424e692ee0
Exporters: - postgres_exporter: DB connections, transactions, cache hit ratio, query stats - node_exporter: host CPU, memory, disk, network - cAdvisor: per-container CPU and memory usage PostgreSQL: - Enable pg_stat_statements for query-level performance tracking - Track index scans vs sequential scans, cache hit ratio Dashboard (service-health.json): - DB: connections, size, transactions/s, slow queries, cache hit ratio, index usage - Host: disk gauge, CPU, memory, network I/O, disk I/O - BRouter: request latency p50/p95/p99, container CPU + memory - All containers: CPU and memory comparison Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
27 lines
1.3 KiB
Markdown
27 lines
1.3 KiB
Markdown
## MODIFIED Requirements
|
|
|
|
### Requirement: CI/CD pipeline
|
|
GitHub Actions SHALL use separate workflows for app deployment and infrastructure deployment, with secrets decrypted from a SOPS-encrypted file.
|
|
|
|
#### Scenario: App deployment
|
|
- **WHEN** code changes are pushed to main in apps/ or packages/
|
|
- **THEN** the cd-apps workflow builds Docker images, pushes to ghcr.io, and deploys app containers
|
|
|
|
#### Scenario: Infrastructure deployment
|
|
- **WHEN** changes are pushed to main in infrastructure/
|
|
- **THEN** the cd-infra workflow copies configs and restarts infrastructure services without rebuilding app images
|
|
|
|
#### Scenario: Secret decryption at deploy time
|
|
- **WHEN** either CD workflow runs
|
|
- **THEN** the SOPS-encrypted secrets file is decrypted and provided to docker-compose as an env file
|
|
|
|
### Requirement: Grafana authentication
|
|
Grafana SHALL authenticate users via GitHub OAuth, restricted to the trails-cool GitHub organization.
|
|
|
|
#### Scenario: GitHub OAuth login
|
|
- **WHEN** a user navigates to grafana.internal.trails.cool
|
|
- **THEN** they are redirected to GitHub for authentication and granted access if they are a member of the trails-cool organization
|
|
|
|
#### Scenario: No password-based login
|
|
- **WHEN** Grafana is deployed
|
|
- **THEN** the login form is disabled and only GitHub OAuth is available
|