Paperclip CTO
679732de7d
feat(security): add modsecurity paranoia level 4 ruleset for nginx
...
CI / lint (push) Successful in 7s
CI / test (push) Successful in 21s
CI / build-container (push) Successful in 6s
Co-Authored-By: Paperclip <noreply@paperclip.ing >
2026-05-19 10:27:48 +02:00
Paperclip CTO
3d541d818a
feat(TRA-249): M5 observability, SLOs, backup, and release readiness
...
- Add prometheus-client to base requirements; sentry-sdk to prod
- api/metrics.py: define HTTP latency histogram, request/error counters, in-flight gauge
- api/middleware.py: extend SecurityAuditMiddleware to observe all four Prometheus collectors per request; low-cardinality path_template label via URL resolver
- api/views.py: /metrics/ endpoint (gated by METRICS_ENABLED setting)
- api/urls.py: wire /metrics/ route
- config/settings/prod.py: METRICS_ENABLED flag; optional Sentry SDK init via SENTRY_DSN env var
- ops/prometheus/alerts.yml: Prometheus alert rules for p95 latency SLO (≤500 ms), error rate SLO (<1%), availability, and saturation
- ops/prometheus/prometheus.yml: scrape config for app + blackbox healthcheck probe
- ops/scripts/backup.sh: pg_dump → S3 STANDARD_IA with retention metadata
- ops/scripts/restore.sh: pg_restore from S3 or local file with interactive confirmation guard
- ops/scripts/synthetic-check.sh: post-deploy smoke test (healthz, metrics gate, schema, 404 shape)
- docs/TRA-249-observability-slos.md: SLO table, PromQL reference queries, alert routing
- docs/TRA-249-backup-restore.md: RPO/RTO targets, drill procedure, restore validation steps
- docs/TRA-249-release-checklist.md: pre/post-deploy checklist
- docs/TRA-249-rollback-runbook.md: decision matrix, app rollback, migration revert, DB restore path
Co-Authored-By: Paperclip <noreply@paperclip.ing >
2026-05-07 09:14:18 +02:00
Paperclip CTO
1f6a4183d4
feat(TRA-247): M5 security hardening — tests, markers, and header enforcement
...
- tests/test_security.py: 30 security regression tests covering secure
headers, CSP directives, middleware ordering, DRF throttle configuration,
and SecurityAuditMiddleware event-detection logic
- tests/test_upload.py: 19 upload defense tests covering extension allow-list,
byte-length limits, and magic-byte signature validation (polyglot / disguised
executable detection)
- pytest.ini: register 'security' and 'upload' markers (--strict-markers
enforcement was already on)
Security settings already committed in feat(TRA-233) via harness include:
SECURE_REFERRER_POLICY, CSP_* directives, DEFAULT_THROTTLE_*, MAX_UPLOAD_SIZE,
SESSION/CSRF cookie hardening, AWS presigned URL policy, and
SecurityAuditMiddleware with dual-logger (access + security) pattern.
Co-Authored-By: Paperclip <noreply@paperclip.ing >
2026-05-07 09:11:23 +02:00
Paperclip CTO
8054c1e1e4
feat(TRA-233): Django M1 foundation scaffold
...
- Environment-split settings: base/local/test/prod with django-environ
- Postgres + Redis + Celery wiring (broker, beat, result backend)
- All 9 domain app stubs: accounts, courses, cms, tracking, quizzes,
training, certificates, reports, notifications
- api app: /healthz/ endpoint, custom DRF exception handler,
SecurityAuditMiddleware, permissions/throttle/upload-validation stubs
- DRF global baseline: JWT+session auth, closed-by-default permissions,
cursor/page pagination, drf-spectacular schema generation
- Dockerfile (multi-env build arg), docker-compose.yml (local),
docker-compose.test.yml (CI-friendly tmpfs Postgres)
- pytest.ini with smoke + settings marker definitions
- tests/test_smoke.py: startup, URL resolution, healthcheck shape
- tests/test_settings_matrix.py: per-profile security assertions
- .github/workflows/ci.yml: test, lint, schema CI jobs
- .env.example with all required vars documented
- .gitignore
Co-Authored-By: Paperclip <noreply@paperclip.ing >
2026-05-07 09:11:23 +02:00
Paperclip CTO
3c59a4c9fc
docs(TRA-253): add DRF settings baseline and handoff checklist
...
- Add section 7: DRF global settings (REST_FRAMEWORK dict, required
packages, custom exception handler, drf-spectacular config, URL
routing skeleton) to satisfy the DoD requirement for concrete
implementation conventions
- Add section 9: handoff checklist for domain tracks (TRA-254/255/256),
frontend track (TRA-257), and QA/CI track (TRA-258) with per-gate
merge criteria and oasdiff command
- Fix section numbering: old section 7 OpenAPI subsections were
labelled 6.x; renumbered to 8.x; old sections 8 and 9 become 10 and 11
Co-Authored-By: Paperclip <noreply@paperclip.ing >
2026-05-07 09:11:23 +02:00
Paperclip CTO
a573e40684
chore: bootstrap repository with initial main commit
2026-05-06 10:39:44 +02:00
