chore(iios): production Dockerfile + migrate entrypoint + env/secrets contract

Adds a multi-stage Dockerfile for iios-service (build → pnpm deploy prune → slim non-root runtime), a docker-entrypoint that runs `prisma migrate deploy` then starts the server as PID 1, a .dockerignore, a fully-commented .env.example config contract, and docs/DEPLOYMENT.md (topology, scaling, release strategy, prod-readiness gaps). Moves prisma to dependencies so the CLI ships in the prod bundle. Image builds, migrates, and serves /health 200. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-03 19:19:13 +05:30
parent 5bd1f646ca
commit a520b26398
7 changed files with 241 additions and 4 deletions
@@ -0,0 +1,48 @@
+# ─────────────────────────────────────────────────────────────────────────────
+# iios-service configuration contract.
+# Copy to `.env` for local dev; in prod, inject via your secrets manager / orchestrator.
+# 🔒 = secret (never commit a real value). ⚠️ = must be set correctly for prod safety.
+# ─────────────────────────────────────────────────────────────────────────────
+
+# ── Core ─────────────────────────────────────────────────────────────────────
+DATABASE_URL=postgresql://iios:iios@localhost:5434/iios?schema=public   # 🔒 Postgres connection
+PORT=3200
+# NODE_ENV=production   # set by the Docker image
+
+# ── Secrets ──────────────────────────────────────────────────────────────────
+# JSON map of appId → HS256 signing secret used to verify session JWTs (SessionVerifier).
+APP_SECRETS={"portal-demo":"dev-secret"}                                 # 🔒
+# JSON map of channelType → inbound webhook HMAC secret (adapter signature check).
+ADAPTER_SECRETS={"WEBHOOK":"dev-adapter-secret"}                         # 🔒
+# Default scope an unauthenticated adapter webhook ingests into.
+ADAPTER_APP=portal-demo
+ADAPTER_ORG=org_demo
+
+# ── ⚠️ Production-safety flags ────────────────────────────────────────────────
+# Enables /v1/dev/* (token mint, webhook inject, chaos, retention sweep). MUST be unset
+# or 0 in production — leaving it on exposes unauthenticated token minting.
+IIOS_DEV_TOKENS=0
+# Skip `prisma migrate deploy` at boot (set to 1 when a separate migration job runs).
+IIOS_SKIP_MIGRATE=0
+
+# ── Tenant isolation ─────────────────────────────────────────────────────────
+IIOS_CELL_ID=cell-default            # physical cell this instance serves (blast-radius partition)
+
+# ── Background workers ───────────────────────────────────────────────────────
+IIOS_RELAY_INTERVAL_MS=500           # outbox relay tick; 0 disables the timer
+IIOS_OUTBOX_MAX_ATTEMPTS=5           # relay dead-letters an event after N failed publishes
+IIOS_RETENTION_SWEEP_INTERVAL_MS=0   # retention sweep tick; 0 disables (run via job instead)
+IIOS_RETENTION_POLICY_VERSION=v1
+IIOS_RETENTION_ARCHIVE_DAYS=90       # default archive window (per-class override: _INTERNAL/_RESTRICTED/_CONFIDENTIAL/_REGULATED)
+IIOS_RETENTION_DELETE_DAYS=365       # default delete (redact) window; same per-class overrides
+
+# ── Rate limits / quotas / budgets ───────────────────────────────────────────
+IIOS_OUTBOUND_LIMIT=5                # per-(channel,target) sends per window
+IIOS_OUTBOUND_WINDOW_MS=60000
+IIOS_TENANT_OUTBOUND_LIMIT=10000     # per-tenant egress cap per window (noisy-neighbor guard)
+IIOS_TENANT_OUTBOUND_WINDOW_MS=60000
+IIOS_AI_BUDGET_UNITS=100000          # per-scope AI cost-unit budget (KG-12)
+
+# ── Capability providers (governed egress targets) ───────────────────────────
+# Per-channel provider endpoint the CapabilityBroker calls, e.g.:
+# IIOS_PROVIDER_URL_EMAIL=https://provider.internal/email