feat: expose safe build metadata and verify foundation
This commit is contained in:
@@ -51,3 +51,11 @@ scripts/teamcity/rollback.sh # redeploy the previous IMAGE_TAG
|
||||
## Production topology
|
||||
|
||||
Production Docker Compose (`compose.yml`) publishes **exactly one** host port, on the `edge` (Nginx) service, which serves the built Angular app and reverse-proxies `/api/*` and `/health/*` to the internal `api` service. `api`, `worker`, `postgres`, and `redis` are reachable only over the internal Docker network. See `docs/architecture/deployment.md` for the full contract and `scripts/teamcity/` for the TeamCity-invoked build/deploy/rollback scripts.
|
||||
|
||||
## Phase 01 status: foundation complete
|
||||
|
||||
- `GET /health/live` — process liveness only, no dependency checks.
|
||||
- `GET /health/ready` — validates PostgreSQL and Redis connectivity.
|
||||
- `GET /api/v1/version` — safe build metadata only (`appVersion`, `teamCityBuildNumber`, `sourceRevision`); never database/Redis URLs.
|
||||
- The compiled no-op migration entry point (`backend/dist/apps/api/src/migration.js`) gives `deploy.sh` a stable container command contract; Phase 02 replaces its body with the real versioned migration runner.
|
||||
- Verified end-to-end: `docker compose -f compose.yml up` with a real TLS certificate serves `/health/live`, `/health/ready`, `/`, and `/api/v1/version` through the single published edge port, with `postgres`/`redis`/`api`/`worker` unreachable from the host.
|
||||
|
||||
Reference in New Issue
Block a user