cesnimda
40 lines
3.1 KiB
Markdown
40 lines
3.1 KiB
Markdown
# SEC-002 ingress and Compose verification
|
|
|
|
Date: 2026-08-02
|
|
Status: `VERIFIED LOCALLY`; operator Traefik and production checks remain.
|
|
|
|
## Implemented boundary
|
|
|
|
- Production automation explicitly selects `docker-compose.yml`; the auto-loaded override was replaced by explicitly selected `docker-compose.dev.yml`.
|
|
- Base Compose publishes no frontend, backend, ai-service, or bundled-Ollama host port. Development adds 3000, 5202, and profile-scoped 11434.
|
|
- Nginx and backend communicate over an internal dedicated CIDR; the backend accepts exactly one forwarded hop only from that CIDR.
|
|
- Nginx derives its application server name from `APP_PUBLIC_BASE_URL`, rejects other Hosts except `/health`, and preserves Traefik's replaced proto/client headers rather than substituting internal HTTP.
|
|
- Deploy preflight requires and validates the canonical origin and dedicated proxy CIDR. CI post-deploy commands use the production Compose file explicitly.
|
|
|
|
## Commands and results
|
|
|
|
| Command/check | Result |
|
|
|---|---|
|
|
| focused `ExternalOriginTests` including proxy config | Pass; 14/14 |
|
|
| full backend Release suite | Pass; 476/476 |
|
|
| frontend `npm run build` | Pass; Next production build and TypeScript |
|
|
| production and dev `docker compose ... config --quiet` | Pass |
|
|
| parsed Compose assertion including `bundled-ollama` | Pass; production ports absent; dev 3000/5202/11434; internal CIDR aligned |
|
|
| normalized `bash -n deploy/deploy.sh` | Pass |
|
|
| `bash -n job-tracker-ui/configure-nginx-origin.sh` | Pass |
|
|
| mounted nginx template `nginx -t` using already-installed local frontend image | Pass |
|
|
| ephemeral origin substitution with canonical host/port then `nginx -t` | Pass |
|
|
| ephemeral substitution with credential-bearing origin | Rejected as expected |
|
|
| `git diff --check` | Pass; line-ending conversion warnings only |
|
|
|
|
No image was pulled and no production or persistent service was changed. Ephemeral Docker validation containers were removed automatically.
|
|
|
|
## Limitations and production gates
|
|
|
|
- No Traefik configuration exists in this repository. Verify its exact `Host()` rule, TLS route, replacement of forwarding headers, selected Docker network, and hostile-Host rejection on the operator host.
|
|
- `WEB_PROXY_SUBNET` must be chosen after production Docker-network inventory; the example value is not a production fact. Deploys may recover a missing value only from the existing Compose `web_proxy` network, preserving the already-running production CIDR without guessing a new one.
|
|
- Host firewall and `docker ps`/published-port state are unverified.
|
|
- The exact `nginx:1.29.8-alpine` base image was not installed locally. Syntax was checked with the existing local nginx frontend image; approved CI must build the pinned Dockerfile.
|
|
- A complete local proxy/browser smoke was not run because rebuilding the pinned container would require an unavailable base image/package access. No browser claim is made.
|
|
- Rollback is a normal application-version rollback plus the previous `.env`; do not reintroduce the deleted auto-loaded override or published production ports. If the new CIDR overlaps, roll back before replacement and select a non-overlapping CIDR.
|