58 lines
3.0 KiB
Markdown
58 lines
3.0 KiB
Markdown
# Release verification: checkpoint 23
|
|
|
|
Checkpoint 23 hardens the Docker/reverse-proxy deployment boundary. It does not change the inference hot path or persisted-state schemas.
|
|
|
|
## Scope verification
|
|
|
|
`cmd/` and `internal/` were byte-for-byte/diff checked against checkpoint 22 after the deployment changes. No runtime Go source changed. Existing release binaries therefore remain unchanged and all entries in `dist/SHA256SUMS` still verify.
|
|
|
|
## Deployment changes
|
|
|
|
- Development Compose defaults to `127.0.0.1:9080 -> :8080` instead of publishing on all host interfaces.
|
|
- `docker-compose.production.yml` requires `GATEWAY_CONFIG`; there is no production fallback to `config.example.json`.
|
|
- Container root filesystem is read-only; `/data` is the persistent writable volume and `/tmp` is tmpfs.
|
|
- Runtime explicitly uses UID/GID `65532:65532`, drops all Linux capabilities and enables `no-new-privileges`.
|
|
- JSON-file logging is bounded to five 10 MiB files in the production Compose example.
|
|
- `scripts/production-preflight.sh` rejects `config.example.json`, rejects non-loopback publishing unless explicitly acknowledged, renders Compose, and invokes the gateway's secret-redacted `-check-config` in the candidate container.
|
|
- `scripts/production-preflight_test.sh` regression-tests loopback success, example-config rejection, wildcard-bind rejection and explicit remote-proxy opt-in.
|
|
|
|
## Production config validation
|
|
|
|
The hardened two-worker production configuration was validated with the release binary:
|
|
|
|
- status: `ok`
|
|
- workers: `2`
|
|
- data directory: `/data`
|
|
- state directory writable: `true`
|
|
- broad trusted-proxy warnings: none
|
|
|
|
The configuration narrows `auth.trusted_proxies` to loopback plus the observed Docker peer `172.30.3.1/32`; `auth.ip_bypass_use_forwarded_ip` remains false.
|
|
|
|
## Test results
|
|
|
|
- `go test ./...`: PASS
|
|
- `go vet ./...`: PASS
|
|
- `go test -race ./cmd/...`: PASS
|
|
- `go test -race ./internal/...`: PASS
|
|
- `sh -n scripts/production-preflight.sh`: PASS
|
|
- `sh -n scripts/production-preflight_test.sh`: PASS
|
|
- `scripts/production-preflight_test.sh`: PASS
|
|
- Compose YAML parse check: PASS
|
|
- `dist/SHA256SUMS`: all 10 packaged binaries PASS
|
|
|
|
## Release-binary smoke test
|
|
|
|
The shipped Linux-amd64 gateway binary was started against an isolated deterministic Ollama mock and temporary state directory.
|
|
|
|
- `/healthz`: 200 / `status=ok`
|
|
- `/readyz`: 200 / `status=ready`
|
|
- authenticated `/gateway/ui-api/session`: admin identity returned
|
|
- authenticated `/v1/chat/completions`: successful response (`chatcmpl-mock`)
|
|
- SIGTERM gateway shutdown: exit code 0 and `gateway stopped` logged
|
|
|
|
The mock process is test infrastructure and is not part of the production artifact.
|
|
|
|
## Deployment recommendation
|
|
|
|
For the observed topology, keep `GATEWAY_PUBLISH_ADDRESS=127.0.0.1` so only a reverse proxy on the Docker host can reach port 9080. If the reverse proxy is remote, bind to one specific host interface, set `ALLOW_NON_LOOPBACK_BIND=1` only for the preflight, and firewall the published port to the exact reverse-proxy source IP.
|