mirror of
https://github.com/Dvorinka/Primora.git
synced 2026-10-28 07:41:23 +00:00
Tomas DvorakandDevin
55edbf8b56
Security:
- Graceful shutdown: http.Server + signal.NotifyContext, 10s drain,
retention sweeper cancelled before pool close
- Scoped API keys (migration 00006): ingest/read/write/admin enforced in
auth middleware; scope picker + badges in Settings UI; scopeless legacy
keys act as admin. Read-only keys now get 403 on ingest (verified live)
- nginx: baseline security headers on all responses, CSP scoped to SPA;
fixed add_header inheritance shadowing
- better-auth rate limit enabled unconditionally (was gated on NODE_ENV,
which the shipped .env sets to development)
- Mailpit moved to docker-compose.dev.yml; prod compose cannot expose it
- setup.sh generates PRIMORA_ENCRYPTION_KEY
Reliability/ops:
- Retention: per-project retention_{events,audit,webhook}_days
(migration 00007, 0=off) + hourly RetentionSweeper; edit UI in Projects
- GET /api/v1/metrics Prometheus exposition
- compose: healthchecks + restart policies everywhere, dragonfly pinned
to v2.0.0, depends_on service_healthy
- backup.sh/restore.sh (pg_dump -Fc + storage volume); restore verified
against scratch postgres+volume
- .dockerignore: exclude target dirs (build context was 4.7GB)
Correctness/testing:
- DBX transfer endpoint: POST /db-connections/:id/transfer — SQL or Redis
target, 1000-row bound, server-side creds (verified live pg→dragonfly)
- Pagination audit: ListComponents capped at 500 (auto-registers)
- CI: goose up/reset/up job + compose e2e-smoke job (smoke-e2e.sh
verified locally: signup, bootstrap, scoped keys, ingest, metrics)
- k6 load sanity script: 6650 reqs, ~217/s, 0 real failures, p95 221ms
(429s = configured rate limiter working)
Docs: DEPLOYMENT_GUIDE.md, PRODUCTION_READINESS.md; verify script
repaired (stale refs + set -e arithmetic abort). ROADMAP: phase 2 +
phase 6 marked complete.
Authored By: TDvorak <[email protected]>
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
86 lines
3.2 KiB
Markdown
86 lines
3.2 KiB
Markdown
# Primora Production Readiness
|
|
|
|
Status checklist for self-hosted production use. Everything listed under
|
|
"Hardened" is implemented and verified; "Known limits" is the honest
|
|
remainder.
|
|
|
|
## Hardened
|
|
|
|
- **Graceful shutdown** — the backend drains in-flight requests for up to
|
|
10 s on SIGTERM/SIGINT (`internal/app`).
|
|
- **Scoped API keys** — `ingest` / `read` / `write` / `admin`, enforced in
|
|
auth middleware before handlers run. Legacy keys without stored scopes act
|
|
as `admin`.
|
|
- **Brute-force protection** — Better Auth rate limiting is enabled
|
|
unconditionally (3 attempts / 10 s on sign-in, sign-up, password change);
|
|
an IP-level limiter caps `/auth/*` at 60 req/min, and per-identity API
|
|
rate limits apply via `USER_RATE_LIMIT_PER_MINUTE` /
|
|
`API_KEY_RATE_LIMIT_PER_MINUTE` in Dragonfly.
|
|
- **Metrics** — `GET /api/v1/metrics` in Prometheus text format.
|
|
- **Retention** — per-project sweeper for telemetry events, audit log rows,
|
|
and webhook deliveries (`retention_*_days`, 0 = disabled, default 90).
|
|
- **Edge security** — nginx emits `X-Frame-Options`, `X-Content-Type-Options`,
|
|
`Referrer-Policy`, `Permissions-Policy`, and a CSP scoped to the SPA only.
|
|
- **Compose hygiene** — all services have healthchecks and
|
|
`restart: unless-stopped`; Dragonfly is pinned to `v2.0.0`; Mailpit lives
|
|
only in `docker-compose.dev.yml`.
|
|
- **Secrets** — `setup.sh` generates `JWT_SECRET`, `BETTER_AUTH_SECRET`, and
|
|
`PRIMORA_ENCRYPTION_KEY`; credentials and webhook secrets are AES-256
|
|
encrypted at rest.
|
|
- **Release images** — GitHub release builds `linux/amd64` + `linux/arm64`
|
|
via buildx/QEMU.
|
|
- **CI coverage** — Go tests, frontend tests + typecheck, all three Docker
|
|
builds, golangci-lint, migration up/reset/up round-trip, and a compose E2E
|
|
smoke (`scripts/smoke-e2e.sh`).
|
|
- **Backups** — `scripts/backup.sh` / `scripts/restore.sh` cover the database
|
|
(custom-format dump) and the storage volume.
|
|
|
|
## Known limits
|
|
|
|
- **Storage is local filesystem only.** No S3 backend — the
|
|
`backend_storage` volume is the durability boundary.
|
|
- **Single host.** Compose topology is single-node; postgres and dragonfly
|
|
are not clustered. HA is out of scope for v0.x.
|
|
- **No TLS inside the stack.** Terminate at a front proxy (Caddy/Traefik);
|
|
see DEPLOYMENT_GUIDE.md.
|
|
- **Metrics are in-memory counters.** `/api/v1/metrics` covers request
|
|
totals/errors/duration — not per-route histograms or DB pool stats yet.
|
|
- **`/api/v1/metrics` is unauthenticated.** Scrape-only design; block it at
|
|
the edge for public instances (commented rule in `infra/nginx/default.conf`).
|
|
|
|
## systemd timer for backups
|
|
|
|
`/etc/systemd/system/primora-backup.service`:
|
|
|
|
```ini
|
|
[Unit]
|
|
Description=Primora backup
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
WorkingDirectory=/opt/primora
|
|
ExecStart=/opt/primora/scripts/backup.sh
|
|
```
|
|
|
|
`/etc/systemd/system/primora-backup.timer`:
|
|
|
|
```ini
|
|
[Unit]
|
|
Description=Nightly Primora backup
|
|
|
|
[Timer]
|
|
OnCalendar=*-*-* 03:17:00
|
|
Persistent=true
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|
|
```
|
|
|
|
## Verification
|
|
|
|
```bash
|
|
./scripts/verify-production-ready.sh # structural check
|
|
./scripts/smoke-e2e.sh # live E2E against a running stack
|
|
npm run check # typecheck + tests + generated-code drift
|
|
```
|