46 lines
2.2 KiB
Markdown
46 lines
2.2 KiB
Markdown
---
|
|
type: User Story
|
|
title: Deploy and operate the platform securely
|
|
description: Operators have repeatable builds, migrations, credential provisioning, configuration, and security checks.
|
|
tags: [operations, security, database, deployment]
|
|
timestamp: 2026-08-01T19:46:09Z
|
|
story_id: US-015
|
|
status: verified
|
|
---
|
|
|
|
# User Story
|
|
|
|
As a platform operator, I want reproducible deployment and security controls, so that the portal, bot, database, and proxy can be operated safely.
|
|
|
|
# Acceptance Criteria
|
|
|
|
- [x] The repository is an npm TypeScript workspace with separate web, bot, contract, database, network, and Minecraft modules.
|
|
- [x] PostgreSQL is available through Docker Compose for local use.
|
|
- [x] Drizzle changes use generated, versioned migrations rather than schema push.
|
|
- [x] Velocity credentials can be provisioned or rotated with a one-time-displayed token stored only as a hash.
|
|
- [x] The Velocity Gradle wrapper produces a tested shaded JAR.
|
|
- [x] Environment examples document database, Keycloak, Discord, trusted proxy, and ProxyCheck settings without secrets.
|
|
- [x] The web application sets CSP, framing, MIME, referrer, and permissions headers.
|
|
- [x] The web runtime provides a dependency-free health endpoint for orchestration probes.
|
|
- [x] npm dependency audit and Semgrep security review complete without findings at the last verified change.
|
|
- [x] Architecture, Keycloak, API error, security, bot, and Velocity operating documentation is available.
|
|
|
|
# Implementation
|
|
|
|
- [`package.json`](../package.json)
|
|
- [`compose.yml`](../compose.yml)
|
|
- [`packages/database/drizzle`](../packages/database/drizzle)
|
|
- [`packages/database/scripts/create-plugin-credential.ts`](../packages/database/scripts/create-plugin-credential.ts)
|
|
- [`plugins/velocity/build.gradle.kts`](../plugins/velocity/build.gradle.kts)
|
|
- [`apps/web/next.config.ts`](../apps/web/next.config.ts)
|
|
|
|
# Validation
|
|
|
|
Use `npm test`, `npm run typecheck`, `npm run lint`, `npm run build`, `npm run velocity:build`, `npm audit`, and `npm run design:validate`.
|
|
|
|
# Related Stories
|
|
|
|
- [Administrator SSO](us-011-admin-sso.md)
|
|
- [Standardize API errors](us-014-problem-details.md)
|
|
- [Build and publish versioned releases](us-016-automated-releases.md)
|