Claude
|
48b9ccf152
|
feat: M4 Hardening — encryption, resource limits, monitoring, backups
## Env var encryption at rest (AES-256-GCM)
- server/src/crypto.rs: new module — encrypt/decrypt with AES-256-GCM
Key = SHA-256(HIY_SECRET_KEY); non-prefixed values pass through
transparently for zero-downtime migration
- Cargo.toml: aes-gcm = "0.10"
- routes/envvars.rs: encrypt on SET; list returns masked values (••••)
- routes/databases.rs: pg_password and DATABASE_URL stored encrypted
- routes/ui.rs: decrypt pg_password when rendering DB card
- builder.rs: decrypt env vars when writing the .env file for containers
- .env.example: add HIY_SECRET_KEY entry
## Per-app resource limits
- apps table: memory_limit (default 512m) + cpu_limit (default 0.5)
added via idempotent ALTER TABLE in db.rs migration
- models.rs: App, CreateApp, UpdateApp gain memory_limit + cpu_limit
- routes/apps.rs: persist limits on create, update via PUT
- builder.rs: pass MEMORY_LIMIT + CPU_LIMIT to build script
- builder/build.sh: use $MEMORY_LIMIT / $CPU_LIMIT in podman run
(replaces hardcoded --cpus="0.5"; --memory now also set)
## Monitoring (opt-in compose profile)
- infra/docker-compose.yml: gatus + netdata under `monitoring` profile
Enable: podman compose --profile monitoring up -d
Gatus on :8080, Netdata on :19999
- infra/gatus.yml: Gatus config checking HIY /api/status every minute
## Backup cron job
- infra/backup.sh: dumps SQLite, copies env files + git repos into a
dated .tar.gz; optional rclone upload; 30-day local retention
Suggested cron: 0 3 * * * /path/to/infra/backup.sh
https://claude.ai/code/session_01FKCW3FDjNFj6jve4niMFXH
|
2026-03-24 15:06:42 +00:00 |
|
Claude
|
8f5bb158cb
|
M1: Rust control plane, builder, dashboard, and infra
- Cargo workspace with hiy-server (axum 0.7 + sqlx SQLite + tokio)
- SQLite schema: apps, deploys, env_vars (inline migrations, no daemon)
- Background build worker: sequential queue, streams stdout/stderr to DB
- REST API: CRUD for apps, deploys, env vars; GitHub webhook with HMAC-SHA256
- SSE endpoint for live build log streaming
- Monospace HTMX-free dashboard: app list + per-app detail, log viewer, env editor
- builder/build.sh: clone/pull → detect strategy (Dockerfile/buildpack/static)
→ docker build → swap container → update Caddy via admin API → prune images
- infra/docker-compose.yml + Dockerfile.server for local dev (no Pi needed)
- proxy/Caddyfile: auto-HTTPS off for local, comment removed for production
- .env.example
Compiles clean (zero warnings). Run locally:
cp .env.example .env && cargo run --bin hiy-server
https://claude.ai/code/session_01FKCW3FDjNFj6jve4niMFXH
|
2026-03-19 08:25:59 +00:00 |
|