feat(deployment): updation - #18
Merged
Merged
Conversation
…-production. Consolidate Docker Compose under deployment/compose and add Kustomize manifests under deployment/k8s for the Flycatch cluster, with environment-wide noindex controls so the new development environment is not SEO-indexed. Co-authored-by: Cursor <cursoragent@cursor.com>
Without the import, /health returned 500 and readiness probes failed. Co-authored-by: Cursor <cursoragent@cursor.com>
Astro/Vite preview was returning 403 for flycatch-website-dev.k3s.flycatchtech.in. Co-authored-by: Cursor <cursoragent@cursor.com>
Vite preview reads the config at runtime; without it, Ingress hostnames were blocked. Co-authored-by: Cursor <cursoragent@cursor.com>
…view. Astro preview host checks blocked the k8s Ingress hostname; serve avoids that. Co-authored-by: Cursor <cursoragent@cursor.com>
Implemented security headers in the Caddyfile, including HSTS, CSP, and other policies for both public and admin routes. Updated README to include instructions for verifying these headers via curl commands.
PR Summary by QodoAdd k3s deployment manifests and non-production SEO safeguards
AI Description
Diagram
High-Level Assessment
Files changed (40)
|
Code Review by Qodo
1. Relocated environment file ignored
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
| 3. Backend migrations: `docker compose -f deployment/docker-compose.yml exec backend alembic upgrade head` | ||
| 4. Seed records: `docker compose -f deployment/docker-compose.yml exec backend flycatch-seed-records` | ||
| 1. `cp deployment/compose/.env.example deployment/compose/.env` and set `JWT_SECRET` (and other `change-me` values) to long random secrets. Do not commit `deployment/compose/.env`. | ||
| 2. `docker compose -f deployment/compose/docker-compose.yml up -d --build` |
There was a problem hiding this comment.
1. Relocated environment file ignored 🐞 Bug ≡ Correctness
The updated onboarding command creates deployment/compose/.env but invokes Compose from the repository root without --env-file, so Compose interpolation can leave required Postgres, MinIO, and backend variables empty. This can prevent the documented stack from starting, while the root README already demonstrates the required invocation.
Agent Prompt
## Issue description
Root-level Compose commands do not explicitly load the relocated `deployment/compose/.env`, causing required variable interpolation to use missing or empty values.
## Issue Context
The root README uses the correct `--env-file deployment/compose/.env` option, but onboarding and specification commands omit it.
## Fix Focus Areas
- docs/onboarding.md[7-27]
- specs/001-website-foundation/quickstart.md[18-24]
- specs/001-website-foundation/quickstart.md[98-98]
- specs/002-auth-rbac/quickstart.md[17-20]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+75
to
+78
| kustomize edit set image \ | ||
| "${BACKEND_IMAGE}=${BACKEND_IMAGE}:${TAG}" \ | ||
| "${FRONTEND_IMAGE}=${FRONTEND_IMAGE}:${TAG}" \ | ||
| "${ADMIN_FE_IMAGE}=${ADMIN_FE_IMAGE}:${TAG}" |
There was a problem hiding this comment.
2. Registry overrides skip tag updates 🐞 Bug ≡ Correctness
When REGISTRY, BACKEND_IMAGE, FRONTEND_IMAGE, or ADMIN_FE_IMAGE is overridden, `kustomize edit set image` searches for the overridden name rather than the fixed image name present in the base manifests. The script therefore pushes the custom images but leaves the overlay pointing to the original registry images.
Agent Prompt
## Issue description
Image override variables are incorrectly used as both Kustomize's existing image key and replacement image, so non-default registry or image values do not match the base manifests.
## Issue Context
The base deployments contain fixed canonical Harbor image names. Kustomize must match those canonical names and replace them with the configured override plus tag.
## Fix Focus Areas
- deployment/k8s/scripts/deploy-dev.sh[9-15]
- deployment/k8s/scripts/deploy-dev.sh[72-79]
- deployment/k8s/base/backend-deployment.yaml[23-25]
- deployment/k8s/base/frontend-deployment.yaml[23-25]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
|
|
||
| 1. Copy or update `deployment/.env` with `jwt_secret` (long random) in addition to existing Backend secrets. | ||
| 2. Start services: `docker compose -f deployment/docker-compose.yml up -d --build` (see [README.md](../../README.md#quick-start-docker-compose)). | ||
| 1. Copy or update `deployment/compose/.env` with `jwt_secret` (long random) in addition to existing Backend secrets. |
There was a problem hiding this comment.
3. Jwt secret documented incorrectly 🐞 Bug ⛨ Security
The updated quickstart tells operators to set lowercase jwt_secret, but Compose interpolates and
explicitly supplies uppercase ${JWT_SECRET} to the backend. Following the instruction leaves that
value unset and overrides the intended JWT secret with an empty value in the container.
Agent Prompt
## Issue description
Correct the Docker Compose setup instruction to name the environment variable that Compose actually passes to the Backend.
## Issue Context
The compose file explicitly maps `JWT_SECRET` using uppercase interpolation, and the environment template defines the same uppercase variable. Lowercase `jwt_secret` does not satisfy that interpolation.
## Fix Focus Areas
- specs/002-auth-rbac/quickstart.md[17-17]
- deployment/compose/docker-compose.yml[43-46]
- deployment/compose/.env.example[26-32]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Reviewer
@athulrajtflycatchtech