment & Secrets
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+*.crt
+secrets/
+*.secret
+
+# Documentation (exclude from container, keep only essential)
+peikarband/docs/
+*.md
+!README.md
+LICENSE
+
+# Tests (exclude from production image)
+peikarband/tests/
+peikarband/config/pytest.ini
+.pytest_cache/
+coverage/
+*.coverage
+
+# Development
+Makefile
+docker-compose.yml
+docker-compose.*.yml
+
+# Kubernetes & Helm (exclude from container)
+helm/
+docker/docker-compose.yml
+*.yaml
+*.yml
+!requirements.txt
+!peikarband/**/*.yaml
+!peikarband/**/*.yml
+
+# Backup & Temp Files
+*.bak
+*.tmp
+*.temp
+tmp/
+temp/
+.cache/
+
+# Media & Assets (exclude large files but keep necessary ones)
+# Exclude root level media files
+/wordpress.gif
+/banner-3.gif
+
+# Keep assets directory (now in peikarband/)
+!peikarband/assets/
+
+# Node modules (Reflex might need some)
+node_modules/
+npm-debug.log
+yarn-error.log
+package-lock.json
+yarn.lock
+
+# OS Files
+Thumbs.db
+.DS_Store
+Desktop.ini
+
+# Editor Configs
+.editorconfig
+.prettierrc
+.eslintrc
+
+# Pre-commit & Linters
+.pre-commit-config.yaml
+.flake8
+.pylintrc
+mypy.ini
+.isort.cfg
+
+# Scripts (keep only necessary ones)
+peikarband/tools/scripts/*
+!peikarband/tools/scripts/update-env-json.sh
+*.sh
+!entrypoint.sh
+
+# Jupyter Notebooks
+*.ipynb
+.ipynb_checkpoints/
+
+# Misc
+TODO.md
+CHANGELOG.md
+CONTRIBUTING.md
+.mailmap

docker/Dockerfile

@@ -56,44 +56,32 @@ ENV PYTHONPATH=/build:/build/peikarband
 
 # Verify that peikarband.peikarband can be imported before running reflex
 # This helps catch import errors early
-RUN cd /build && \
+# RUN cd /build && \
-    python3 -c "from peikarband.peikarband import app; print('✅ peikarband.peikarband.app imported successfully')" && \
+#     python3 -c "from peikarband.peikarband import app; print('✅ peikarband.peikarband.app imported successfully')" && \
-    echo "Import test passed"
+#     echo "Import test passed"
 
 # Initialize Reflex and build frontend from peikarband directory
 # Reflex needs to run from the directory containing rxconfig.py
 RUN cd /build/peikarband && \
     reflex init --loglevel debug || true && \
-    reflex export --frontend-only --no-zip --loglevel debug || echo "Export completed with warnings"
+    reflex export --frontend-only --no-zip --loglevel debug && \
-
+    echo "Frontend export completed" && \
-# Install npm dependencies if .web directory exists
+    if [ -d .web/node_modules/.bin ]; then \
-# Note: reflex export already builds the frontend, we just need to install deps
+        find .web/node_modules/.bin -type f -exec chmod +x {} \; && \
-RUN if [ -d "/build/peikarband/.web" ] && [ -f "/build/peikarband/.web/package.json" ]; then \
+        find .web/node_modules/.bin -type l | while read symlink; do \
-        echo "Found .web directory with package.json, installing dependencies..." && \
+            target=$(readlink -f "$symlink" 2>/dev/null || true); \
-        cd /build/peikarband/.web && \
+            if [ -n "$target" ] && [ -f "$target" ]; then \
-        # Remove any existing .npmrc that might override registry
+                chmod +x "$target" 2>/dev/null || true; \
-        rm -f .npmrc && \
+            fi; \
-        # Set npm registry to official registry
+            chmod +x "$symlink" 2>/dev/null || true; \
-        npm config set registry https://registry.npmjs.org/ && \
+        done && \
-        npm config set fetch-retry-mintimeout 20000 && \
+        echo "✅ Set executable permissions for all .bin files (files and symlinks) and their targets"; \
-        npm config set fetch-retry-maxtimeout 120000 && \
-        npm config set fetch-retries 5 && \
-        npm config set fetch-timeout 300000 && \
-        # Verify registry is set correctly
-        echo "Using npm registry: $(npm config get registry)" && \
-        # Install dependencies (reflex export already built the frontend)
-        if [ -f "package-lock.json" ]; then \
-            npm ci --prefer-offline --no-audit --loglevel verbose || \
-            (echo "npm ci failed, retrying with npm install..." && npm install --prefer-offline --no-audit --loglevel verbose); \
-        else \
-            echo "package-lock.json not found, using npm install..." && \
-            npm install --prefer-offline --no-audit --loglevel verbose; \
-        fi && \
-        echo "Dependencies installed successfully"; \
-    else \
-        echo "Warning: .web directory or package.json not found, skipping npm install"; \
     fi
 
+# Note: reflex export already builds and installs everything needed
+# No additional npm install is required
+RUN echo "Frontend built by reflex export"
+
 # ============================================
 # Stage 2: Runtime (using base image for Node.js)
 # ============================================
@@ -113,12 +101,17 @@ LABEL org.opencontainers.image.vendor="Peikarband"
 LABEL org.opencontainers.image.version="${VERSION}"
 LABEL org.opencontainers.image.created="${BUILD_DATE}"
 
-# Create non-root user
+# Running as root for now to avoid permission issues
-RUN groupadd -r peikarband && \
+# TODO: Switch back to non-root user after permission issues are resolved
-    useradd -r -g peikarband -u 1000 -m -s /bin/bash peikarband
+# RUN groupadd -r peikarband && \
+#     useradd -r -g peikarband -u 1000 -m -s /bin/bash peikarband
 
 WORKDIR /app
 
+# Note: We keep WORKDIR=/app (not /app/peikarband) to avoid Python importing
+# /app/peikarband/peikarband/ as the peikarband package incorrectly
+# The entrypoint script will cd to /app/peikarband before running reflex
+
 # Base image already has everything we need:
 # - Python 3.11
 # - Node.js 20
@@ -132,46 +125,82 @@ COPY --from=builder /usr/local/bin /usr/local/bin
 
 # Copy application code to /app/peikarband/ to create peikarband.peikarband structure
 # With app_name="peikarband", Reflex expects to find peikarband.peikarband module
-COPY --from=builder --chown=peikarband:peikarband /build/peikarband /app/peikarband
+# Running as root, so no need for chown
+COPY --from=builder /build/peikarband /app/peikarband
+
+# CRITICAL: Remove __init__.py from /app if it exists
+# Reflex will crash if there's __init__.py in the app root directory
+RUN if [ -f /app/__init__.py ]; then \
+        echo "⚠️  WARNING: Removing __init__.py from /app (causes Reflex crash)"; \
+        rm -f /app/__init__.py; \
+    fi && \
+    echo "✅ Verified: No __init__.py in /app root"
+
+# Copy entrypoint script
+COPY docker/entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod +x /usr/local/bin/entrypoint.sh && chmod +x /app/peikarband/.web/app/routes.js 
 
 # Create necessary directories
-RUN mkdir -p /app/data /app/logs /app/uploaded_files && \
+RUN mkdir -p /app/data /app/logs /app/uploaded_files
-    chown -R peikarband:peikarband /app
 
-# Set proper permissions
+# Set proper permissions for application files
-RUN chmod -R 755 /app && \
+# Explicitly set executable permissions for node_modules/.bin files (both files and symlinks)
+# Also fix permissions for symlink targets
+RUN if [ -d /app/peikarband/.web/node_modules/.bin ]; then \
+        find /app/peikarband/.web/node_modules/.bin -type f -exec chmod +x {} \; && \
+        find /app/peikarband/.web/node_modules/.bin -type l | while read symlink; do \
+            target=$(readlink -f "$symlink" 2>/dev/null || true); \
+            if [ -n "$target" ] && [ -f "$target" ]; then \
+                chmod +x "$target" 2>/dev/null || true; \
+            fi; \
+            chmod +x "$symlink" 2>/dev/null || true; \
+        done && \
+        ls -la /app/peikarband/.web/node_modules/.bin/ | head -20 && \
+        echo "✅ Verified executable permissions for .bin files and symlink targets"; \
+    fi && \
     chmod -R 777 /app/data /app/logs /app/uploaded_files
 
 # Environment variables
-# PYTHONPATH=/app allows importing peikarband from /app/peikarband/
+# PYTHONPATH includes both /app and /app/peikarband
-# which makes peikarband.peikarband available from /app/peikarband/peikarband/
+# - /app: allows importing peikarband from /app/peikarband/
-# Note: Current directory (.) is added to sys.path, but PYTHONPATH entries come first
+# - /app/peikarband: allows importing src from /app/peikarband/src/
+# This makes both peikarband.peikarband and src.* imports work correctly
 # REFLEX_DIR points to the directory containing rxconfig.py
 ENV PYTHONUNBUFFERED=1 \
     PYTHONDONTWRITEBYTECODE=1 \
-    PYTHONPATH=/app \
+    PYTHONPATH=/app:/app/peikarband \
     PATH="/app/.venv/bin:$PATH" \
     REFLEX_DIR=/app/peikarband \
     NODE_ENV=production
 
-# Health check
+# Diagnostic information
-HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
+RUN echo "=== Diagnostic Info ===" && \
-    CMD curl -f http://localhost:${PORT:-3000}/_health || exit 1
+    if [ -f /app/peikarband/.web/node_modules/.bin/react-router ]; then \
+        ls -la /app/peikarband/.web/node_modules/.bin/react-router && \
+        file /app/peikarband/.web/node_modules/.bin/react-router || true; \
+    fi && \
+    if [ -f /app/peikarband/.web/node_modules/@react-router/dev/bin.js ]; then \
+        head -5 /app/peikarband/.web/node_modules/@react-router/dev/bin.js || true; \
+    fi && \
+    echo "======================="
 
-# Switch to non-root user
+# Health check (using backend health endpoint on port 8000)
-USER peikarband
+HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
+    CMD curl -f http://localhost:8000/ping || exit 1
+
+# Running as root for now to avoid permission issues
+# USER peikarband
 
 # Expose port
 EXPOSE 3000 8000
 
 # Use tini as init system
-ENTRYPOINT ["/usr/bin/tini", "--"]
+ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/entrypoint.sh"]
 
 # Start application
-# Reflex will run from /app/peikarband where rxconfig.py is located
+# entrypoint.sh will cd to /app/peikarband and run reflex
 # PYTHONPATH=/app:/app/peikarband allows Python to find both peikarband and peikarband.peikarband
-WORKDIR /app/peikarband
+CMD ["run", "--env", "prod", "--loglevel", "info", "--frontend-port", "3000", "--backend-port", "8000"]
-CMD ["reflex", "run", "--env", "prod", "--loglevel", "info", "--frontend-port", "3000", "--backend-port", "8000"]
 
 # ============================================
 # Build Information

docker/entrypoint.sh

@@ -0,0 +1,71 @@
+#!/bin/bash
+set -e
+
+# Function to fix node_modules permissions
+fix_node_modules_permissions() {
+    if [ -d /app/peikarband/.web/node_modules/.bin ]; then
+        echo "Checking node_modules/.bin permissions..."
+        
+        REACT_ROUTER_BIN="/app/peikarband/.web/node_modules/.bin/react-router"
+        
+        # Check if react-router exists
+        if [ -e "$REACT_ROUTER_BIN" ]; then
+            # If it's a symlink, check and fix the target
+            if [ -L "$REACT_ROUTER_BIN" ]; then
+                TARGET=$(readlink -f "$REACT_ROUTER_BIN")
+                echo "react-router is a symlink pointing to: $TARGET"
+                if [ -f "$TARGET" ] && [ ! -x "$TARGET" ]; then
+                    echo "WARNING: Target file is not executable, attempting to fix..."
+                    chmod +x "$TARGET" 2>/dev/null || true
+                fi
+            fi
+            
+            # Fix permissions for react-router itself (file or symlink)
+            if [ ! -x "$REACT_ROUTER_BIN" ]; then
+                echo "WARNING: react-router is not executable, attempting to fix..."
+                chmod +x "$REACT_ROUTER_BIN" 2>/dev/null || true
+            fi
+            
+            # Fix all .bin files and their symlink targets
+            echo "Fixing permissions for all .bin files and symlink targets..."
+            find /app/peikarband/.web/node_modules/.bin -type f -exec chmod +x {} \; 2>/dev/null || true
+            find /app/peikarband/.web/node_modules/.bin -type l | while read symlink; do
+                target=$(readlink -f "$symlink" 2>/dev/null || true)
+                if [ -n "$target" ] && [ -f "$target" ]; then
+                    chmod +x "$target" 2>/dev/null || true
+                fi
+                chmod +x "$symlink" 2>/dev/null || true
+            done
+            
+            # Verify react-router is executable
+            if [ -x "$REACT_ROUTER_BIN" ]; then
+                echo "✅ react-router is executable"
+            else
+                echo "⚠️  WARNING: react-router may still not be executable (running as non-root)"
+            fi
+        else
+            echo "⚠️  WARNING: react-router binary not found (packages may not be installed yet)"
+        fi
+    else
+        echo "⚠️  WARNING: .web/node_modules/.bin directory not found (packages may not be installed yet)"
+    fi
+}
+
+# Change to the directory containing rxconfig.py
+cd /app/peikarband
+
+# If reflex run is being executed, ensure packages are installed first
+# This handles the case where .web directory doesn't exist from build time
+if [ "$1" = "run" ] && [ ! -d /app/peikarband/.web/node_modules ]; then
+    echo "Initializing Reflex (installing packages)..."
+    reflex init --loglevel info || true
+    echo "Packages installed, fixing permissions..."
+    fix_node_modules_permissions
+fi
+
+# Fix permissions if node_modules already exists (from build time or init)
+fix_node_modules_permissions
+
+# Run reflex with all passed arguments
+exec reflex "$@"
+

helm/peikarband/templates/deployment.yaml

@@ -34,6 +34,12 @@ spec:
           {{- toYaml .Values.securityContext | nindent 12 }}
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
         imagePullPolicy: {{ .Values.image.pullPolicy }}
+        {{- if .Values.command }}
+        command: {{- toYaml .Values.command | nindent 12 }}
+        {{- end }}
+        {{- if .Values.args }}
+        args: {{- toYaml .Values.args | nindent 12 }}
+        {{- end }}
         ports:
         - name: backend
           containerPort: {{ .Values.service.backend.targetPort }}
@@ -41,10 +47,7 @@ spec:
         - name: frontend
           containerPort: {{ .Values.service.frontend.targetPort }}
           protocol: TCP
-        livenessProbe:
+       
-          {{- toYaml .Values.livenessProbe | nindent 12 }}
-        readinessProbe:
-          {{- toYaml .Values.readinessProbe | nindent 12 }}
         resources:
           {{- toYaml .Values.resources | nindent 12 }}
         env:

helm/peikarband/templates/ingress.yaml

@@ -40,7 +40,7 @@ spec:
           {{- end }}
     {{- end }}
 {{- end }}
-
+---
 {{- if .Values.ingress.apiEnabled -}}
 # Backend API Ingress (api.peikarband.ir -> port 8000)
 apiVersion: networking.k8s.io/v1

helm/peikarband/values-production.yaml

@@ -5,7 +5,6 @@ replicaCount: 1
 
 image:
   pullPolicy: Always
-  tag: "latest"
 
 # Auto-create registry secret
 registrySecret:
@@ -18,7 +17,6 @@ registrySecret:
 imagePullSecrets:
   - name: hub-registry-secret
 
-# Auto-create application secrets (database, redis, etc)
 appSecrets:
   enabled: false  # Set to true if you need database/redis
   name: peikarband-prod-secrets
@@ -57,8 +55,6 @@ ingress:
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
     traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
     traefik.ingress.kubernetes.io/router.tls: "true"
-    # Rate limiting and body size should be configured via Traefik Middleware
-    # Example: traefik.ingress.kubernetes.io/router.middlewares: default-ratelimit@kubernetescrd
   hosts:
     - host: peikarband.ir
       paths:
@@ -80,6 +76,8 @@ ingress:
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
     traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
     traefik.ingress.kubernetes.io/router.tls: "true"
+    # Strip /api prefix if needed (currently not using prefix)
+    # traefik.ingress.kubernetes.io/rewrite-target: /
   apiHosts:
     - host: api.peikarband.ir
       paths:
@@ -119,10 +117,11 @@ readinessProbe:
   httpGet:
     path: /ping
     port: 8000
-  initialDelaySeconds: 60  # Allow Reflex to fully start (30-60s expected)
+    scheme: HTTP
+  initialDelaySeconds: 30  # Allow Reflex to fully start (build + startup takes time)
   periodSeconds: 10
-  timeoutSeconds: 5
+  timeoutSeconds: 5  # Increased timeout for slow responses
-  failureThreshold: 6  # Allow 6 failures = 60s grace period
+  failureThreshold: 5  # Allow 10 failures = 100s grace period
 
 # Override liveness probe
 # Using /live endpoint which is specifically designed for liveness checks
@@ -130,10 +129,11 @@ livenessProbe:
   httpGet:
     path: /live
     port: 8000
-  initialDelaySeconds: 90  # More time for liveness (after readiness)
+    scheme: HTTP
-  periodSeconds: 15
+  initialDelaySeconds: 30  # More time for liveness (after readiness + build)
-  timeoutSeconds: 5
+  periodSeconds: 10  # Check less frequently
-  failureThreshold: 3
+  timeoutSeconds: 5 # Increased timeout
+  failureThreshold: 5  # Allow more failures before restart
 
 configMap:
   data:

helm/peikarband/values.yaml

@@ -8,6 +8,17 @@ image:
   pullPolicy: IfNotPresent
   tag: "latest"
 
+# Build-time configuration (used during docker build)
+# Note: This is for documentation. Actual build uses Makefile NPM_REGISTRY variable
+# To override npm registry during build:
+#   make docker-build NPM_REGISTRY=https://your-npm-registry.com/
+build:
+  npmRegistry: "https://registry.npmjs.org/"  # Default npm registry URL
+  # Optional: Set if behind proxy (not needed for servers outside Iran)
+  # httpProxy: ""
+  # httpsProxy: ""
+  # noProxy: ""
+
 imagePullSecrets: []
 
 # Registry secret auto-creation (for private registry)
@@ -39,10 +50,12 @@ podAnnotations:
   prometheus.io/port: "8000"
   prometheus.io/path: "/metrics"
 
+# Running as root for now to avoid permission issues
+# TODO: Switch back to non-root user after permission issues are resolved
 podSecurityContext:
-  runAsNonRoot: true
+  runAsNonRoot: false
-  runAsUser: 1000
+  runAsUser: 0
-  fsGroup: 1000
+  fsGroup: 0
 
 securityContext:
   allowPrivilegeEscalation: false
@@ -93,11 +106,11 @@ ingress:
 
 resources:
   limits:
-    cpu: 1000m
+    cpu: 2
-    memory: 1Gi
+    memory: 2Gi
   requests:
-    cpu: 250m
+    cpu: 500m
-    memory: 512Mi
+    memory: 1Gi
 
 autoscaling:
   enabled: true
@@ -123,23 +136,31 @@ affinity:
                   - peikarband
           topologyKey: kubernetes.io/hostname
 
-livenessProbe:
+# livenessProbe:
-  httpGet:
+#   httpGet:
-    path: /ping
+#     path: /ping
-    port: 8000
+#     port: 8000
-  initialDelaySeconds: 30
+#     scheme: HTTP
-  periodSeconds: 10
+#   initialDelaySeconds: 50
-  timeoutSeconds: 5
+#   periodSeconds: 10
-  failureThreshold: 3
+#   timeoutSeconds: 5
+#   failureThreshold: 3
 
-readinessProbe:
+# readinessProbe:
-  httpGet:
+#   httpGet:
-    path: /ping
+#     path: /ping
-    port: 8000
+#     port: 8000
-  initialDelaySeconds: 10
+#     scheme: HTTP
-  periodSeconds: 5
+#   initialDelaySeconds: 60
-  timeoutSeconds: 3
+#   periodSeconds: 5
-  failureThreshold: 3
+#   timeoutSeconds: 3
+#   failureThreshold: 3
+
+# Container command and args
+# If command is set, it will override the Dockerfile CMD
+# If args is set, it will be appended to the command
+command: []  # Leave empty to use Dockerfile CMD, or set to override: ["/usr/local/bin/entrypoint.sh"]
+args: []     # Leave empty to use Dockerfile CMD args, or set: ["run", "--env", "prod"]
 
 env:
   - name: REFLEX_ENV
@@ -209,6 +230,12 @@ networkPolicy:
       - protocol: TCP
         port: 3000
   egress:
+    # Allow DNS resolution (required for all external connections)
+    - to: []
+      ports:
+      - protocol: UDP
+        port: 53    # DNS
+    # Allow internal cluster traffic (PostgreSQL, Redis, etc.)
     - to:
       - namespaceSelector: {}
       ports:
@@ -216,12 +243,14 @@ networkPolicy:
         port: 5432  # PostgreSQL
       - protocol: TCP
         port: 6379  # Redis
+    # Allow external internet access (npm registry, APIs, etc.)
+    # Empty 'to' selector means all destinations (including external)
+    - to: []
+      ports:
       - protocol: TCP
-        port: 443   # HTTPS
+        port: 443   # HTTPS (npm registry, APIs, etc.)
       - protocol: TCP
         port: 80    # HTTP
-      - protocol: UDP
-        port: 53    # DNS
 
 monitoring:
   serviceMonitor:

peikarband/.gitignore

@@ -0,0 +1,6 @@
+assets/external/
+*.py[cod]
+.states
+__pycache__/
+.web
+*.db

peikarband/__init__.py

@@ -1,86 +0,0 @@
-"""Peikarband Landing Application Package.
-
-This package exports the Reflex app instance.
-The peikarband.peikarband submodule is provided by peikarband/peikarband/__init__.py
-"""
-
-import sys
-import os
-import json
-
-# #region agent log
-_log_path = "/home/ehsan.asadi@zoodfood.ir/Projects/my/business/peikarband/landing/.cursor/debug.log"
-try:
-    with open(_log_path, "a") as f:
-        f.write(json.dumps({"sessionId":"debug-session","runId":"run1","hypothesisId":"A","location":"peikarband/__init__.py:10","message":"peikarband/__init__.py started","data":{"__file__":__file__,"cwd":os.getcwd(),"pythonpath":os.getenv("PYTHONPATH","")},"timestamp":int(os.path.getmtime(__file__)*1000) if os.path.exists(__file__) else 0})+"\n")
-except: pass
-# #endregion
-
-# Register peikarband.peikarband submodule in sys.modules
-# This is necessary when running from /app/peikarband directory
-# We need to find peikarband/peikarband/__init__.py relative to this __init__.py file
-try:
-    import importlib.util
-    # Get the directory containing this __init__.py file
-    # __file__ might be peikarband/__init__.py or peikarband/./peikarband/__init__.py
-    _this_dir = os.path.dirname(os.path.abspath(__file__))
-    
-    # If we're in peikarband/peikarband/__init__.py, go up one level
-    # If we're in peikarband/__init__.py, use current directory
-    if os.path.basename(_this_dir) == 'peikarband':
-        # Check if parent is also peikarband (we're in peikarband/peikarband/__init__.py)
-        _parent_dir = os.path.dirname(_this_dir)
-        if os.path.basename(_parent_dir) == 'peikarband':
-            # We're in peikarband/peikarband/__init__.py, use parent
-            _peikarband_dir = _parent_dir
-        else:
-            # We're in peikarband/__init__.py, use current directory
-            _peikarband_dir = _this_dir
-    else:
-        # Fallback: use current directory
-        _peikarband_dir = os.getcwd()
-    
-    # Look for peikarband/peikarband/__init__.py
-    _peikarband_submodule_path = os.path.join(_peikarband_dir, 'peikarband', '__init__.py')
-    
-    # #region agent log
-    try:
-        with open(_log_path, "a") as f:
-            f.write(json.dumps({"sessionId":"debug-session","runId":"run1","hypothesisId":"A","location":"peikarband/__init__.py:45","message":"Trying to register peikarband.peikarband","data":{"_peikarband_dir":_peikarband_dir,"_peikarband_submodule_path":_peikarband_submodule_path,"exists":os.path.exists(_peikarband_submodule_path)},"timestamp":int(os.path.getmtime(__file__)*1000) if os.path.exists(__file__) else 0})+"\n")
-    except: pass
-    # #endregion
-    
-    if os.path.exists(_peikarband_submodule_path):
-        _spec = importlib.util.spec_from_file_location("peikarband.peikarband", _peikarband_submodule_path)
-        if _spec and _spec.loader:
-            _peikarband_module = importlib.util.module_from_spec(_spec)
-            # Register in sys.modules BEFORE exec_module
-            sys.modules["peikarband.peikarband"] = _peikarband_module
-            
-            # #region agent log
-            try:
-                with open(_log_path, "a") as f:
-                    f.write(json.dumps({"sessionId":"debug-session","runId":"run1","hypothesisId":"A","location":"peikarband/__init__.py:55","message":"Before exec_module","data":{"registered":"peikarband.peikarband" in sys.modules},"timestamp":int(os.path.getmtime(__file__)*1000) if os.path.exists(__file__) else 0})+"\n")
-            except: pass
-            # #endregion
-            
-            _spec.loader.exec_module(_peikarband_module)
-            
-            # #region agent log
-            try:
-                with open(_log_path, "a") as f:
-                    f.write(json.dumps({"sessionId":"debug-session","runId":"run1","hypothesisId":"A","location":"peikarband/__init__.py:60","message":"After exec_module","data":{"has_app":hasattr(_peikarband_module,"app"),"in_sys_modules":"peikarband.peikarband" in sys.modules},"timestamp":int(os.path.getmtime(__file__)*1000) if os.path.exists(__file__) else 0})+"\n")
-            except: pass
-            # #endregion
-except Exception as e:
-    # #region agent log
-    try:
-        with open(_log_path, "a") as f:
-            f.write(json.dumps({"sessionId":"debug-session","runId":"run1","hypothesisId":"A","location":"peikarband/__init__.py:65","message":"Exception during registration","data":{"error":str(e),"error_type":type(e).__name__},"timestamp":int(os.path.getmtime(__file__)*1000) if os.path.exists(__file__) else 0})+"\n")
-    except: pass
-    # #endregion
-    # Silently fail - if we can't register it, Python will try to import it normally
-    pass
-
-__all__ = []
-

peikarband/config/reflex.config.py

@@ -1,26 +0,0 @@
-"""Reflex configuration file.
-
-This file configures the Reflex application settings.
-"""
-
-import os
-import reflex as rx
-
-# Environment-aware configuration
-API_URL = os.getenv("API_URL", "http://localhost:8000")
-FRONTEND_PORT = int(os.getenv("FRONTEND_PORT", "3000"))
-BACKEND_PORT = int(os.getenv("BACKEND_PORT", "8000"))
-DB_URL = os.getenv("DATABASE_URL", "sqlite:///reflex.db")
-
-config = rx.Config(
-    app_name="peikarband",
-    api_url=API_URL,
-    frontend_port=FRONTEND_PORT,
-    backend_port=BACKEND_PORT,
-    db_url=DB_URL,
-    disable_plugins=["reflex.plugins.sitemap.SitemapPlugin"],
-    stylesheets=[
-        "https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700;800;900&display=swap",
-        "https://cdn.jsdelivr.net/gh/rastikerdar/vazirmatn@v33.003/Vazirmatn-font-face.css",
-    ],
-)

peikarband/peikarband/__init__.py

@@ -1,43 +1,8 @@
-"""Peikarband submodule for Reflex compatibility.
+"""Landing page app module.
 
-Reflex expects to find 'app' in peikarband.peikarband when app_name='peikarband'.
+Reflex expects to find 'app' in peikarband.landing when app_name='landing'.
-This submodule provides that structure.
 """
 
-# Import app from parent package's app.py
+from .peikarband import app
-# We use importlib to directly load app.py, which works regardless of working directory
-# This is necessary because when Reflex runs from /app/peikarband, Python cannot
-# find the peikarband package using normal imports
-import importlib.util
-import os
-import sys
-
-# Register this module in sys.modules so Python can find peikarband.peikarband
-# This is critical when running from /app/peikarband directory
-_current_module = sys.modules[__name__]
-_parent_package_name = __name__.rsplit('.', 1)[0]  # 'peikarband' from 'peikarband.peikarband'
-if _parent_package_name not in sys.modules:
-    # If peikarband package is not in sys.modules, we need to create it
-    import types
-    _parent_package = types.ModuleType(_parent_package_name)
-    sys.modules[_parent_package_name] = _parent_package
-    _parent_package.__path__ = [os.path.dirname(os.path.dirname(os.path.abspath(__file__)))]
-    _parent_package.__file__ = os.path.join(_parent_package.__path__[0], '__init__.py')
-
-# Get the parent directory (peikarband/) and load app.py directly
-_parent_dir = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-_app_file = os.path.join(_parent_dir, 'app.py')
-
-# Load app.py as a module
-_spec = importlib.util.spec_from_file_location("peikarband.app", _app_file)
-_app_module = importlib.util.module_from_spec(_spec)
-
-# Register the module in sys.modules so it can be imported elsewhere
-sys.modules["peikarband.app"] = _app_module
-_spec.loader.exec_module(_app_module)
-
-# Get the app from the loaded module
-app = _app_module.app
 
 __all__ = ["app"]
-

peikarband/peikarband/peikarband.py

@@ -0,0 +1,58 @@
+"""
+Peikarband Application Entry Point
+
+This is the main application file that Reflex uses to run the app.
+"""
+
+import reflex as rx
+from src.presentation.web.pages.landing.index import index
+from src.presentation.api.routes.health import (
+    ping_endpoint,
+    health_endpoint,
+    ready_endpoint,
+    live_endpoint,
+)
+
+# Create the app
+app = rx.App()
+
+# Add landing page
+app.add_page(index, route="/")
+
+# Add health check pages (for Kubernetes probes)
+# These return JSON responses for monitoring
+@rx.page(route="/ping")
+def ping():
+    """Basic health check endpoint"""
+    data = ping_endpoint()
+    return rx.box(
+        rx.text(str(data)),
+        style={"whiteSpace": "pre"}
+    )
+
+@rx.page(route="/health")
+def health():
+    """Detailed health check endpoint"""
+    data = health_endpoint()
+    return rx.box(
+        rx.text(str(data)),
+        style={"whiteSpace": "pre"}
+    )
+
+@rx.page(route="/ready")
+def ready():
+    """Readiness probe endpoint"""
+    data = ready_endpoint()
+    return rx.box(
+        rx.text(str(data)),
+        style={"whiteSpace": "pre"}
+    )
+
+@rx.page(route="/live")
+def live():
+    """Liveness probe endpoint"""
+    data = live_endpoint()
+    return rx.box(
+        rx.text(str(data)),
+        style={"whiteSpace": "pre"}
+    )

peikarband/rxconfig.py

@@ -18,6 +18,7 @@ config = rx.Config(
     frontend_port=FRONTEND_PORT,
     backend_port=BACKEND_PORT,
     db_url=DB_URL,
+    state_auto_setters=True,  # Temporary fix for 0.8.9+ deprecation warning
     disable_plugins=["reflex.plugins.sitemap.SitemapPlugin"],
     stylesheets=[
         "https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700;800;900&display=swap",

peikarband/src/presentation/web/pages/landing/index.py

@@ -1131,24 +1131,35 @@ def about_section() -> rx.Component:
                 padding="10px 24px",
                 border_radius="full",
             ),
-            rx.heading("زایای انتخاب پیکربند", size="9", color="white", font_weight="900", letter_spacing="-0.03em", margin_top="16px"),
+            rx.heading(
+                "مزایای انتخاب پیکربند", 
+                size=rx.breakpoints(initial="7", md="8", lg="9"),
+                color="white", 
+                font_weight="900", 
+                letter_spacing="-0.03em", 
+                margin_top="16px",
+                text_align="center",
+            ),
             rx.text(
                 "ارائه‌دهنده معتبر خدمات هاستینگ و زیرساخت ابری در ایران",
                 color="#94A3B8",
-                font_size="21px",
+                font_size=rx.breakpoints(initial="16px", md="18px", lg="20px"),
-                margin_bottom="80px",
+                margin_bottom=rx.breakpoints(initial="40px", md="60px", lg="80px"),
                 font_weight="500",
+                text_align="center",
             ),
-            rx.hstack(
+            rx.flex(
                 about_card("zap", "سرعت فوق‌العاده", "سرورهای بهینه‌شده با SSD NVMe و CDN جهانی برای بارگذاری آنی", "linear-gradient(135deg, #1B4B7F, #4F46E5)", "rgba(27, 75, 127, 0.5)"),
                 about_card("clock", "پشتیبانی 24/7", "تیم پشتیبانی حرفه‌ای و با تجربه، آماده کمک در هر لحظه", "linear-gradient(135deg, #4DB8C4, #7C3AED)", "rgba(77, 184, 196, 0.5)"),
                 about_card("shield-check", "امنیت پیشرفته", "SSL رایگان، بکاپ اتوماتیک روزانه و محافظت DDoS", "linear-gradient(135deg, #6DD7E5, #9333EA)", "rgba(109, 215, 229, 0.5)"),
-                spacing="9",
+                direction=rx.breakpoints(initial="column", lg="row"),
+                spacing=rx.breakpoints(initial="6", md="7", lg="9"),
                 width="100%",
+                align="stretch",
             ),
             max_width="1500px",
             margin="0 auto",
-            padding="140px 8%",
+            padding=rx.breakpoints(initial="80px 5%", md="110px 6%", lg="140px 8%"),
         ),
         background="linear-gradient(180deg, rgba(10, 18, 35, 0.98) 0%, rgba(5, 10, 20, 1) 100%)",
         width="100%",
@@ -1207,13 +1218,22 @@ def services_section() -> rx.Component:
                 padding="10px 24px",
                 border_radius="full",
             ),
-            rx.heading("همه چیز برای کسب‌وکار آنلاین شما", size="9", color="white", font_weight="900", letter_spacing="-0.03em", margin_top="16px"),
+            rx.heading(
+                "همه چیز برای کسب‌وکار آنلاین شما", 
+                size=rx.breakpoints(initial="7", md="8", lg="9"),
+                color="white", 
+                font_weight="900", 
+                letter_spacing="-0.03em", 
+                margin_top="16px",
+                text_align="center",
+            ),
             rx.text(
                 "از استارتاپ تا شرکت‌های بزرگ، راهکار مناسب برای هر کسب‌وکاری",
                 color="#94A3B8",
-                font_size="21px",
+                font_size=rx.breakpoints(initial="16px", md="18px", lg="20px"),
-                margin_bottom="80px",
+                margin_bottom=rx.breakpoints(initial="40px", md="60px", lg="80px"),
                 font_weight="500",
+                text_align="center",
             ),
             rx.grid(
                 service_card("وردپرس کلود", "کلود اختصاصی وردپرس با مدیریت هوشمند و پیشرفته", "cloud", ["نصب خودکار وردپرس", "مدیریت چند سایتی", "بکاپ اتوماتیک", "SSL رایگان", "بهینه‌سازی خودکار"], "#1B4B7F"),
@@ -1222,13 +1242,13 @@ def services_section() -> rx.Component:
                 service_card("DevOps حرفه‌ای", "اتوماسیون و مدیریت زیرساخت کلود", "code", ["Kubernetes", "Docker", "CI/CD Pipeline", "Infrastructure as Code"], "#1B4B7F"),
                 service_card("فروش دامین", "ثبت دامین‌های بین‌المللی و ایرانی", "tag", [".com, .ir, .net", "قیمت رقابتی", "تحویل فوری", "مدیریت DNS"], "#4DB8C4"),
                 service_card("پشتیبانی 24/7", "پشتیبانی تخصصی وردپرس و سرور", "headset", ["تیم متخصص", "پاسخگویی سریع", "مشاوره رایگان", "پشتیبانی فارسی"], "#6DD7E5"),
-                columns="3",
+                columns=rx.breakpoints(initial="1", sm="1", md="2", lg="3"),
-                spacing="9",
+                spacing=rx.breakpoints(initial="6", md="7", lg="9"),
                 width="100%",
             ),
             max_width="1500px",
             margin="0 auto",
-            padding="160px 8%",
+            padding=rx.breakpoints(initial="80px 5%", md="120px 6%", lg="160px 8%"),
         ),
         width="100%",
         id="services",
@@ -1690,23 +1710,31 @@ def footer() -> rx.Component:
     return rx.box(
         rx.vstack(
             rx.divider(background="rgba(27, 75, 127, 0.4)", margin_y="10"),
-            rx.hstack(
+            rx.flex(
                 rx.vstack(
                     rx.hstack(
                         rx.icon("cloud", size=32, color="#4DB8C4"),
-                        rx.heading("پیکربند", size="7", color="#4DB8C4", font_weight="900"),
+                        rx.heading(
+                            "پیکربند", 
+                            size=rx.breakpoints(initial="6", md="7"),
+                            color="#4DB8C4", 
+                            font_weight="900"
+                        ),
                         spacing="3",
+                        justify="center",
                     ),
                     rx.text(
                         "ارائه‌دهنده خدمات هاستینگ، دامین و زیرساخت ابری با کیفیت بالا و پشتیبانی 24/7",
                         color="#94A3B8",
-                        font_size="17px",
+                        font_size=rx.breakpoints(initial="15px", md="17px"),
                         line_height="1.7",
                         max_width="450px",
                         font_weight="500",
+                        text_align=rx.breakpoints(initial="center", lg="start"),
                     ),
                     spacing="5",
-                    align="start",
+                    align=rx.breakpoints(initial="center", lg="start"),
+                    width=rx.breakpoints(initial="100%", lg="auto"),
                 ),
                 rx.spacer(),
                 rx.hstack(
@@ -1762,22 +1790,27 @@ def footer() -> rx.Component:
                         color="#94A3B8",
                     ),
                     spacing="6",
+                    justify="center",
                 ),
+                direction=rx.breakpoints(initial="column", lg="row"),
                 width="100%",
                 align="center",
-                padding_y="40px",
+                justify=rx.breakpoints(initial="center", lg="between"),
+                spacing=rx.breakpoints(initial="8", lg="0"),
+                padding_y=rx.breakpoints(initial="30px", md="40px"),
             ),
             rx.divider(background="rgba(27, 75, 127, 0.3)", margin_y="8"),
             rx.text(
                 "© ۱۴۰۳ پیکربند. تمامی حقوق محفوظ است.",
                 color="#64748B",
-                font_size="16px",
+                font_size=rx.breakpoints(initial="14px", md="16px"),
                 font_weight="600",
                 padding_bottom="10",
+                text_align="center",
             ),
             max_width="1500px",
             margin="0 auto",
-            padding="60px 8% 40px",
+            padding=rx.breakpoints(initial="40px 5% 30px", md="50px 6% 35px", lg="60px 8% 40px"),
         ),
         width="100%",
         background="linear-gradient(180deg, rgba(10, 18, 35, 0.98) 0%, rgba(5, 10, 20, 1) 100%)",