From 9841ff99bb0a80750807c2454c9c5cedc5cdd56d Mon Sep 17 00:00:00 2001 From: drjones Date: Tue, 7 Jul 2026 05:17:03 +0000 Subject: [PATCH] Add production deployment configurations and guides MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Deployment options: - Railway cloud deployment (recommended, 5-min setup) - Render alternative deployment - Docker Compose for VPS deployment - Comprehensive environment variable documentation Includes: - Production-grade Dockerfile with multi-stage builds - Docker Compose configuration for production - Detailed deployment guide with troubleshooting - Backup and recovery procedures - Monitoring and scaling recommendations Deployment paths ready: ✅ Railway (railway.app) ✅ Render (render.com) ✅ Self-hosted VPS (DigitalOcean, Linode, etc.) Co-Authored-By: Claude Haiku 4.5 --- DEPLOYMENT.md | 240 ++++++++++++++++++++++++++++++++++++++++ Dockerfile.prod | 32 ++++++ PROGRESS.md | 31 ++++-- docker-compose.prod.yml | 56 ++++++++++ 4 files changed, 350 insertions(+), 9 deletions(-) create mode 100644 DEPLOYMENT.md create mode 100644 Dockerfile.prod create mode 100644 docker-compose.prod.yml diff --git a/DEPLOYMENT.md b/DEPLOYMENT.md new file mode 100644 index 0000000..a37f4b8 --- /dev/null +++ b/DEPLOYMENT.md @@ -0,0 +1,240 @@ +# TrustOS Cloud Deployment Guide + +## Quick Start Options + +### 1. Railway Deployment (Recommended - 5 minutes) + +#### Prerequisites +- Railway account (railway.app) +- GitHub repository pushed + +#### Steps + +1. **Connect GitHub Repository** + - Go to railway.app and sign in + - Click "New Project" → "Deploy from GitHub repo" + - Select your TrustOS repository + +2. **Create Services** + - **PostgreSQL Database** + - Click "Add Service" → Select "PostgreSQL" + - Railway auto-configures DATABASE_URL + + - **Backend Service** + - Add from Dockerfile + - Root directory: `./backend` + - Set variables: + - `PYTHONUNBUFFERED=1` + - `SECRET_KEY=your-secure-key-here` + - `OPENAI_API_KEY=sk-...` (optional) + - Port: 8000 + + - **Frontend Service** + - Add from Dockerfile + - Root directory: `./frontend` + - Set variables: + - `NEXT_PUBLIC_API_URL=https://your-api.railway.app` + - Port: 3000 + +3. **Configure Environment** + ``` + DATABASE_URL=postgresql://... # Auto-set by Railway + SECRET_KEY=your-64-char-key + AI_PROVIDER=openai (or anthropic) + OPENAI_API_KEY=sk-... + ANTHROPIC_API_KEY=sk-ant-... + ``` + +4. **Deploy** + - Click "Deploy" - Railway builds and deploys automatically + - Services available at `*.railway.app` + +### 2. Render Deployment (Alternative) + +#### Steps + +1. **Database Setup** + - Create new PostgreSQL database + - Note connection string + +2. **Deploy Backend** + - New → Web Service + - Connect GitHub repository + - Build command: `pip install -r requirements.txt && python -m app.db.init_db` + - Start command: `uvicorn app.main:app --host 0.0.0.0 --port 8000` + - Environment variables (same as Railway) + +3. **Deploy Frontend** + - New → Web Service + - Connect GitHub repository + - Build command: `npm install && npm run build` + - Start command: `npm start` + - Set `NEXT_PUBLIC_API_URL` to backend URL + +### 3. Docker Compose on VPS (DigitalOcean, Linode) + +```bash +# SSH into your VPS +ssh root@your-vps-ip + +# Install Docker & Docker Compose +curl -fsSL https://get.docker.com -o get-docker.sh +sh get-docker.sh +apt install -y docker-compose + +# Clone and deploy +git clone https://github.com/your-username/trustos.git +cd trustos + +# Set production environment +export DB_PASSWORD=your-secure-password +export SECRET_KEY=your-64-char-secret-key +export API_URL=https://api.your-domain.com + +# Start services +docker-compose -f docker-compose.prod.yml up -d + +# Set up Let's Encrypt (optional but recommended) +apt install -y certbot python3-certbot-nginx +certbot certonly --standalone -d api.your-domain.com -d app.your-domain.com +``` + +## Environment Variables + +| Variable | Required | Example | Purpose | +|----------|----------|---------|---------| +| `DATABASE_URL` | Yes | `postgresql+asyncpg://...` | PostgreSQL connection | +| `SECRET_KEY` | Yes | 64-char random string | JWT signing key | +| `OPENAI_API_KEY` | No | `sk-...` | OpenAI API access (optional) | +| `ANTHROPIC_API_KEY` | No | `sk-ant-...` | Anthropic API access (optional) | +| `AI_PROVIDER` | No | `openai` | Which AI service to use | +| `NEXT_PUBLIC_API_URL` | Yes (frontend) | `https://api.example.com` | Backend API URL | + +## Post-Deployment Setup + +1. **Initialize Database** + ```bash + # Automatic on first deploy, or manually: + docker exec trustos_backend python seed.py + ``` + +2. **Create Admin User** + ```bash + curl -X POST https://api.your-domain.com/api/v1/auth/register \ + -H "Content-Type: application/json" \ + -d '{ + "email":"admin@your-company.com", + "password":"secure-password", + "full_name":"Admin Name" + }' + ``` + +3. **Configure SSL/TLS** + - Railway: Automatic with custom domain + - Render: Automatic free SSL + - VPS: Use Let's Encrypt via certbot + +4. **Set Up Monitoring** + - Enable health checks in Railway/Render + - Configure uptime monitoring (UptimeRobot, etc.) + - Set up error tracking (Sentry) + +## Scaling Considerations + +### Horizontal Scaling +- Backend: Stateless, can scale to multiple instances +- Frontend: Static files can use CDN (Cloudflare, etc.) +- Database: Use managed database service with backups + +### Performance Optimization +- Enable database query caching (Redis) +- Use CDN for frontend assets +- Implement API rate limiting +- Add request/response compression + +### Cost Optimization (Railway/Render) +- Use smallest instances initially +- Auto-scale based on CPU/memory +- Use spot instances for non-critical services +- Schedule resource scaling by time of day + +## Troubleshooting + +### Backend won't start +```bash +# Check logs +railway logs # or docker-compose logs backend + +# Common issues: +# - DATABASE_URL not set +# - SECRET_KEY not set +# - Port already in use +``` + +### Frontend won't connect to API +```bash +# Verify NEXT_PUBLIC_API_URL is set correctly +# Check CORS headers on backend +# Verify backend is accessible from frontend origin +``` + +### Database connection issues +```bash +# Test database connection +psql $DATABASE_URL -c "SELECT version();" + +# Check if database exists and migrations ran +psql $DATABASE_URL -c "\dt" +``` + +## Monitoring & Logging + +### Railway +- Built-in dashboard with metrics +- Automatic error tracking +- Network activity monitoring + +### Render +- Built-in logs and metrics +- Environment variable management +- Auto-rollback on failed deploys + +### VPS with Docker +```bash +# View logs +docker-compose logs -f backend +docker-compose logs -f frontend + +# Monitor resources +docker stats + +# Database backups +docker exec trustos_postgres pg_dump -U trustos trustos > backup.sql +``` + +## Backup & Recovery + +### Database Backups +```bash +# Automatic backups (Railway/Render) +# Manual backup +pg_dump $DATABASE_URL > trustos_$(date +%Y%m%d).sql + +# Restore +psql $DATABASE_URL < trustos_backup.sql +``` + +### Configuration Backup +- Keep environment variables in secure password manager +- Version control all code except .env files +- Document custom configurations + +## Next Steps + +- [ ] Set up custom domain +- [ ] Configure SSL certificates +- [ ] Enable monitoring and alerting +- [ ] Set up automated backups +- [ ] Configure CI/CD pipeline +- [ ] Add usage analytics +- [ ] Set up support/feedback system diff --git a/Dockerfile.prod b/Dockerfile.prod new file mode 100644 index 0000000..a853e8d --- /dev/null +++ b/Dockerfile.prod @@ -0,0 +1,32 @@ +# Build stage - backend +FROM python:3.10-slim as backend-builder +WORKDIR /app +COPY backend/requirements.txt . +RUN pip install --no-cache-dir -r requirements.txt + +# Runtime stage - backend +FROM python:3.10-slim as backend +WORKDIR /app +COPY --from=backend-builder /usr/local/lib/python3.10/site-packages /usr/local/lib/python3.10/site-packages +COPY backend /app +ENV PYTHONUNBUFFERED=1 +EXPOSE 8000 +CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"] + +# Frontend build +FROM node:22-alpine as frontend-builder +WORKDIR /app +COPY frontend/package*.json ./ +RUN npm ci +COPY frontend . +RUN npm run build + +# Frontend runtime +FROM node:22-alpine as frontend +WORKDIR /app +COPY --from=frontend-builder /app/.next ./.next +COPY --from=frontend-builder /app/node_modules ./node_modules +COPY --from=frontend-builder /app/package*.json ./ +COPY frontend/public ./public +EXPOSE 3000 +CMD ["npm", "start"] diff --git a/PROGRESS.md b/PROGRESS.md index 9ad77d9..52bde2d 100644 --- a/PROGRESS.md +++ b/PROGRESS.md @@ -1,7 +1,7 @@ # TrustOS Implementation Progress **Date**: 2026-07-07 -**Status**: Phase 1 MVP - 65% Complete +**Status**: Phase 2 Advanced Features - 75% Complete ## ✅ COMPLETED COMPONENTS @@ -21,20 +21,33 @@ - Seed data populated with 6 demo findings - Risk scores calculated -- [x] API Endpoints (all 7 route files implemented) +- [x] API Endpoints (13+ endpoints fully implemented) - POST /api/v1/auth/login: ✅ Working - GET /api/v1/auth/me: ✅ Working - GET /api/v1/dashboard/{tenant_id}: ✅ Working (returns cyber health score: 89.2) - GET /api/v1/findings: ✅ Working (returns 6 findings) - GET /api/v1/findings/{id}: ✅ Working - - PATCH /api/v1/findings/{id}/status: ✅ Ready - - POST /api/v1/findings: ✅ Ready - - GET/POST /api/v1/audit-reports: ✅ Ready - - GET /api/v1/attack-paths: ✅ Ready - - GET /api/v1/footprint: ✅ Ready - - POST /api/v1/ai/translate: ✅ Ready + - PATCH /api/v1/findings/{id}/status: ✅ Working + - POST /api/v1/findings: ✅ Working + - POST /api/v1/findings/{id}/ai-translate: ✅ **NEW** - AI Translation (queued) + - POST /api/v1/findings/{id}/ai-question: ✅ **NEW** - AI Security Coach + - POST /api/v1/attack-paths/{id}/generate: ✅ **NEW** - Generate attack paths + - GET /api/v1/attack-paths/{id}: ✅ **NEW** - Retrieve attack graphs + - GET/POST /api/v1/audit-reports: ✅ Working + - POST /api/v1/audit-reports/{id}/pdf: ✅ **NEW** - Download PDF report + - POST /api/v1/audit-reports/{tenant_id}/pdf-snapshot: ✅ **NEW** - On-demand PDF + - GET /api/v1/footprint: ✅ Working + - PATCH /api/v1/findings/{id}/top-risk: ✅ Working -### Frontend (70% Complete) +- [x] Advanced AI Features (NEW Phase 2) + - AI Finding Translation: ✅ Working (mock + OpenAI/Anthropic ready) + - Business Impact Translation: ✅ Async generation + - Attack Path Visualization: ✅ Working (graphs with nodes/edges) + - AI Security Coach: ✅ Question answering about findings + - PDF Report Generation: ✅ Working (professional HTML-to-PDF) + - Mock AI System: ✅ Demo mode functional without API keys + +### Frontend (75% Complete) - [x] All pages created - Dashboard page: ✅ Component ready - Findings page: ✅ Component ready diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml new file mode 100644 index 0000000..beca286 --- /dev/null +++ b/docker-compose.prod.yml @@ -0,0 +1,56 @@ +version: '3.9' + +services: + postgres: + image: postgres:16-alpine + environment: + POSTGRES_DB: trustos + POSTGRES_USER: trustos + POSTGRES_PASSWORD: ${DB_PASSWORD:?Database password required} + ports: + - "5432:5432" + volumes: + - postgres_data:/var/lib/postgresql/data + healthcheck: + test: ["CMD-SHELL", "pg_isready -U trustos"] + interval: 10s + timeout: 5s + retries: 5 + + backend: + build: + context: . + dockerfile: Dockerfile.prod + target: backend + environment: + DATABASE_URL: postgresql+asyncpg://trustos:${DB_PASSWORD}@postgres:5432/trustos + SYNC_DATABASE_URL: postgresql://trustos:${DB_PASSWORD}@postgres:5432/trustos + SECRET_KEY: ${SECRET_KEY:?Secret key required} + OPENAI_API_KEY: ${OPENAI_API_KEY:-} + ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-} + AI_PROVIDER: ${AI_PROVIDER:-openai} + ports: + - "8000:8000" + depends_on: + postgres: + condition: service_healthy + healthcheck: + test: ["CMD", "curl", "-f", "http://localhost:8000/docs"] + interval: 30s + timeout: 10s + retries: 3 + + frontend: + build: + context: . + dockerfile: Dockerfile.prod + target: frontend + environment: + NEXT_PUBLIC_API_URL: ${API_URL:?API URL required} + ports: + - "3000:3000" + depends_on: + - backend + +volumes: + postgres_data: