Skip to content

infrastructure-validation.md

Latest commit

 

History

History
72 lines (60 loc) · 4.69 KB

infrastructure-validation.md

File metadata and controls

72 lines (60 loc) · 4.69 KB
Raw

Vault and native infrastructure validation

This branch is based on main at c904d71ef8a7541885cbbe887f25148e196ef768. It contains the infrastructure replacement, adapted to the committed service module names. The owner's uncommitted module renames, Identity refactor, Wallet edits, and local tooling remain outside the branch. No live database, Vault state, or deployment was accessed.

Scope

  • Compose manages PostgreSQL 18, Vault, dependencies, networks, application Agents and independent Agent/Flyway migration jobs. Existing persistent volumes have explicit external names.
  • Vault Agent handles AppRole authentication, token/credential renewal and application restart on credential replacement. Java consumes Agent token files for scoped KV access.
  • Ansible replaces preparation, provisioning, initialization, migration orchestration, import, identity refresh, backup and recovery launchers. The root scripts/ directory and custom Java migration/import/leased-datasource implementations are removed.
  • The four existing versioned PostgreSQL SQL files are byte-for-byte unchanged; their hashes are recorded in infrastructure/migrations.sha256. Wallet receives a separate V1 marker, not a financial persistence implementation.
  • Identity import and privilege checks retain identity_challenge, identity_audit_log, and identity_challenge_scope. No SQL from the owner's unfinished Identity refactor is imported.
  • Existing Identity KV scoping and pepper-rotation tests are retained. Their fixture helper now requires Agent-delivered token paths in PAYGUARD_REHEARSAL_OPERATOR_TOKEN_FILE, PAYGUARD_REHEARSAL_IDENTITY_TOKEN_FILE, and PAYGUARD_REHEARSAL_WALLET_TOKEN_FILE. Those live Vault tests were not executed here.

Executed checks

Check Result Limit
Offline deployment/security contracts PASS, 18 tests Configuration and HCL/TOML parsing, not live leases
Compose base/application/migration/operations configuration PASS Compose 2.40.3; no daemon
Compose production overlay configuration PASS Dummy external broker hosts and CA paths
Ansible playbook syntax PASS, 21 entry points preflight.yml is an imported task list, not a playbook
Fresh preparation PASS OpenSSL and Ansible on a new isolated fixture
Repeated fresh preparation PASS, safely refused Generated bytes unchanged; private keys/passwords/config 0600, directories 0700
Existing versioned PostgreSQL SQL PASS, 4 files unchanged No live Flyway history available
Shared Agent token/TLS/error-sanitization Java tests PASS, 5 tests No live Vault; repository style goals skipped for this run
Application packaging and test-source compilation PASS, all four services Runtime tests skipped; Spotless/Checkstyle bypassed in this packaging run
Reactor Maven validation PASS Spotless and Checkstyle for parent/shared/four services; PMD/SpotBugs not run
Changed Java formatting PASS Google Java Format 1.30.0
Original checkout WIP preservation PASS Original status, staging state and file hashes unchanged

The Java test command used JDK 25 and the repository Maven wrapper:

./mvnw -B -ntp -pl payguard-shared \
  -Dspotless.skip=true -Dcheckstyle.skip=true \
  -Dtest=AgentTokenClientTest,PostgreSqlTlsTest,SanitizedDependencyErrorTest test
python3 -m unittest discover -s infrastructure/tests -v

Dependency downloads used private, workspace-only proxy settings and the system Java trust store. TLS verification remained enabled; proxy settings and generated secrets are not committed.

Required live acceptance

The reusable native infrastructure CI workflow runs on an isolated Docker host. It prepares separate volumes, provisions Vault/databases, migrates every database twice, verifies privileges, starts the applications and rehearses a Vault outage. The workflow is executable test scaffolding, not evidence that those jobs have passed.

Production acceptance remains incomplete. Run integration, permission-denial, TLS failure, Agent renewal/reauthentication, credential replacement, interrupted migration/recovery, backup/restore, import rollback and business end-to-end tests before deployment. Test held SQL transactions and Vault outages explicitly; credential expiration does not terminate every already executing database statement. Complete paired PostgreSQL/Raft restoration and check existing records, histories, ownership and secret versions on isolated recovery volumes.

Base Kafka is a local plaintext rehearsal broker. The production overlay requires authenticated TLS external Redis/Kafka and verified CA/hostname settings. This is a single-host deployment building block, not a tested highly available database or Vault deployment.