fix(deploy): hardening + doc corrections from 2026-07-04 quality report#158
Open
Anuraj-dev wants to merge 6 commits into
Open
fix(deploy): hardening + doc corrections from 2026-07-04 quality report#158Anuraj-dev wants to merge 6 commits into
Anuraj-dev wants to merge 6 commits into
Conversation
- Correct security-group UDP RTC range 10000-59999 -> 40000-40100 to match .env.example, server config defaults, and e2e constants - Fix project-structure diagram: models are User/Room, not a Meeting model - Add the missing 'cp client/.env.example client/.env' step; client Socket.io has no VITE_SERVER_URL fallback so fresh clones fail to signal without it
- Container healthcheck hits /api/health (the endpoint the deploy workflow already polls) via node's global fetch; no curl/wget in the slim runtime - mem_limit/mem_reservation/cpus ceilings so a runaway process can't starve the box; sized for a small single node and tunable per instance
- Emit HSTS and X-Content-Type-Options once at the TLS edge (with 'always' so the port-80 redirect and catch-all 404 are covered too) - Strip helmet's duplicate copies on proxied /api and /socket.io responses - Add explicit proxy_read_timeout on /socket.io/ so long-lived, mostly-idle WebSocket upgrades aren't dropped at nginx's default 60s
- Record the running container's image before switching (.rollback-image) - If the post-deploy health check fails, redeploy that prior immutable :<sha> tag and re-verify health on the box - Gate strictly on the health step failing (not a failed pull/start, where the old container is still up), and let the job still end red so the existing alarm path notifies a human
- VideoTile test is now .tsx, not .jsx - Correct the Server image smoke trigger paths to match the workflow YAML (add shared/**, package.json, package-lock.json; .dockerignore is at root) - typecheck workflow header no longer calls the codebase 'mostly JavaScript'
- engines.node floors: root+server >=22.13 (mediasoup >=22, eslint 10 on the 22.x branch needs >=22.13); client/shared/e2e >=20.19 (vite 8 + eslint 10) - server/.env.example now documents LOG_LEVEL and AWS_REGION
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Deploy/docs items from the 2026-07-04 quality report.
Deploy hardening
deploy-backend.yml: the running image ref is recorded before each release; if (and only if) the post-deploy health check fails, the workflow SSHes back, checks out the prior SHA, redeploys the last-good immutable tag, and re-verifies health. The job still ends red so the existing alarm path notifies a human./api/healthvia node fetch — slim image has no curl) + mem/cpu limits.X-Content-Type-Optionsat the TLS edge withalways(covers nginx-generated 301/404), stripping helmet's upstream duplicates; explicitproxy_read_timeout 3600son the Socket.io path.Doc corrections
.env.example,env.ts, e2e constants — the old range provisions a wrong ~50k-port security group);Meetingmodel →Room; added the missingcp client/.env.example client/.envsetup step.VideoTile.test.jsx→.tsx; server-image CI trigger paths synced with actual workflow YAML.server/.env.example: documentedLOG_LEVEL/AWS_REGION.engines.nodeon all package.json files (root/server ≥22.13, client/shared/e2e ≥20.19).Validated:
docker compose configclean; workflow YAML parses; no application source touched.