feat: add production deployment handoff controls

docker-compose.control-panel.yml

@@ -1,8 +1,7 @@
-# Production-oriented Control Panel scaffold.
-# Requires:
-#   - TLS cert/key mounted at /opt/casan-control-panel/tls/tls.crt|tls.key
-#   - OIDC env file at /opt/casan-control-panel/oauth2-proxy.env
-#   - CASAN state/artifacts mounted read-write/read-only as appropriate
+# Production Control Panel deployment. This file intentionally has no build
+# directives: production must run the digest-pinned images attested by CI.
+# `production-preflight.sh` validates all files, endpoints, Object Lock and
+# images before `docker compose up` is allowed.
 #
 # oauth2-proxy must emit X-Auth-Request-User and X-Auth-Request-Groups.
 # Nginx overwrites X-CASAN-* headers before proxying to the API; the API maps
@@ -10,11 +9,13 @@
 
 services:
   control-panel-api:
-    build:
-      context: .
-      dockerfile: Dockerfile.control-panel-api
-    image: casan-control-panel-api:latest
+    image: ${CASAN_CP_API_IMAGE:?Set a digest-pinned CASAN_CP_API_IMAGE}
     restart: unless-stopped
+    env_file:
+      - path: ${CASAN_CP_RUNTIME_ENV:?Set CASAN_CP_RUNTIME_ENV}
+        required: true
+      - path: ${CASAN_CP_VAULT_ENV:?Set CASAN_CP_VAULT_ENV}
+        required: true
     environment:
       CASAN_PROFILE: prod
       CASAN_CP_STRICT: "1"
@@ -23,26 +24,23 @@ services:
       CP_PORT: "3010"
       CASAN_APP_ROOT: /app
     volumes:
-      - ./.specify:/app/.specify
-      - ./docs/output:/app/docs/output:ro
+      - ${CASAN_CP_STATE_DIR:?Set CASAN_CP_STATE_DIR}:/app/.specify
+      - ${CASAN_CP_OUTPUT_DIR:?Set CASAN_CP_OUTPUT_DIR}:/app/docs/output:ro
     expose:
       - "3010"
     networks:
       - casan-control
 
   control-panel-ui:
-    build:
-      context: .
-      dockerfile: Dockerfile.control-panel-ui
-    image: casan-control-panel-ui:latest
+    image: ${CASAN_CP_UI_IMAGE:?Set a digest-pinned CASAN_CP_UI_IMAGE}
     restart: unless-stopped
     depends_on:
       - control-panel-api
       - oauth2-proxy
     ports:
-      - "8443:443"
+      - "${CASAN_CP_HTTPS_PORT:-443}:443"
     volumes:
-      - /opt/casan-control-panel/tls:/etc/nginx/tls:ro
+      - ${CASAN_CP_TLS_DIR:?Set CASAN_CP_TLS_DIR}:/etc/nginx/tls:ro
     networks:
       - casan-control
 
@@ -50,8 +48,8 @@ services:
     image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0
     restart: unless-stopped
     env_file:
-      - path: /opt/casan-control-panel/oauth2-proxy.env
-        required: false
+      - path: ${CASAN_CP_OAUTH_ENV:?Set CASAN_CP_OAUTH_ENV}
+        required: true
     command:
       - --http-address=0.0.0.0:4180
       - --reverse-proxy=true