You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
46 lines
2.3 KiB
Markdown
46 lines
2.3 KiB
Markdown
# Questions for the backend / devops owner (house conventions)
|
|
|
|
Purpose: confirm HQ's deployment matches how the other apps on the company EC2 box are set
|
|
up, so nothing is inconsistent. Each item notes what HQ currently does, in parentheses, so
|
|
answers can be a quick "matches" / "change to X". Tick answers inline as you get them.
|
|
|
|
## Runtime & Node
|
|
1. How do the other Node/API apps run on this box — `docker run`, docker-compose, `pm2`, or `systemd`? *(HQ uses docker-compose.)*
|
|
- **A:**
|
|
2. What Node version do the APIs use, and how do you get Node 20+ given the host is Node 16 with old glibc (2.26) — containerized, `nvm`, or something else? *(HQ runs Node 20 inside its container.)*
|
|
- **A:**
|
|
|
|
## Database
|
|
3. Do all apps connect to `accurate-postgres` as the `postgres` superuser, or do any have their own DB user/role? *(Checked: only `postgres` exists; HQ uses it, matching.)*
|
|
- **A:**
|
|
4. Is port `5432` intentionally open to the public internet (`0.0.0.0`), or should it be restricted to specific IPs in the security group?
|
|
- **A:**
|
|
5. Are there backups of the shared Postgres — how and where?
|
|
- **A:**
|
|
|
|
## Environment & secrets
|
|
6. Where do apps keep their `.env` / secrets, and any convention for file location or permissions? *(HQ: `apps/hq/.env`, `chmod 600`.)*
|
|
- **A:**
|
|
|
|
## nginx & TLS
|
|
7. Do all vhosts go in `/etc/nginx/conf.d/*.conf`, and is there a filename convention? *(HQ: `sims.hq.conf`.)*
|
|
- **A:**
|
|
8. For the APIs behind nginx, how do you pass the real client IP / handle `X-Forwarded-For` and `trust proxy`? *(HQ: nginx sets `X-Forwarded-For $remote_addr`; app uses `trust proxy 1`.)*
|
|
- **A:**
|
|
9. How is the `*.simssoftware.in` wildcard cert renewed/managed (`/etc/ssl/sims/`)?
|
|
- **A:**
|
|
|
|
## Networking & ports
|
|
10. What port range do internal apps use, and do they bind to `127.0.0.1` or `0.0.0.0`? *(HQ binds `127.0.0.1:5182` — only nginx reaches it.)*
|
|
- **A:**
|
|
|
|
## Deploy & operations
|
|
11. How are updates deployed — WinSCP copy, `git pull`, or a pipeline? *(HQ: copied into `/usr/share/nginx/sims-hq`.)*
|
|
- **A:**
|
|
12. What restarts containers/apps after a reboot — docker `restart` policy, `systemd`? *(HQ: `restart: unless-stopped`.)*
|
|
- **A:**
|
|
|
|
## DNS
|
|
13. Where is `simssoftware.in` DNS managed and who adds records? *(We added `hq` A -> 13.232.53.115.)*
|
|
- **A:**
|