gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(structure): promote app to repo root + remove redundant workspace cruft

Browse Source 
Standard production layout: the OKR app (was nested under AINative_OKR_CASAN5/) is now
the repository root. No more wrapper directory.

- Promote AINative_OKR_CASAN5/* -> repo root (backend/ frontend/ packages/ apps/
  .specify/ docs/ infra/ nginx/ scripts/ + configs). Merge tool dirs: .gitea (kept the
  active deploy ci.yml, added harness-ci.yml + runbooks), .claude (agents/commands +
  launch.json), .github moved up.
- Remove redundant: 00_SUBMISSION_PACKAGE, scattered root notes (FPT_CASAN_Full.md,
  tu-tuong-casan.md, casan-tu-sinh..., casan_harness_assessment.md, source-review...,
  README_CASAN5_REFINED.md), casan-next-plans/ and optimize-docs/ (competition/planning
  artifacts — roadmap + design history preserved in git log / commit messages).
- Update all references to the old layout:
  - .gitea/workflows/{ci,harness-ci}.yml, .github/workflows/{ci,deploy}.yml:
    working-directory .; drop AINative_OKR_CASAN5/ prefix; .specify/{tests,scripts}
    -> packages/casan-harness/... (.specify/logs state kept)
  - .claude/launch.json, .gitea/*-runbook.md: path prefixes
  - CLAUDE.md, README.md: docs/input -> apps/okr/domain/input
  - policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest re-signed
- secrets-scan.sh: fixture excludes -> new package/domain paths.

Full gate from the new root: PASS=64 FAIL=0 SKIP=3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thanhnv
2026-07-08 13:26:36 +09:00
co-authored by Claude Opus 4.8
parent 7101af9fd4
commit 36a4812ef3
925 changed files with 410 additions and 18001 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/local-prod/README.md
+29
View File
@@ -0,0 +1,29 @@
# CASAN Local Production-Like Infra Lab
This Docker Compose stack emulates the external infrastructure needed to move
CASAN Tier 2 from "needs infra" to locally testable production-like controls.
## Services
| Service | Local URL | Purpose |
|---|---|---|
| Vault dev | `http://127.0.0.1:18200` | KMS Transit signing/rotation/non-exportable keys |
| Mock IdP/OIDC | `http://127.0.0.1:18081` | RS256 JWT + JWKS for approval identity |
| MinIO | `http://127.0.0.1:19090` | S3-compatible WORM/Object Lock emulation |
| MinIO Console | `http://127.0.0.1:19091` | Object store admin UI |
| Alert webhook | `http://127.0.0.1:19092` | Slack/PagerDuty-style webhook emulator |
| Billing API mock | `http://127.0.0.1:19093/usage` | Provider usage API emulator |
| Dashboard via nginx | `http://127.0.0.1:18080` | Dashboard behind basic auth (`casan` / `casan`) |
## Commands
```bash
bash .specify/scripts/bash/infra-lab.sh start
bash .specify/scripts/bash/infra-lab.sh verify
bash .specify/scripts/bash/infra-lab.sh env
bash .specify/scripts/bash/infra-lab.sh stop
```
This is a lab, not a compliance claim. AWS S3 Object Lock, real enterprise IdP,
CloudHSM, PagerDuty/Slack, and OpenAI/Anthropic billing APIs still need real
managed services and credentials before claiming production Strong readiness.
infra/local-prod/docker-compose.yml
+140
View File
@@ -0,0 +1,140 @@
name: casan-local-prod
services:
vault:
image: hashicorp/vault:1.15
cap_add:
- IPC_LOCK
environment:
VAULT_DEV_ROOT_TOKEN_ID: root
VAULT_DEV_LISTEN_ADDRESS: 0.0.0.0:8200
ports:
- "18200:8200"
healthcheck:
test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1:8200/v1/sys/health"]
interval: 5s
timeout: 3s
retries: 20
idp:
build:
context: ./idp
environment:
CASAN_IDP_PORT: "8080"
CASAN_IDP_ISSUER: http://127.0.0.1:18081
ports:
- "18081:8080"
healthcheck:
test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=2)"]
interval: 5s
timeout: 3s
retries: 20
minio:
image: minio/minio:RELEASE.2025-09-07T16-13-09Z
command: server /data --console-address ":9001"
environment:
MINIO_ROOT_USER: casanadmin
MINIO_ROOT_PASSWORD: casanadmin123
MINIO_BROWSER_REDIRECT_URL: http://127.0.0.1:19091
ports:
- "19090:9000"
- "19091:9001"
volumes:
- minio-data:/data
healthcheck:
test: ["CMD", "curl", "-fsS", "http://127.0.0.1:9000/minio/health/live"]
interval: 5s
timeout: 3s
retries: 20
minio-init:
image: minio/mc:RELEASE.2025-08-13T08-35-41Z
depends_on:
minio:
condition: service_healthy
entrypoint: /bin/sh
command:
- -c
- |
set -eu
mc alias set local http://minio:9000 casanadmin casanadmin123
mc mb --ignore-existing --with-lock local/casan-worm
mc retention set --default COMPLIANCE 1d local/casan-worm
mc anonymous set none local/casan-worm
echo MINIO_WORM_READY bucket=casan-worm mode=COMPLIANCE retention=1d
minio-mc:
image: minio/mc:RELEASE.2025-08-13T08-35-41Z
profiles: ["tools"]
depends_on:
minio:
condition: service_healthy
entrypoint: /bin/sh
alert-webhook:
build:
context: ./mock-http
command: ["python", "/app/mock_http.py", "alert"]
environment:
CASAN_MOCK_PORT: "8080"
ports:
- "19092:8080"
healthcheck:
test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=2)"]
interval: 5s
timeout: 3s
retries: 20
billing-api:
build:
context: ./mock-http
command: ["python", "/app/mock_http.py", "billing"]
environment:
CASAN_MOCK_PORT: "8080"
ports:
- "19093:8080"
healthcheck:
test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=2)"]
interval: 5s
timeout: 3s
retries: 20
dashboard:
image: python:3.12-slim
working_dir: /workspace
command: ["python", "packages/casan-harness/scripts/bash/dashboard-server.py", "8787"]
environment:
CASAN_DASHBOARD_BIND: 0.0.0.0
CASAN_DASHBOARD_STALE_S: "315360000"
CASAN_DASHBOARD_METRICS: /workspace/.specify/logs/cost/metrics.jsonl
CASAN_DASHBOARD_HTML: /workspace/docs/output/casan/central-agentops-dashboard.html
CASAN_DASHBOARD_ALERTS: /workspace/.specify/agentops/alerts.log
volumes:
- ../..:/workspace:ro
expose:
- "8787"
healthcheck:
test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8787/healthz', timeout=2)"]
interval: 5s
timeout: 3s
retries: 20
dashboard-nginx:
image: nginx:1.27-alpine
depends_on:
dashboard:
condition: service_healthy
ports:
- "18080:80"
volumes:
- ./nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
- ./nginx/htpasswd:/etc/nginx/.htpasswd:ro
healthcheck:
test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1/healthz"]
interval: 5s
timeout: 3s
retries: 20
volumes:
minio-data:
infra/local-prod/idp/Dockerfile
+7
View File
@@ -0,0 +1,7 @@
FROM python:3.12-slim
RUN pip install --no-cache-dir "pyjwt[crypto]==2.10.1"
WORKDIR /app
COPY mock_idp.py /app/mock_idp.py
EXPOSE 8080
CMD ["python", "/app/mock_idp.py"]
infra/local-prod/idp/mock_idp.py
+94
View File
@@ -0,0 +1,94 @@
#!/usr/bin/env python3
import json
import os
import time
from http.server import BaseHTTPRequestHandler, HTTPServer
from urllib.parse import urlparse
import jwt
from cryptography.hazmat.primitives.asymmetric import rsa
PORT = int(os.environ.get("CASAN_IDP_PORT", "8080"))
ISSUER = os.environ.get("CASAN_IDP_ISSUER", f"http://127.0.0.1:{PORT}")
KID = "casan-local-prod-idp"
KEY = rsa.generate_private_key(public_exponent=65537, key_size=2048)
def b64u_int(value: int) -> str:
raw = value.to_bytes((value.bit_length() + 7) // 8, "big")
import base64
return base64.urlsafe_b64encode(raw).decode().rstrip("=")
def jwk():
numbers = KEY.public_key().public_numbers()
return {
"kty": "RSA",
"use": "sig",
"alg": "RS256",
"kid": KID,
"n": b64u_int(numbers.n),
"e": b64u_int(numbers.e),
}
class Handler(BaseHTTPRequestHandler):
def send_json(self, code, payload):
body = json.dumps(payload).encode()
self.send_response(code)
self.send_header("Content-Type", "application/json")
self.send_header("Content-Length", str(len(body)))
self.end_headers()
self.wfile.write(body)
def do_GET(self): # noqa: N802
path = urlparse(self.path).path
if path == "/healthz":
self.send_json(200, {"status": "ok", "issuer": ISSUER})
elif path == "/.well-known/openid-configuration":
self.send_json(
200,
{
"issuer": ISSUER,
"jwks_uri": f"{ISSUER}/.well-known/jwks.json",
"token_endpoint": f"{ISSUER}/token",
"id_token_signing_alg_values_supported": ["RS256"],
},
)
elif path == "/.well-known/jwks.json":
self.send_json(200, {"keys": [jwk()]})
else:
self.send_json(404, {"error": "not_found"})
def do_POST(self): # noqa: N802
if urlparse(self.path).path != "/token":
self.send_json(404, {"error": "not_found"})
return
size = int(self.headers.get("Content-Length", "0"))
try:
payload = json.loads(self.rfile.read(size) or b"{}")
except json.JSONDecodeError:
self.send_json(400, {"error": "invalid_json"})
return
now = int(time.time())
claims = {
"iss": ISSUER,
"sub": payload.get("sub", "oidc-ops"),
"role": payload.get("role", "ops"),
"action": payload.get("action", "deploy"),
"actor": payload.get("actor", "alice"),
"input_sha256": payload.get("input_sha256", ""),
"iat": now,
"exp": now + int(payload.get("ttl_s", 300)),
}
token = jwt.encode(claims, KEY, algorithm="RS256", headers={"kid": KID})
self.send_json(200, {"access_token": token, "token_type": "Bearer", "expires_in": claims["exp"] - now})
def log_message(self, *args):
pass
if __name__ == "__main__":
HTTPServer(("0.0.0.0", PORT), Handler).serve_forever()
infra/local-prod/mock-http/Dockerfile
+5
View File
@@ -0,0 +1,5 @@
FROM python:3.12-slim
WORKDIR /app
COPY mock_http.py /app/mock_http.py
EXPOSE 8080
infra/local-prod/mock-http/mock_http.py
+68
View File
@@ -0,0 +1,68 @@
#!/usr/bin/env python3
import json
import os
import sys
from http.server import BaseHTTPRequestHandler, HTTPServer
from urllib.parse import urlparse
MODE = sys.argv[1] if len(sys.argv) > 1 else "alert"
PORT = int(os.environ.get("CASAN_MOCK_PORT", "8080"))
EVENTS = []
USAGE = [
{
"provider": "local-prod-mock",
"model": "billing-api-emulator",
"run_id": "infra-lab-run",
"step": "speckit.implement",
"input_tokens": 1842,
"output_tokens": 936,
"total_tokens": 2778,
"cost_usd": 0.08334,
"latency_ms": 4210,
"status": "success",
}
]
class Handler(BaseHTTPRequestHandler):
def send_json(self, code, payload):
body = json.dumps(payload).encode()
self.send_response(code)
self.send_header("Content-Type", "application/json")
self.send_header("Content-Length", str(len(body)))
self.end_headers()
self.wfile.write(body)
def do_GET(self): # noqa: N802
path = urlparse(self.path).path
if path == "/healthz":
self.send_json(200, {"status": "ok", "mode": MODE, "events": len(EVENTS)})
elif MODE == "alert" and path == "/events":
self.send_json(200, EVENTS)
elif MODE == "billing" and path in ("/usage", "/v1/usage"):
self.send_json(200, USAGE)
else:
self.send_json(404, {"error": "not_found"})
def do_POST(self): # noqa: N802
if MODE != "alert":
self.send_json(404, {"error": "not_found"})
return
size = int(self.headers.get("Content-Length", "0"))
raw = self.rfile.read(size)
try:
payload = json.loads(raw or b"{}")
except json.JSONDecodeError:
payload = {"raw": raw.decode(errors="replace")}
EVENTS.append(payload)
self.send_json(200, {"ok": True, "events": len(EVENTS)})
def log_message(self, *args):
pass
if __name__ == "__main__":
HTTPServer(("0.0.0.0", PORT), Handler).serve_forever()
infra/local-prod/nginx/default.conf
+17
View File
@@ -0,0 +1,17 @@
server {
listen 80;
server_name _;
location = /healthz {
proxy_pass http://dashboard:8787/healthz;
}
location / {
auth_basic "CASAN local-prod dashboard";
auth_basic_user_file /etc/nginx/.htpasswd;
proxy_pass http://dashboard:8787;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
infra/local-prod/nginx/htpasswd
+1
View File
@@ -0,0 +1 @@
casan:$apr1$bCe9E6jA$7NdeZUhyLMXXWGe9RCCY1/