mobiniqow
a464e550c9
Full-stack implementation of the Cyberyan full-stack trial task. Backend (Django 5 / DRF) - Normalised PostgreSQL model (Profile, Company, School, Skill, Experience, Education) as the source of truth, with GIN + trigram indexes. - Self-healing CSV reader: the supplied export carries an injected watermark column, missing columns, rows split by broken quoting and a duplicated header. A signature-scored Needleman-Wunsch alignment reconstructs 284 clean records out of 336 physical rows; only 10 rows parse correctly without it. - Pluggable search layer (Strategy): Elasticsearch by default, PostgreSQL full-text search as a fallback selected by a single environment variable. - Keyword search with per-field boosts, fuzziness and phrase boosting, six faceted filters (OR within a filter, AND across filters), an experience range, four sort orders, highlighting and facet aggregations. - JWT auth with rotation + blacklist, three roles, PII masking, scoped rate limits, a single error envelope, OpenAPI schema and health probes. Frontend (React 18 / TypeScript / Vite) - Debounced search with type-ahead, faceted filter panel, result cards, profile drawer, URL-synced search state, automatic token refresh. - Highlight snippets rendered without dangerouslySetInnerHTML. Infrastructure - Hardened multi-stage images (non-root, read-only rootfs, healthchecks). - docker-compose for the full stack plus dev and production overlays. - ELK: structured JSON logs shipped asynchronously to Logstash, routed per event type, with a composable index template and a Kibana setup script. Quality - 61 backend tests (85% coverage), ruff/black/bandit/mypy, ESLint + tsc, GitHub Actions running lint, tests and both image builds. - Persian documentation: README plus architecture, search, API, data, security and operations guides. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GnFo6fNaHCTAkJbfcdkqtG
75 lines
2.4 KiB
YAML
75 lines
2.4 KiB
YAML
# =============================================================================
|
|
# Production overlay.
|
|
#
|
|
# docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
|
|
#
|
|
# What it changes:
|
|
# * Elasticsearch authentication is switched on and every client is given
|
|
# credentials.
|
|
# * Kibana is no longer published; reach it through an SSH tunnel or an
|
|
# authenticating reverse proxy.
|
|
# * Containers get CPU/memory limits and no longer seed the dataset on boot.
|
|
# * The API is fronted by HTTPS (SECURE_SSL_REDIRECT + HSTS come from
|
|
# config/settings/prod.py).
|
|
#
|
|
# TLS between the containers is intentionally out of scope here: in a real
|
|
# deployment the cluster sits behind a service mesh or an internal load
|
|
# balancer that terminates it. See docs/SECURITY.md.
|
|
# =============================================================================
|
|
|
|
services:
|
|
elasticsearch:
|
|
environment:
|
|
xpack.security.enabled: "true"
|
|
ELASTIC_PASSWORD: ${ELASTIC_PASSWORD:?ELASTIC_PASSWORD is required in production}
|
|
healthcheck:
|
|
test:
|
|
- "CMD-SHELL"
|
|
- "curl -fsS -u elastic:${ELASTIC_PASSWORD} 'http://localhost:9200/_cluster/health?wait_for_status=yellow&timeout=5s' >/dev/null || exit 1"
|
|
deploy:
|
|
resources:
|
|
limits: { memory: 2g }
|
|
|
|
logstash:
|
|
environment:
|
|
# The Elasticsearch output reads its credentials from the URL.
|
|
ELASTICSEARCH_HOSTS: http://elastic:${ELASTIC_PASSWORD}@elasticsearch:9200
|
|
deploy:
|
|
resources:
|
|
limits: { memory: 1g }
|
|
|
|
kibana:
|
|
environment:
|
|
ELASTICSEARCH_USERNAME: elastic
|
|
ELASTICSEARCH_PASSWORD: ${ELASTIC_PASSWORD}
|
|
# Remove the published port: Kibana is reached through a tunnel or proxy.
|
|
ports: !reset []
|
|
deploy:
|
|
resources:
|
|
limits: { memory: 1g }
|
|
|
|
backend:
|
|
environment:
|
|
DJANGO_SETTINGS_MODULE: config.settings.prod
|
|
DJANGO_DEBUG: "false"
|
|
SECURE_SSL_REDIRECT: "true"
|
|
ELASTICSEARCH_USERNAME: elastic
|
|
ELASTICSEARCH_PASSWORD: ${ELASTIC_PASSWORD}
|
|
# A production container must never mutate data on boot.
|
|
SEED_DATASET: "false"
|
|
SEED_USERS: "false"
|
|
deploy:
|
|
replicas: 2
|
|
resources:
|
|
limits: { cpus: "1.0", memory: 768m }
|
|
|
|
frontend:
|
|
deploy:
|
|
resources:
|
|
limits: { cpus: "0.5", memory: 128m }
|
|
|
|
postgres:
|
|
deploy:
|
|
resources:
|
|
limits: { memory: 1g }
|