424e692ee0
Exporters: - postgres_exporter: DB connections, transactions, cache hit ratio, query stats - node_exporter: host CPU, memory, disk, network - cAdvisor: per-container CPU and memory usage PostgreSQL: - Enable pg_stat_statements for query-level performance tracking - Track index scans vs sequential scans, cache hit ratio Dashboard (service-health.json): - DB: connections, size, transactions/s, slow queries, cache hit ratio, index usage - Host: disk gauge, CPU, memory, network I/O, disk I/O - BRouter: request latency p50/p95/p99, container CPU + memory - All containers: CPU and memory comparison Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
16 lines
752 B
Markdown
16 lines
752 B
Markdown
## Requirements
|
|
|
|
### Requirement: Encrypted secrets in repository
|
|
Production secrets SHALL be stored as a SOPS-encrypted file in the repository, decryptable only with a single age private key.
|
|
|
|
#### Scenario: Edit secrets
|
|
- **WHEN** a developer runs `sops infrastructure/secrets.env`
|
|
- **THEN** the file is decrypted in a temporary editor, and re-encrypted on save
|
|
|
|
#### Scenario: CD decryption
|
|
- **WHEN** the CD workflow runs
|
|
- **THEN** the encrypted secrets file is decrypted using the AGE_SECRET_KEY GitHub secret and provided to docker-compose as an env file
|
|
|
|
#### Scenario: Secret audit trail
|
|
- **WHEN** a secret is changed
|
|
- **THEN** the change appears in git history as a diff of the encrypted file with a commit message describing what changed
|