cesnimda
0954876295
Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.
2.4 KiB
deployment
Production runs the frontend/nginx, ASP.NET API, AI sidecar, and configured database through Docker
Compose. The backend is not published directly; nginx proxies /api. deploy/deploy.sh validates
configuration, takes and verifies a provider-appropriate backup before replacement, builds/restarts the
stack, and performs health checks. The protected production workflow explicitly rebuilds the AI sidecar
so application and AI contracts always come from the same tested commit.
Production commands explicitly select docker-compose.yml. The operator-owned reverse proxy still
targets frontend/nginx through compatibility port 3000. Whether the deployed firewall blocks direct
external access requires host verification; the repository cannot prove it. Production nginx now
requires INGRESS_PROXY_CIDRS, an explicit allowlist of the observed socket peers belonging to
Traefik. Canonical Host and forwarded headers alone do not grant access. Traefik must match the canonical
Host, terminate TLS and replace forwarding headers with one client IP and https. Nginx uses its
realip module only for those peers, emits one normalized IP and canonical scheme/Host to the backend,
and rejects untrusted application requests and multi-hop chains. Empty peer configuration fails startup
and the deployment preflight. The default-host /health remains a local/container liveness exception.
This repository change still awaits real nginx/container and production topology verification; see
B06 evidence and exact operator procedure.
Nginx reaches the backend over dedicated WEB_PROXY_SUBNET; the backend trusts that CIDR for one hop,
ignores forwarded Host and validates the canonical application Host in Production. Public URLs and
cookie security use APP_PUBLIC_BASE_URL. Production CORS defaults to that same origin and rejects
noncanonical overrides. Local development explicitly adds
docker-compose.dev.yml, which publishes ports 3000/5202, uses the localhost origin, and disables
forwarded-header trust with nginx's INGRESS_MODE=direct.
Each service rotates local Docker logs at 10 MB and retains three files. Add a central sink only if cross-host search or longer retention becomes necessary.
Use deploy/README.md, deploy/first-production-deployment.md, and
docs/deployment/backup-restore.md as the operational runbooks.