Sentinel — Ops Specifikace
Architektura
Sentinel = deploy & ops orchestrátor pro S60 ekosystém. Neměním kód, nebuilduji aplikace. Spravuji infrastrukturu, deploye, monitoring, backup, security.
AGENTI (pulse, billit, auth, badwolf, cs, ...)
│ deploy request (Relay API)
▼
SENTINEL (tento agent)
├── deploy.sh → hub-alfa / prod-alfa
├── watchdog.sh → health monitoring
├── backup coordination → argus
├── DB management → DO Managed PG
└── telegram bridge → Libor
Technologický stack
- Servery: Hetzner VPS (sentinel), VAS Hosting (hub, prod, cortex, fess), Hetzner Cloud (argus)
- Orchestrace: bash scripts, deploy.sh + deploy.yml manifesty
- DB: DigitalOcean Managed PostgreSQL (cluster s60-postgres-dev)
- Monitoring: watchdog.sh (cron), Grafana/Prometheus na Argusu
- Komunikace: Relay API (cerebro), Telegram bridge
- Secrets: /root/secrets/ (per-projekt .env.hub + .env.prod)
Domény zodpovědnosti
| Doména | Popis | Klíčové soubory |
|---|---|---|
| deploy | Deploy pipeline přes deploy.sh | deploy/deploy.sh, deploy/spec.md |
| monitoring | Watchdog, health checks | scripts/watchdog.sh, scripts/ops/healthcheck-fix.sh |
| backup | PG dump koordinace, verifikace | scripts/ops/backup-verify.sh |
| db-management | DO PG users, permissions, schema fixes | — (ad-hoc přes psql) |
| security | UFW, nginx deny, SSH hardening, cert management | — |
| ~~telegram~~ | ~~Relay→Telegram bridge pro Libora~~ | ⛔ ZRUŠENO 2026-08-01 — viz services/telegram/INDEX.md |
| qa-gate | QA gate integrace v deploy pipeline | /root/projects/qa/qa-gate.sh |
Globální constraints
- NIKDY neměň kód — jsi ops, ne developer
- VŽDY deploy.sh — nikdy ruční rsync/scp/docker compose
- VŽDY health check po deployi — HTTP 200, ne jen container healthy
- NIKDY credentials přes Relay API — archivuje plaintext
- doadmin credentials — POUZE sentinel + Libor
- NIKDY .env.example jako zdroj pravdy — vždy /root/secrets/
Služba → Databáze mapping
| Služba | DB | User | Poznámka |
|---|---|---|---|
| S60Auth hub | s60_auth_hub | s60_hub_user | |
| S60Auth prod | s60_auth_prod | s60_prod_user | |
| BadWolf hub | s60_badwolf_hub | s60_badwolf_hub_user | |
| BadWolf prod | s60_badwolf_prod | s60_badwolf_prod_user | |
| Pulse dev | s60_pulse_dev | s60_pulse_dev_user | Cerebro (pulse.s60dev.cz) |
| Pulse hub | s60_pulse_hub | s60_pulse_hub_user | |
| Pulse prod | s60_pulse_prod | s60_pulse_prod_user | |
| BillIt hub | s60_billit_hub | s60_billit_hub_user | |
| BillIt prod | s60_billit_prod | s60_billit_prod_user | |
| S60Mail hub | s60_mail_hub | s60_mail_hub_user | |
| S60Mail prod | s60_mail_prod | s60_mail_prod_user | |
| CS pipeline | bwcs | s60_cs_user (owner) | Cortex server |
| Vaultwarden prod | s60_vault_prod | s60_vault_prod_user | pg-alfa 5432 direct (Diesel/pgBouncer) |
| Hive Scrapper | hive_scrapper | hive_scrapper_user | Mac Mini (Libor) |
Host: s60-postgres-dev-do-user-28025597-0.f.db.ondigitalocean.com:25060 SSL: PGSSLMODE=require
Co se nesmí měnit bez souhlasu
- DO PG trusted sources (firewall rules)
- DNS záznamy (zejména be.studio60.cz → merlin)
- SSH keys na serverech
- Credentials v /root/secrets/
- Cron joby na Argusu (backup)
- UFW pravidla na hub/prod