Skip to content

PRODUCTION.md

Latest commit

 

History

History
57 lines (40 loc) · 1.76 KB

PRODUCTION.md

File metadata and controls

57 lines (40 loc) · 1.76 KB
Raw

Production operations

Architecture

  • AKS vcr-aks-prod (South India) — API + register worker via Helm
  • ACR vcrprotocolprodin — images pinned by git SHA + digest
  • Key Vault vcr-kv-prod-in — secrets synced from GitHub production environment
  • DNS api.vcrprotocol.xyz → nginx ingress LoadBalancer

GitHub secrets (production environment)

Required Purpose
AZURE_CLIENT_ID OIDC app id (terraform output github_actions_client_id)
AZURE_TENANT_ID Azure AD tenant
AZURE_SUBSCRIPTION_ID Subscription
MONGODB_URI, REDIS_URL, PRIVATE_KEY, BITGO_*, PINATA_*, … Application

OIDC (recommended): Do not set AZURE_CLIENT_SECRET after terraform apply creates federated credentials.

Optional: ALLOWED_ORIGINS (comma-separated CORS origins, default https://vcrprotocol.xyz)

Enable required reviewers on the production environment in GitHub.

Workflows

Workflow When
Deploy Production (AKS) Push main / manual
Bootstrap AKS Platform New cluster only
Terraform Plan PR touching infra/terraform
Security Weekly + PR — CodeQL, npm audit
CI PR — build, test

Terraform

# One-time state backend
cd infra/terraform/bootstrap && terraform init && terraform apply

cd ../environments/prod
terraform init -migrate-state   # first time only
terraform apply

Rollback

az aks get-credentials -g rg-vcr-protocol-prod-in -n vcr-aks-prod
helm rollback vcr-api -n vcr-protocol

Alerts

Email: admin@vcrprotocol.xyz (change in infra/terraform/environments/prod/variables.tf → alert_email).

Azure Monitor alerts: unhealthy pods, error logs, nodes not ready, monthly budget thresholds.