feat: add production deployment handoff controls

2026-07-10 16:41:14 +09:00
parent 7cea023dce
commit aa284e9bd4
14 changed files with 408 additions and 109 deletions
@@ -0,0 +1,24 @@
+# Public control-plane endpoint. Do not use localhost, an IP address, or example.com.
+CASAN_PUBLIC_FQDN=control.casan.company.internal
+CASAN_CP_HTTPS_PORT=443
+
+# Host paths. These are provisioned outside the repository with restrictive permissions.
+CASAN_CP_TLS_DIR=/opt/casan-control-panel/tls
+CASAN_CP_OAUTH_ENV=/opt/casan-control-panel/oauth2-proxy.env
+CASAN_CP_RUNTIME_ENV=/opt/casan-control-panel/runtime.env
+CASAN_CP_VAULT_ENV=/opt/casan-control-panel/vault.env
+CASAN_CP_STATE_DIR=/srv/casan/state
+CASAN_CP_OUTPUT_DIR=/srv/casan/output
+
+# CI must publish immutable image references, not tags such as :latest.
+CASAN_CP_API_IMAGE=registry.example.internal/casan/control-panel-api@sha256:replace-with-64-hex-digest
+CASAN_CP_UI_IMAGE=registry.example.internal/casan/control-panel-ui@sha256:replace-with-64-hex-digest
+
+# WORM anchor destination. The deploy identity needs only PutObject and
+# GetObjectLockConfiguration for this bucket/prefix; use workload identity,
+# never static credentials in this file.
+CASAN_S3_BUCKET=casan-production-audit
+CASAN_S3_PREFIX=audit-anchors
+CASAN_S3_REGION=ap-northeast-1
+CASAN_S3_RETENTION_DAYS=365
+CASAN_S3_KMS_KEY_ID=alias/casan-audit