Add VPS deployment infrastructure with network isolation - #160
Merged
Merged
Conversation
… DEV/PROD
Implementa a proposta dos analistas BTV com isolamento de rede via Docker Compose
declarativo, substituindo o uso imperativo de pkill + python3 -m http.server.
Arquivos criados:
- ops/docker-compose.vps.yml: orquestração VPS com duas redes isoladas
- btv-prod-net (bridge pública): docs-prod, demo-prod, nginx-prod via nginx:alpine
- btv-dev-net (internal: true): docs-dev, demo-dev no loopback 127.0.0.1
- Rawls Blind Testing: internal: true remove o gateway padrão no kernel Docker
- Levinas: portas DEV vinculadas estritamente a 127.0.0.1 (túnel SSH obrigatório)
- Fail-Secure: restart: on-failure:3 nos containers DEV (desiste em vez de loop)
- Logging json-file com max-size/max-file para VPS com disco limitado
- ops/Dockerfile.python-vps: servidor HTTP estático minimalista para VPS DEV
- Base python:3.11-slim (~150MB vs ~5GB do CUDA) — sem GPU, sem governance API
- Serve arquivos estáticos de /app via python3 -m http.server (stdlib pura)
- Usuário não-root btv (mesma convenção de segurança dos outros Dockerfiles)
- Projetado para hot-reload: volume /opt/btv/{docs,demo}:/app:rw
Arquivos modificados:
- .github/workflows/lint-guards.yml: adiciona step de validação de sintaxe do
docker-compose.vps.yml (docker compose config --quiet) em todo push/PR
- .github/workflows/e2e.yml: adiciona ops/Dockerfile.python-vps nos path triggers
de push e pull_request para consistência com os outros Dockerfiles monitorados
Referências arquiteturais: ADR-009 (Monolito Modular), EthicalVerdict ALLOW
https://claude.ai/code/session_01PMXfaS3wkNEhcMbc784dSo
1. CRÍTICO — substitui deploy.resources por mem_limit/cpus (Swarm→standalone) deploy.resources.limits é diretiva de Docker Swarm e silenciosamente ignorada em Docker Compose standalone (VPS simples). Limites de memória e CPU não eram aplicados em runtime apesar de declarados. Corrigido com mem_limit e cpus no nível do serviço (Compose standalone) em todos os 4 serviços. 2. RACE CONDITION — adiciona healthcheck em docs-prod e demo-prod nginx-prod dependia de docs-prod/demo-prod apenas por 'started', não 'healthy'. Janela de race condition no boot: nginx tentava proxy para backends não prontos. Healthcheck via wget (incluso em nginx:alpine) com interval 10s / retries 3. depends_on atualizado para condition: service_healthy. 3. ARMADILHA OPERACIONAL — documenta conflito Nginx host/container em nginx-prod nginx-prod faz bind nas portas 80/443 e monta /etc/nginx/sites-enabled do host. Se o Nginx do host estiver ativo, ocorre conflito de porta silencioso no boot. Adicionado comentário PRÉ-REQUISITO com comandos de desativação do host-nginx. 4. ALLOW COM RESSALVA — documenta escopo DEV-only em Dockerfile.python-vps python3 -m http.server não tem TLS, rate limiting, nem autenticação. Comentário adicionado antes do CMD para evitar uso inadvertido em produção. Verificação: docker compose -f ops/docker-compose.vps.yml config --quiet ✅ https://claude.ai/code/session_01PMXfaS3wkNEhcMbc784dSo
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR introduces production-ready VPS deployment infrastructure with strict network isolation between development and production environments, implementing the "Separation of Powers" architectural principle via Docker networking primitives.
Key Changes
New VPS Docker Compose configuration (
ops/docker-compose.vps.yml):btv-prod-net(public bridge) andbtv-dev-net(internal/blind)docs-prod,demo-prod,nginx-prod) on public bridge network with TLS terminationdocs-dev,demo-dev) on kernel-level isolated internal network, accessible only via SSH tunneling127.0.0.1for dev services (Levinas principle)New lightweight VPS Dockerfile (
ops/Dockerfile.python-vps):http.servermodule (no external dependencies)btv) for securityCI/CD integration updates:
Notable Implementation Details
internal: trueflag, not firewall rules—immune to misconfigurationon-failure:3) prevents infinite restart loopshttps://claude.ai/code/session_01PMXfaS3wkNEhcMbc784dSo