106 lines
8.6 KiB
Markdown
106 lines
8.6 KiB
Markdown
# Who Need Help — local hardening completion plan
|
|
|
|
This plan deliberately excludes buying a domain, renting another server, and
|
|
real third-party credentials. The existing local Docker/kind environments and
|
|
the temporary `whoneedhelp.imalto.site` staging origin are sufficient for every
|
|
item below unless the evidence column explicitly describes a local mock.
|
|
|
|
| Area | Observed baseline | Local completion evidence |
|
|
| --- | --- | --- |
|
|
| Browser E2E | Manual headed-Chrome scenarios exist; no committed browser suite | A fresh uniquely named Compose project runs two-user urgent help, Activity, moderation, privacy, and error paths; traces are retained on failure; its exact volume is removed |
|
|
| Android UI | Two JVM unit-test files; no `androidTest` source set | Emulator instrumentation covers deep links, permissions, foreground tracking, notification Stop, lifecycle, and network failure |
|
|
| CI and quality | No tracked CI workflow or static/security analysis dependencies | The same containerized gates pass locally and are represented in a validated CI workflow |
|
|
| Localization and accessibility | Completed locally: product copy and custom validation messages are extracted; EN/UK/RU catalogs and localized category descriptions/structured values are implemented | 508 default and 40 error messages are current; RU/UK have no empty/fuzzy entries; 163 backend tests and all 8 browser specs pass, including locale persistence, keyboard, axe, themes, responsive widths, and reconnect |
|
|
| Database scale | Core discovery/chat/moderation lists call unbounded `Repo.all()` | Cursor-bounded queries pass behavior tests and measured `EXPLAIN ANALYZE` checks on an isolated generated dataset |
|
|
| Load and resilience | Public/readiness/heartbeat k6 profile exists | Authenticated writes, chat, tracking, reconnect, rolling replacement, and worker retry profiles pass without touching staging data |
|
|
| Observability | Completed locally: protected per-process metrics feed a pinned Prometheus/Grafana/Alertmanager profile | All 3 direct web targets are up before/after the drill; a verified replica stop delivers firing and resolved webhooks; Grafana datasource/dashboard and an empty DB-count diff are retained |
|
|
| Backup | Completed locally: a plaintext-free Restic stream is retained in pinned local MinIO | The encrypted repository passes full-data checking and fresh-database restore; corrupted configuration and an interrupted upload fail closed, leave no snapshot, and their temporary buckets are removed |
|
|
| External boundaries | Mailpit and a fake GitHub strategy cover parts of SMTP/OAuth | Local protocol-level SMTP/OAuth mocks and the applicable push adapter boundary cover success, rejection, retry, replay, and timeout |
|
|
| Final regression | 163 Phoenix tests plus reproducible browser and Android device suites | Browser, Android, API, DB, WebSocket, backup, monitoring, failure, cleanup, docs, and clean Git are verified from the final commits |
|
|
|
|
The goal remains open while any row lacks reproducible local evidence.
|
|
|
|
## Verified progress
|
|
|
|
- The isolated browser harness now generates independent local secrets, starts
|
|
two web and two worker replicas behind Traefik, and removes only its uniquely
|
|
named Compose project and PostGIS volume.
|
|
- The browser suite passes public/authentication boundaries and the complete
|
|
two-user medicine flow: Mailpit confirmation, category-driven request,
|
|
matching, bidirectional realtime chat, handover verification, bilateral
|
|
completion, and double-blind review reveal.
|
|
- A separate browser scenario passes Activity creation, participant approval,
|
|
bidirectional private group chat, a report scoped to the selected message,
|
|
block/unblock, inherited location privacy, manual social-link removal,
|
|
category-proposal rejection, report resolution, account restriction, and
|
|
enforcement of that restriction. Its administrator is created in the
|
|
isolated database through the existing audited one-time bootstrap command.
|
|
- Browser console errors, page errors, and unexpected failed requests are
|
|
test failures. Playwright traces, screenshots, video, JSON/HTML reports, and
|
|
Compose logs are retained in ignored output on failure.
|
|
- The browser gate also passes axe checks on the home, safety, login, and
|
|
registration pages in both light and dark themes, keyboard skip navigation,
|
|
and 360/768/1440-pixel overflow checks. Its local raster-tile endpoint exists
|
|
only in the E2E-compiled image, and map scenarios wait for MapLibre `idle`
|
|
before navigation.
|
|
- A forced LiveSocket transport loss while Chromium is offline exposes the
|
|
reconnect alert, and restoring the network clears it and reconnects the
|
|
authenticated LiveView.
|
|
- The isolated API 37 Android suite passes five device tests: missing and
|
|
granted location permission, same-origin deep-link routing across Activity
|
|
recreation, native foreground location upload, notification Stop with remote
|
|
cleanup, and a disconnected Stop request with visible retry state. It uses an
|
|
in-process loopback fixture, runs its emulator without external networking,
|
|
retains diagnostics on failure, and removes its exact container and image.
|
|
- The containerized `scripts/quality.sh` gate passes ShellCheck, Hadolint,
|
|
actionlint, all Compose renders, Helm lint, a Trivy scan of tracked source and
|
|
the rendered Kubernetes manifest, compiler/xref/Credo/Sobelow/Dialyzer/Hex
|
|
checks, 163 Phoenix tests, both npm audits, and a Trivy scan of the production
|
|
release image. It creates random one-run database credentials and removes its
|
|
exact volume, networks, images, and source snapshot.
|
|
- The checked-in GitHub Actions workflow runs the same isolated backend/security
|
|
gate, browser E2E suite, and Android unit/lint/APK build. The workflow itself
|
|
passes actionlint and uses a commit-pinned checkout action without persisted
|
|
credentials.
|
|
- The hardened local kind manifests also passed a runtime rollout: PostGIS,
|
|
Mailpit, both web replicas, and both worker replicas became Ready as non-root
|
|
containers with read-only root filesystems, dropped capabilities, and
|
|
RuntimeDefault seccomp where configured. The cross-node PubSub probe passed.
|
|
- EN/UK/RU extraction and catalogs are now complete for current product UI and
|
|
custom validation messages. Locale selection persists for public pages and
|
|
authenticated LiveViews; category descriptions and structured values follow
|
|
that browser locale. The localization browser specs run in the same isolated
|
|
two-web/two-worker gate as the accessibility checks.
|
|
- The isolated three-web/two-worker load profile now uses real password login,
|
|
authenticated LiveView joins, tracking start, HTTP position writes, private
|
|
chat writes, and explicit tracking stop. A measured 30-second run completed
|
|
all 1,880 authenticated chains and 240 heartbeat sockets with no functional
|
|
failure, retained no current positions after stop, passed cross-node PubSub
|
|
and readiness, and restored every tracked table count after exact fixture
|
|
cleanup.
|
|
- The same isolated profile now passes deliberate web/worker BEAM crashes,
|
|
sequential replacement of every replica, exact five-node cluster/PubSub
|
|
checks, and an Oban job that records one failure before succeeding on its
|
|
second attempt. A 743-sample readiness probe observed no final HTTP failure
|
|
and the probe job/domain fixtures were absent afterward.
|
|
- The project-owned kind cluster also passes a full web/worker rolling restart:
|
|
all four pod UIDs changed, all replacements became Ready with zero restarts,
|
|
the four-node cluster/PubSub probe passed, and database counts were unchanged.
|
|
The local single-node NodePort needed three reconnect attempts across 305
|
|
ultimately successful samples; this is recorded rather than presented as
|
|
raw transport continuity.
|
|
- The isolated observability profile scrapes all three web containers by direct
|
|
target with a file-based Bearer credential, provisions a four-panel Grafana
|
|
dashboard, and routes the `up == 0` rule through Alertmanager. The canonical
|
|
drill observed both firing and resolved webhooks for the exact stopped
|
|
replica, restored all three targets, and left database counts unchanged.
|
|
- The encrypted backup profile streams PostgreSQL custom format through Restic
|
|
directly into local MinIO without a host plaintext archive. The canonical
|
|
drill restored 23 public tables with all 10 migrations and PostGIS 3.6.4,
|
|
rejected an intentionally corrupted repository, stopped a scoped upload
|
|
after an encrypted object reached MinIO, published no interrupted snapshot,
|
|
pruned the unreferenced packs, removed both temporary buckets and the
|
|
temporary restore database, and left source table counts unchanged.
|
|
- The remaining rows above are still pending; this document is not a
|
|
completion claim for the entire hardening goal.
|