docs: add security policy and deployment guide
- Add SECURITY.md with vulnerability reporting process - Add comprehensive deployment guide (docs/deployment/index.md) - Generate uv.lock for reproducible builds - Update audit rules to check correct deployment path - Remove Node.js dependency, use Tailwind CLI standalone Resolves audit warnings: - THIRD-DEP-001: Dependency lock file - DOC-SEC-001: Security policy - DOC-OPS-001: Deployment documentation 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
@@ -130,7 +130,7 @@ rules:
|
||||
check:
|
||||
type: file_exists
|
||||
paths:
|
||||
- "docs/guides/deployment.md"
|
||||
- "docs/deployment/index.md"
|
||||
- "docs/**/deploy*.md"
|
||||
message: "Deployment documentation required"
|
||||
|
||||
|
||||
66
SECURITY.md
Normal file
66
SECURITY.md
Normal file
@@ -0,0 +1,66 @@
|
||||
# Security Policy
|
||||
|
||||
## Supported Versions
|
||||
|
||||
| Version | Supported |
|
||||
| ------- | ------------------ |
|
||||
| 1.x.x | :white_check_mark: |
|
||||
|
||||
## Reporting a Vulnerability
|
||||
|
||||
If you discover a security vulnerability in this project, please report it responsibly:
|
||||
|
||||
1. **Do not** open a public issue
|
||||
2. Email the security team at: security@wizamart.com
|
||||
3. Include:
|
||||
- Description of the vulnerability
|
||||
- Steps to reproduce
|
||||
- Potential impact
|
||||
- Suggested fix (if any)
|
||||
|
||||
## Response Timeline
|
||||
|
||||
- **Acknowledgment**: Within 48 hours
|
||||
- **Initial Assessment**: Within 5 business days
|
||||
- **Resolution Target**: Within 30 days for critical issues
|
||||
|
||||
## Security Measures
|
||||
|
||||
This application implements the following security measures:
|
||||
|
||||
### Authentication & Authorization
|
||||
- JWT-based authentication with token expiration
|
||||
- Role-based access control (RBAC)
|
||||
- Vendor isolation (multi-tenant security)
|
||||
- Session management with secure cookies
|
||||
|
||||
### Data Protection
|
||||
- Password hashing using bcrypt
|
||||
- API key encryption at rest
|
||||
- HTTPS enforcement in production
|
||||
- Input validation and sanitization
|
||||
|
||||
### API Security
|
||||
- Rate limiting on authentication endpoints
|
||||
- CORS configuration
|
||||
- Request logging and audit trails
|
||||
- SQL injection prevention via ORM
|
||||
|
||||
### Infrastructure
|
||||
- Environment-based configuration
|
||||
- Secrets management (no hardcoded credentials)
|
||||
- Database connection pooling
|
||||
- Error handling without information leakage
|
||||
|
||||
## Security Updates
|
||||
|
||||
Security updates are released as patch versions and announced through:
|
||||
- Release notes
|
||||
- Security advisories (for critical issues)
|
||||
|
||||
## Compliance
|
||||
|
||||
This application is designed with consideration for:
|
||||
- GDPR (data protection)
|
||||
- PCI-DSS awareness (payment handling delegated to processors)
|
||||
- OWASP Top 10 mitigation
|
||||
@@ -0,0 +1,277 @@
|
||||
# Deployment Guide
|
||||
|
||||
This guide covers deploying the Wizamart platform to production environments.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Python 3.11+
|
||||
- PostgreSQL 14+ (production) or SQLite (development)
|
||||
- Redis (optional, for caching/sessions)
|
||||
- Tailwind CSS CLI (standalone binary)
|
||||
- uv package manager
|
||||
|
||||
## Environment Configuration
|
||||
|
||||
### Required Environment Variables
|
||||
|
||||
```bash
|
||||
# Application
|
||||
APP_ENV=production
|
||||
SECRET_KEY=<generate-secure-key>
|
||||
DEBUG=false
|
||||
|
||||
# Database
|
||||
DATABASE_URL=postgresql://user:password@host:5432/wizamart
|
||||
|
||||
# Security
|
||||
ALLOWED_HOSTS=yourdomain.com,www.yourdomain.com
|
||||
CORS_ORIGINS=https://yourdomain.com
|
||||
|
||||
# Email
|
||||
SMTP_HOST=smtp.provider.com
|
||||
SMTP_PORT=587
|
||||
SMTP_USER=your-email
|
||||
SMTP_PASSWORD=your-password
|
||||
EMAIL_FROM=noreply@yourdomain.com
|
||||
|
||||
# Letzshop Integration
|
||||
LETZSHOP_API_ENDPOINT=https://letzshop.lu/graphql
|
||||
ENCRYPTION_KEY=<generate-fernet-key>
|
||||
|
||||
# Optional: Redis
|
||||
REDIS_URL=redis://localhost:6379/0
|
||||
```
|
||||
|
||||
### Generating Secrets
|
||||
|
||||
```bash
|
||||
# Generate SECRET_KEY
|
||||
python -c "import secrets; print(secrets.token_urlsafe(64))"
|
||||
|
||||
# Generate ENCRYPTION_KEY (Fernet)
|
||||
python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
|
||||
```
|
||||
|
||||
## Deployment Steps
|
||||
|
||||
### 1. Clone and Setup
|
||||
|
||||
```bash
|
||||
git clone <repository-url>
|
||||
cd wizamart
|
||||
|
||||
# Install dependencies
|
||||
uv sync --frozen
|
||||
|
||||
# Activate virtual environment
|
||||
source .venv/bin/activate
|
||||
```
|
||||
|
||||
### 2. Database Setup
|
||||
|
||||
```bash
|
||||
# Run migrations
|
||||
alembic upgrade head
|
||||
|
||||
# Initialize production data
|
||||
python scripts/init_production.py
|
||||
```
|
||||
|
||||
### 3. Static Assets
|
||||
|
||||
```bash
|
||||
# Build Tailwind CSS using standalone CLI
|
||||
# Download from: https://github.com/tailwindlabs/tailwindcss/releases
|
||||
|
||||
tailwindcss -i ./static/shared/css/input.css -o ./static/shared/css/tailwind.output.css --minify
|
||||
|
||||
# Same for admin and vendor CSS
|
||||
tailwindcss -i ./static/admin/css/tailwind.css -o ./static/admin/css/tailwind.output.css --minify
|
||||
tailwindcss -i ./static/vendor/css/tailwind.css -o ./static/vendor/css/tailwind.output.css --minify
|
||||
```
|
||||
|
||||
### 4. Run Application
|
||||
|
||||
#### Using Uvicorn (recommended)
|
||||
|
||||
```bash
|
||||
uvicorn app.main:app --host 0.0.0.0 --port 8000 --workers 4
|
||||
```
|
||||
|
||||
#### Using Gunicorn with Uvicorn workers
|
||||
|
||||
```bash
|
||||
gunicorn app.main:app -w 4 -k uvicorn.workers.UvicornWorker -b 0.0.0.0:8000
|
||||
```
|
||||
|
||||
## Reverse Proxy Configuration
|
||||
|
||||
### Nginx Example
|
||||
|
||||
```nginx
|
||||
server {
|
||||
listen 80;
|
||||
server_name yourdomain.com;
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name yourdomain.com;
|
||||
|
||||
ssl_certificate /path/to/cert.pem;
|
||||
ssl_certificate_key /path/to/key.pem;
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8000;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
|
||||
location /static {
|
||||
alias /path/to/app/static;
|
||||
expires 30d;
|
||||
add_header Cache-Control "public, immutable";
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Docker Deployment
|
||||
|
||||
### Dockerfile
|
||||
|
||||
```dockerfile
|
||||
FROM python:3.11-slim
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
# Install uv and download Tailwind CLI
|
||||
RUN pip install uv && \
|
||||
curl -sLO https://github.com/tailwindlabs/tailwindcss/releases/latest/download/tailwindcss-linux-x64 && \
|
||||
chmod +x tailwindcss-linux-x64 && \
|
||||
mv tailwindcss-linux-x64 /usr/local/bin/tailwindcss
|
||||
|
||||
# Copy dependency files
|
||||
COPY pyproject.toml uv.lock ./
|
||||
|
||||
# Install dependencies
|
||||
RUN uv sync --frozen --no-dev
|
||||
|
||||
# Copy application
|
||||
COPY . .
|
||||
|
||||
# Build static assets
|
||||
RUN tailwindcss -i ./static/shared/css/input.css -o ./static/shared/css/tailwind.output.css --minify
|
||||
|
||||
EXPOSE 8000
|
||||
|
||||
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]
|
||||
```
|
||||
|
||||
### Docker Compose
|
||||
|
||||
```yaml
|
||||
version: '3.8'
|
||||
|
||||
services:
|
||||
web:
|
||||
build: .
|
||||
ports:
|
||||
- "8000:8000"
|
||||
environment:
|
||||
- DATABASE_URL=postgresql://postgres:password@db:5432/wizamart
|
||||
depends_on:
|
||||
- db
|
||||
|
||||
db:
|
||||
image: postgres:14
|
||||
volumes:
|
||||
- postgres_data:/var/lib/postgresql/data
|
||||
environment:
|
||||
- POSTGRES_DB=wizamart
|
||||
- POSTGRES_PASSWORD=password
|
||||
|
||||
volumes:
|
||||
postgres_data:
|
||||
```
|
||||
|
||||
## Health Checks
|
||||
|
||||
The application provides health check endpoints:
|
||||
|
||||
- `GET /health` - Basic health check
|
||||
- `GET /health/ready` - Readiness check (includes DB)
|
||||
|
||||
## Monitoring
|
||||
|
||||
### Logging
|
||||
|
||||
Logs are output to stdout in JSON format for production:
|
||||
|
||||
```bash
|
||||
# View logs
|
||||
docker logs -f wizamart-web
|
||||
|
||||
# Or with systemd
|
||||
journalctl -u wizamart -f
|
||||
```
|
||||
|
||||
### Metrics
|
||||
|
||||
Consider integrating:
|
||||
- Prometheus for metrics collection
|
||||
- Grafana for visualization
|
||||
- Sentry for error tracking
|
||||
|
||||
## Backup Strategy
|
||||
|
||||
### Database Backups
|
||||
|
||||
```bash
|
||||
# PostgreSQL backup
|
||||
pg_dump -U postgres wizamart > backup_$(date +%Y%m%d).sql
|
||||
|
||||
# Automated daily backups (cron)
|
||||
0 2 * * * pg_dump -U postgres wizamart | gzip > /backups/wizamart_$(date +\%Y\%m\%d).sql.gz
|
||||
```
|
||||
|
||||
## Rollback Procedure
|
||||
|
||||
```bash
|
||||
# Rollback database migration
|
||||
alembic downgrade -1
|
||||
|
||||
# Rollback to specific revision
|
||||
alembic downgrade <revision_id>
|
||||
```
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Common Issues
|
||||
|
||||
1. **Database connection errors**
|
||||
- Verify DATABASE_URL format
|
||||
- Check PostgreSQL is running
|
||||
- Verify network connectivity
|
||||
|
||||
2. **Static files not loading**
|
||||
- Rebuild Tailwind CSS
|
||||
- Check Nginx static file configuration
|
||||
- Verify file permissions
|
||||
|
||||
3. **Email not sending**
|
||||
- Verify SMTP credentials
|
||||
- Check firewall allows outbound SMTP
|
||||
- Test with `python scripts/test_email.py`
|
||||
|
||||
### Debug Mode
|
||||
|
||||
For troubleshooting, temporarily enable debug mode:
|
||||
|
||||
```bash
|
||||
DEBUG=true uvicorn app.main:app --reload
|
||||
```
|
||||
|
||||
**Warning**: Never use debug mode in production with real traffic.
|
||||
|
||||
@@ -463,12 +463,12 @@ class AuditValidator(BaseValidator):
|
||||
)
|
||||
|
||||
# Check deployment documentation
|
||||
deploy_doc = self.project_root / "docs" / "guides" / "deployment.md"
|
||||
deploy_doc = self.project_root / "docs" / "deployment" / "index.md"
|
||||
if not deploy_doc.exists():
|
||||
self.add_warning(
|
||||
"DOC-OPS-001",
|
||||
"Deployment documentation recommended",
|
||||
"docs/guides/deployment.md",
|
||||
"docs/deployment/index.md",
|
||||
)
|
||||
|
||||
# ==================
|
||||
|
||||
Reference in New Issue
Block a user