feat: LinkedIn profile search engine (Django + React + Elasticsearch + ELK)

Full-stack implementation of the Cyberyan full-stack trial task.

Backend (Django 5 / DRF)
- Normalised PostgreSQL model (Profile, Company, School, Skill, Experience,
  Education) as the source of truth, with GIN + trigram indexes.
- Self-healing CSV reader: the supplied export carries an injected watermark
  column, missing columns, rows split by broken quoting and a duplicated
  header. A signature-scored Needleman-Wunsch alignment reconstructs 284 clean
  records out of 336 physical rows; only 10 rows parse correctly without it.
- Pluggable search layer (Strategy): Elasticsearch by default, PostgreSQL
  full-text search as a fallback selected by a single environment variable.
- Keyword search with per-field boosts, fuzziness and phrase boosting, six
  faceted filters (OR within a filter, AND across filters), an experience
  range, four sort orders, highlighting and facet aggregations.
- JWT auth with rotation + blacklist, three roles, PII masking, scoped rate
  limits, a single error envelope, OpenAPI schema and health probes.

Frontend (React 18 / TypeScript / Vite)
- Debounced search with type-ahead, faceted filter panel, result cards,
  profile drawer, URL-synced search state, automatic token refresh.
- Highlight snippets rendered without dangerouslySetInnerHTML.

Infrastructure
- Hardened multi-stage images (non-root, read-only rootfs, healthchecks).
- docker-compose for the full stack plus dev and production overlays.
- ELK: structured JSON logs shipped asynchronously to Logstash, routed per
  event type, with a composable index template and a Kibana setup script.

Quality
- 61 backend tests (85% coverage), ruff/black/bandit/mypy, ESLint + tsc,
  GitHub Actions running lint, tests and both image builds.
- Persian documentation: README plus architecture, search, API, data,
  security and operations guides.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GnFo6fNaHCTAkJbfcdkqtG

elk/logstash/config/logstash.yml

@@ -0,0 +1,19 @@
+# Logstash node configuration.
+# The pipeline itself lives in pipeline/logstash.conf.
+
+http.host: "0.0.0.0"
+node.name: logstash
+
+# One worker per CPU is plenty for an application log stream; batching keeps
+# the number of bulk requests to Elasticsearch low.
+pipeline.workers: 2
+pipeline.batch.size: 250
+pipeline.batch.delay: 50
+pipeline.ordered: false
+
+# Persisted queue: a short Elasticsearch outage does not lose log events.
+queue.type: persisted
+queue.max_bytes: 256mb
+
+log.level: info
+xpack.monitoring.enabled: false

elk/logstash/pipeline/logstash.conf

@@ -0,0 +1,85 @@
+# =============================================================================
+# Application log pipeline.
+#
+# Django emits one JSON object per log record and ships it over TCP with
+# `python-logstash-async` (asynchronous, buffered - a Logstash outage never
+# blocks a request thread).  Because the payload is already structured there is
+# no grok parsing here: the pipeline only enriches, classifies and routes.
+# =============================================================================
+
+input {
+  tcp {
+    port  => 5959
+    codec => json_lines
+    tags  => ["django"]
+  }
+}
+
+filter {
+  # Fields Logstash adds itself and that carry no information for us.
+  mutate {
+    remove_field => ["port", "@version"]
+  }
+
+  # The application already stamps an ISO-8601 timestamp; trust it so the log
+  # line is filed under the moment it happened, not the moment it arrived.
+  date {
+    match  => ["@timestamp", "ISO8601"]
+    target => "@timestamp"
+    tag_on_failure => ["_timestamp_parse_failure"]
+  }
+
+  # Route by event type. `event` is set by the application through `extra=`.
+  if [event] == "search_executed" {
+    mutate { add_field => { "[@metadata][stream]" => "search" } }
+
+    # A slow search is worth alerting on; pre-computing the flag keeps the
+    # Kibana query simple.
+    if [took_ms] and [took_ms] > 500 {
+      mutate { add_tag => ["slow_search"] }
+    }
+    if [result_count] == 0 {
+      mutate { add_tag => ["zero_results"] }
+    }
+  } else if [event] in ["login_succeeded", "login_failed", "logout", "user_registered"] {
+    mutate { add_field => { "[@metadata][stream]" => "audit" } }
+  } else if [level] in ["ERROR", "CRITICAL"] {
+    mutate { add_field => { "[@metadata][stream]" => "error" } }
+  } else {
+    mutate { add_field => { "[@metadata][stream]" => "app" } }
+  }
+
+  # Never let a stray contact detail reach the log store.
+  mutate {
+    remove_field => ["password", "authorization", "emails", "phone_numbers"]
+  }
+}
+
+output {
+  elasticsearch {
+    # Credentials, when the cluster has security enabled, travel inside the
+    # URL (see docker-compose.prod.yml) so this single pipeline file works
+    # both with and without authentication.
+    hosts => ["${ELASTICSEARCH_HOSTS:http://elasticsearch:9200}"]
+
+    # One index per stream per day keeps retention policies simple and makes
+    # "delete everything older than 30 days" a single index deletion.
+    index => "app-logs-%{[@metadata][stream]}-%{+YYYY.MM.dd}"
+
+    # Composable index template (Elasticsearch 8 style): pins the types of the
+    # fields Kibana filters and aggregates on instead of letting dynamic
+    # mapping guess them.
+    manage_template    => true
+    template_api       => "composable"
+    template_name      => "app-logs"
+    template           => "/usr/share/logstash/templates/app-logs.json"
+    template_overwrite => true
+
+    action => "index"
+  }
+
+  # Anything that fails to parse is still visible in `docker compose logs`.
+  if "_jsonparsefailure" in [tags] or "_timestamp_parse_failure" in [tags] {
+    stdout { codec => rubydebug }
+  }
+}

elk/logstash/templates/app-logs.json

@@ -0,0 +1,58 @@
+{
+  "index_patterns": ["app-logs-*"],
+  "priority": 200,
+  "template": {
+    "settings": {
+      "number_of_shards": 1,
+      "number_of_replicas": 0,
+      "refresh_interval": "5s"
+    },
+    "mappings": {
+      "dynamic": true,
+      "properties": {
+        "@timestamp": { "type": "date" },
+        "level": { "type": "keyword" },
+        "logger": { "type": "keyword" },
+        "service": { "type": "keyword" },
+        "environment": { "type": "keyword" },
+        "event": { "type": "keyword" },
+        "message": { "type": "text" },
+        "request_id": { "type": "keyword" },
+        "user_id": { "type": "long" },
+        "user_role": { "type": "keyword" },
+        "client_ip": { "type": "ip" },
+        "user_agent": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } },
+        "http_method": { "type": "keyword" },
+        "http_path": { "type": "keyword" },
+        "http_status": { "type": "short" },
+        "duration_ms": { "type": "float" },
+        "backend": { "type": "keyword" },
+        "took_ms": { "type": "integer" },
+        "result_count": { "type": "integer" },
+        "query": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } },
+        "sort": { "type": "keyword" },
+        "page": { "type": "integer" },
+        "page_size": { "type": "integer" },
+        "filters": {
+          "properties": {
+            "skills": { "type": "keyword" },
+            "roles": { "type": "keyword" },
+            "seniority": { "type": "keyword" },
+            "countries": { "type": "keyword" },
+            "industries": { "type": "keyword" },
+            "companies": { "type": "keyword" },
+            "min_experience": { "type": "integer" },
+            "max_experience": { "type": "integer" }
+          }
+        },
+        "error": {
+          "properties": {
+            "type": { "type": "keyword" },
+            "message": { "type": "text" },
+            "stack": { "type": "text", "index": false }
+          }
+        }
+      }
+    }
+  }
+}