GovOPlaN/govoplan
2
0
Fork 0
Code Issues 18 Pull Requests Actions Packages Projects Releases 3 Wiki Activity

Sync wiki from project files

zemion
2026-07-30 15:27:44 +02:00
parent c1b70fe80d
commit b300273a55
1 changed files with 24 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Repo-docs-INSTALLATION-AND-DEPLOYMENT-ARCHITECTURE.md
+24 -2
@@ -1,4 +1,4 @@
<!-- codex-wiki-sync:945eb2492ecee6c951a67e3e --> <!-- codex-wiki-sync:7ede1004776a35112535520c -->
> Mirrored from `/mnt/DATA/git/govoplan/docs/INSTALLATION_AND_DEPLOYMENT_ARCHITECTURE.md`. > Mirrored from `/mnt/DATA/git/govoplan/docs/INSTALLATION_AND_DEPLOYMENT_ARCHITECTURE.md`.
> Origin: `repository`. > Origin: `repository`.
@@ -34,10 +34,16 @@ It currently supports:
- Core, base, or full initial module selections; - Core, base, or full initial module selections;
- deterministic Compose JSON accepted by Compose v2; - deterministic Compose JSON accepted by Compose v2;
- generated secrets stored in a private `0600` file; - generated secrets stored in a private `0600` file;
- service-specific environment allowlists so infrastructure containers do not
receive unrelated application credentials;
- plan, render, doctor, status, and apply commands; - plan, render, doctor, status, and apply commands;
- an installation lock, migration-before-start ordering, readiness polling, - an installation lock, migration-before-start ordering, readiness polling,
and an applied-state receipt; and an applied-state receipt;
- idempotent reconfiguration that preserves generated secrets; - idempotent reconfiguration that preserves generated secrets;
- a keyed environment fingerprint that detects private binding changes without
writing secret values to plans or receipts;
- host CPU, memory, disk, entropy, architecture, Docker daemon, Compose,
listen-port, and external endpoint preflight checks;
- service removal without implicit data-volume deletion. - service removal without implicit data-volume deletion.
Create a local evaluation bundle: Create a local evaluation bundle:
@@ -108,6 +114,10 @@ a production distribution:
5. **Deployment agent.** Web updates need a separate privileged reconciler with 5. **Deployment agent.** Web updates need a separate privileged reconciler with
a typed command allowlist. The API and browser must never receive the Docker a typed command allowlist. The API and browser must never receive the Docker
socket or arbitrary shell access. socket or arbitrary shell access.
6. **Ingress and certificates.** A self-hosted profile needs an explicit choice
between an existing reverse proxy and a supported managed ingress, including
trusted-proxy boundaries, TLS certificate issuance, renewal, and health
probing through the public route.
`apply --allow-unverified-images` is therefore restricted to the evaluation `apply --allow-unverified-images` is therefore restricted to the evaluation
profile. It explicitly acknowledges both mutable image identities and profile. It explicitly acknowledges both mutable image identities and
@@ -123,6 +133,10 @@ credentials. `external` requires an explicit `DATABASE_URL`; switching from
managed to external cannot reuse the old `postgres` Docker hostname managed to external cannot reuse the old `postgres` Docker hostname
accidentally. accidentally.
Interactive entry hides external URLs because they commonly contain
credentials. For unattended automation, provide them through a protected
operator mechanism and avoid storing secret-bearing flags in shell history.
Production policy should support external managed databases and local managed Production policy should support external managed databases and local managed
PostgreSQL equally at the application boundary. Backup, point-in-time recovery, PostgreSQL equally at the application boundary. Backup, point-in-time recovery,
high availability, and major-version upgrades remain deployment properties. high availability, and major-version upgrades remain deployment properties.
@@ -133,6 +147,10 @@ high availability, and major-version upgrades remain deployment properties.
requires an explicit `REDIS_URL`. `disabled` is evaluation-only and disables requires an explicit `REDIS_URL`. `disabled` is evaluation-only and disables
workers while recording the single-process login-throttle risk acknowledgement. workers while recording the single-process login-throttle risk acknowledgement.
`doctor` performs a bounded TCP connection check for external PostgreSQL,
Redis, and S3 endpoints. This verifies DNS, routing, and that the port accepts a
connection; it is not an authentication or semantic health check.
Production base installations include Redis because durable queues, distributed Production base installations include Redis because durable queues, distributed
throttling, notifications, scheduled work, and transactional event delivery throttling, notifications, scheduled work, and transactional event delivery
must survive API restarts. must survive API restarts.
@@ -172,6 +190,8 @@ applied state. `plan` compares their canonical hashes and service sets.
deliberately destructive workflow. deliberately destructive workflow.
- Existing generated credentials are retained unless an explicit future rotate - Existing generated credentials are retained unless an explicit future rotate
operation is requested. operation is requested.
- Private configuration changes are represented by a keyed fingerprint in the
plan and receipt; plaintext values are never copied there.
- Managed-to-external transitions require the new endpoint in the same - Managed-to-external transitions require the new endpoint in the same
operation. operation.
- Migrations run as a one-shot service before API/worker replacement. - Migrations run as a one-shot service before API/worker replacement.
@@ -230,4 +250,6 @@ Run the focused tests:
The tests cover profile restrictions, secret persistence, external endpoint The tests cover profile restrictions, secret persistence, external endpoint
requirements, S3 policy, Compose service selection, secret non-disclosure, requirements, S3 policy, Compose service selection, secret non-disclosure,
private file modes, first-plan generation, and receipt-based idempotency. service-specific environment isolation, private file modes, external endpoint
preflight, first-plan generation, apply ordering, and receipt-based
idempotency.