f369153149
[AZ-552] [AZ-553] [AZ-554] [AZ-555] Cycle-2 hotfix: deploy/infra chain
...
Batch 5 (cycle 2 hotfix sprint, batch 1 of 2). 6 story points under epic
AZ-530. Addresses 2 Critical + 2 High deploy-blocking findings from
security_report_cycle2.md (F-INFRA-1..F-INFRA-4).
AZ-552 — drop_jwt_secret_deploy_preflight (1 pt, F-INFRA-1 Critical)
scripts/start-services.sh swaps obsolete JwtConfig__Secret preflight
for the cycle-2 trio (KeysFolder + ActiveKid + DataProtection.KeysFolder).
.env.example, env/api/env.ps1, _docs/04_deploy/* updated to match. Repo
scan in scripts/ and .env.example returns 0 offenders.
AZ-553 — bind_mount_es256_keys (2 pts, F-INFRA-2 Critical)
start-services.sh bind-mounts DEPLOY_HOST_JWT_KEYS_DIR read-only at
/etc/azaion/jwt-keys; preflight fails fast on a missing or empty host
directory with operator-actionable error messages.
AZ-554 — persist_dataprotection_keys (2 pts, F-INFRA-3 High)
Program.cs DataProtection wiring now fails fast in Production when
KeysFolder is unset OR not probe-writable. start-services.sh bind-mounts
DEPLOY_HOST_DP_KEYS_DIR read-write at /var/lib/azaion/dp-keys.
Development behaviour unchanged (ephemeral default).
AZ-555 — secrets_readme_es256_rewrite (1 pt, F-INFRA-4 High)
secrets/README.md schema fully rewritten; new "Host-side directories"
subsection with bind-mount table + ownership/permission guidance.
Cycle-1 JwtConfig__Secret removed from live schema (one prose
deprecation paragraph retained).
Adjacent hygiene
module-layout.md "Owns" extended to include scripts/, secrets/, env/,
.env.example (gap from Step 9 new-task layout-delta).
Tests
e2e/Azaion.E2E/Tests/Cycle2HotfixDeployTests.cs — 19 facts (8 exec,
11 Skip with rationale per AZ-537/AZ-538 precedent). Skipped tests
cover preflight/restart/Production-only paths verified at deploy gate.
Build: 0W 0E across Azaion.AdminApi + Azaion.E2E.
Test run deferred to autodev Step 11 (Run Tests).
Tracker transition deferred to next batch (MCP availability unverified
in this session — Leftovers pattern).
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-05-14 09:35:57 +03:00
c7b297de83
refactor: remove deploy.cmd and update Dockerfile for health checks
...
ci/woodpecker/push/01-test Pipeline failed
ci/woodpecker/push/02-build-push unknown status
- Deleted the deploy.cmd script as it was no longer needed.
- Updated Dockerfile to include curl for health checks and added a non-root user for improved security.
- Modified health check command to use curl for better reliability.
- Adjusted docker-compose.test.yml to reflect changes in health check configuration.
- Cleaned up appsettings.json and removed unused configuration properties.
- Removed Resource entity and related requests from the codebase as part of the architectural shift.
- Updated documentation to reflect the removal of hardware binding and related endpoints.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-05-13 08:47:21 +03:00
Oleksandr Bezdieniezhnykh