Feature/docs - #289
Closed
rayenmabrouk wants to merge 19 commits into
Closed
Feature/docs#289rayenmabrouk wants to merge 19 commits into
rayenmabrouk wants to merge 19 commits into
Conversation
- Add Dockerfile.hardened: 3-stage build (node staticfiles, python build, slim runtime) - Non-root user (dpaste), HEALTHCHECK, exec-form CMD, runtime deps only - Hardened image: 85MB content vs 463MB upstream (82% reduction) - Add .gitattributes to enforce LF line endings for Docker compatibility - Fix manage.py line endings (CRLF to LF) for Linux container shebang Infrastructure/containerization: Rayen Mabrouk Original application: dpaste (MIT License, DarrenOfficial)
- .dockerignore excludes .git, node_modules, tests, docs, terraform from build context - docker-compose.yml uses Dockerfile.hardened with SQLite volume and dev settings - Verified: docker compose up serves dpaste on port 8000 with HTTP 200 Infrastructure/containerization: Rayen Mabrouk Original application: dpaste (MIT License, DarrenOfficial)
- pytest runs full dpaste test suite (51 tests) - ruff linter on dpaste code (non-blocking, upstream code) - Docker build of hardened image in CI - Trivy vulnerability scan fails on CRITICAL/HIGH findings Infrastructure/CI: Rayen Mabrouk Original application: dpaste (MIT License, DarrenOfficial)
- Remove libxml2 from runtime (eliminates 1 CRITICAL + 8 HIGH CVEs) - Clean node_modules from build stage (eliminates 5 HIGH Node.js CVEs) - Add --ignore-unfixed to Trivy to skip unpatched OS vulnerabilities - Add .trivyignore for vendored Python build-tool CVEs - Disable upstream docker.yml workflow (requires Docker Hub credentials we don't use)
Networking: VPC, public subnet, IGW, route table, security group (SSH restricted to admin IP, app port 8000). Compute: ECR repo with scan-on-push, EC2 t3.micro on Amazon Linux 2023 with IMDSv2 enforced, encrypted gp3 root volume, Docker bootstrap via user_data, Academy LabInstanceProfile. Monitoring: CloudWatch log group (7-day retention), CPU and status-check alarms.
Add modular Terraform infrastructure for AWS deployment
SECRET_KEY generated by Terraform (random_password) and stored as an SSM SecureString; read by the instance role at deploy time. scripts/deploy.sh: IMDSv2 metadata, ECR pull via instance role, root-only env file, awslogs driver to CloudWatch, health check with automatic rollback, persistent /data volume. Caddy reverse proxy with automatic Let's Encrypt TLS on an sslip.io hostname. Security group now exposes 80/443 only; port 8000 bound to localhost. .gitattributes: enforce LF for Terraform files to prevent user_data hash drift.
Deploy dpaste to AWS over HTTPS
…ocking scripts/bootstrap-tfstate.ps1 creates the state bucket outside Terraform (idempotent): versioning, SSE-S3 encryption, public access block, TLS-only bucket policy. backend.tf enables the S3 backend with use_lockfile (S3-native locking, no DynamoDB). required_version raised to >= 1.10 for native locking. State migrated with terraform init -migrate-state; plan shows no changes.
Terraform remote state in S3
… test Deploys through SSM Run Command (no SSH keys in GitHub, port 22 not needed). The job ships the commit's deploy.sh with the command. Concurrency group prevents overlapping deploys; production environment restricted to master. OIDC tested first and blocked in AWS Academy (iam:CreateOpenIDConnectProvider denied); uses session credentials refreshed each lab session by scripts/refresh-github-aws-secrets.ps1.
CD pipeline: ECR + SSM deploy
PR: fmt, validate, Checkov, plan (run summary). Merge: plan, then manual approval via the infrastructure environment, then apply of the exact saved plan. Checkov triage: fixed ECR tag immutability, locked the VPC default security group, enabled EC2 detailed monitoring; remaining findings skipped inline with justifications. Converted .tf files to ASCII (a malformed em-dash made Checkov skip 3 files). CD: skip push when the tag already exists (immutable tags).
Terraform pipeline: Checkov gate + approval-gated apply
…cript systemd timer runs dpaste's cleanup_snippets daily (Amazon Linux 2023 has no cron). ECR credential helper replaces docker login so no registry token is stored on disk; falls back to docker login if the package is unavailable.
Ops: snippet cleanup timer + ECR credential helper
…loudWatch panels Blackbox exporter probes the local container and the live AWS deployment (availability, latency, HTTP status, TLS expiry, request phases) without changing dpaste code. Prometheus evaluates DpasteDown, DpasteSlowResponse and TLSCertificateExpiringSoon. Grafana datasources and dashboard are provisioned from files; production EC2 CPU and network come from CloudWatch. cAdvisor evaluated and removed: incompatible with Docker Desktop's containerd image store (cannot resolve container layer IDs).
Monitoring: Prometheus + Grafana (black-box probes + CloudWatch)
Original dpaste README moved to docs/upstream-dpaste-README.md. README separates upstream application code from the infrastructure work, lists verified behaviour, trade-offs and AI-assistance disclosure. Screenshots renamed chronologically; admin IP redacted.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.