cesnimda
0954876295
Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.
33 lines
2.4 KiB
Markdown
33 lines
2.4 KiB
Markdown
# deployment
|
|
|
|
Production runs the frontend/nginx, ASP.NET API, AI sidecar, and configured database through Docker
|
|
Compose. The backend is not published directly; nginx proxies `/api`. `deploy/deploy.sh` validates
|
|
configuration, takes and verifies a provider-appropriate backup before replacement, builds/restarts the
|
|
stack, and performs health checks. The protected production workflow explicitly rebuilds the AI sidecar
|
|
so application and AI contracts always come from the same tested commit.
|
|
|
|
Production commands explicitly select `docker-compose.yml`. The operator-owned reverse proxy still
|
|
targets frontend/nginx through compatibility port 3000. Whether the deployed firewall blocks direct
|
|
external access requires host verification; the repository cannot prove it. Production nginx now
|
|
requires `INGRESS_PROXY_CIDRS`, an explicit allowlist of the **observed socket peers** belonging to
|
|
Traefik. Canonical Host and forwarded headers alone do not grant access. Traefik must match the canonical
|
|
Host, terminate TLS and replace forwarding headers with one client IP and `https`. Nginx uses its
|
|
realip module only for those peers, emits one normalized IP and canonical scheme/Host to the backend,
|
|
and rejects untrusted application requests and multi-hop chains. Empty peer configuration fails startup
|
|
and the deployment preflight. The default-host `/health` remains a local/container liveness exception.
|
|
This repository change still awaits real nginx/container and production topology verification; see
|
|
[B06 evidence and exact operator procedure](../audits/2026-09-07/validation/b06-completion.md).
|
|
|
|
Nginx reaches the backend over dedicated `WEB_PROXY_SUBNET`; the backend trusts that CIDR for one hop,
|
|
ignores forwarded Host and validates the canonical application Host in Production. Public URLs and
|
|
cookie security use `APP_PUBLIC_BASE_URL`. Production CORS defaults to that same origin and rejects
|
|
noncanonical overrides. Local development explicitly adds
|
|
`docker-compose.dev.yml`, which publishes ports 3000/5202, uses the localhost origin, and disables
|
|
forwarded-header trust with nginx's `INGRESS_MODE=direct`.
|
|
|
|
Each service rotates local Docker logs at 10 MB and retains three files. Add a central sink only if
|
|
cross-host search or longer retention becomes necessary.
|
|
|
|
Use `deploy/README.md`, `deploy/first-production-deployment.md`, and
|
|
`docs/deployment/backup-restore.md` as the operational runbooks.
|