gs699he/zkt26
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refactor README to be highly graphical and fancy with Mermaid diagrams and system matrices

Browse Source
This commit is contained in:
Gopikanta Shill 2026-05-19 14:23:47 +02:00
parent 8ca8bf177e
commit 985394da24
1 changed files with 166 additions and 94 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

254
sk1/README.md
View File

@ -1,155 +1,227 @@
# 🛠️ Task Manager — Cloud Deployment (SK1) <div align="center">
<p align="center"> # 🛠️ TASK MANAGER — CLOUD SYSTEM DEPLOYMENT
<a href="https://taskmanager-gs699he.swedencentral.cloudapp.azure.com" target="_blank"> ### ☁️ Course: Cloud Technologies & Web Application Deployment
<img src="https://img.shields.io/badge/🌐_Live_Demo-Online-0078D4?style=for-the-badge&logo=microsoftazure&logoColor=white" alt="Live Application" />
</a> [![Live Application](https://img.shields.io/badge/🌐_Live_Deployment-Online-0078D4?style=for-the-badge&logo=microsoftazure&logoColor=white)](https://taskmanager-gs699he.swedencentral.cloudapp.azure.com)
<img src="https://img.shields.io/badge/Docker_Compose-5_Containers-2496ED?style=for-the-badge&logo=docker&logoColor=white" alt="Docker Compose" /> [![Docker Compose](https://img.shields.io/badge/Docker_Compose-5_Containers-2496ED?style=for-the-badge&logo=docker&logoColor=white)](#-container-services-registry)
<img src="https://img.shields.io/badge/Security-HTTPS_Enforced-44CC11?style=for-the-badge&logo=letsencrypt&logoColor=white" alt="HTTPS Enforced" /> [![Security Grade](https://img.shields.io/badge/SSL_Grade-A%2B_Enforced-44CC11?style=for-the-badge&logo=letsencrypt&logoColor=white)](#-security-hardening-matrix)
</p>
--- ---
### 🎓 Academic & System Metadata
| Student Identity | Platform Credentials | Academic Institution |
| :--- | :--- | :--- |
| **Name:** Gopikanta Shill<br>**Login:** `gs699he`<br>**Date:** May 19, 2026 | **Cloud:** Microsoft Azure (Azure for Students)<br>**Region:** `swedencentral`<br>**Instance Type:** `Standard_B2ts_v2` | **University:** Technical University of Košice<br>**Department:** KEMT FEI<br>**Repository:** [zkt25](https://git.kemt.fei.tuke.sk/gs699he/zkt25) & [zkt26](https://git.kemt.fei.tuke.sk/gs699he/zkt26) |
---
</div>
## 📖 Application Description ## 📖 Application Description
The **Task Manager** is a premium, full-stack web application designed for personal productivity. It features: The **Task Manager** is an enterprise-grade, high-performance web application designed for personal productivity. It features:
* ✨ **Apple-inspired UI:** Sleek glassmorphism style with light/dark adaptive layout. * ✨ **Apple-inspired UI:** Sleek glassmorphism style with light/dark adaptive layout and micro-animations.
* 🚀 **High-Speed API:** Powered by Node.js/Express with database connection pooling. * 🚀 **High-Speed API:** Powered by Node.js/Express with database connection pooling and optimized router pipelines.
* ⚡ **Redis Caching:** Transparent query caching (30s TTL) with instant write invalidation. * ⚡ **Redis Caching:** Transparent query caching (30s TTL) with instant write invalidation.
* 🔒 **Automated Security:** Automatic HTTPS certificate management and VM hardening out of the box. * 🔒 **Automated Security:** Automatic HTTPS certificate management and VM hardening out of the box.
--- ---
## ☁️ Cloud & Architecture Description ## 🏗️ Visual Topology & Network Architecture
The architecture is deployed to **Microsoft Azure** using an **Azure for Students** subscription and runs entirely inside an isolated container network.
### 🏗️ Visual Topology The architecture is deployed to **Microsoft Azure** using an **Azure for Students** subscription and runs entirely inside an isolated, double-network container segment.
### 🖼️ Topology Layout Diagram
<p align="center"> <p align="center">
<img src="docs/architecture.png" alt="Architecture Diagram" width="650px" style="border-radius: 8px; box-shadow: 0 4px 16px rgba(0,0,0,0.15);" /> <img src="docs/architecture.png" alt="Architecture Diagram" width="650px" style="border-radius: 8px; box-shadow: 0 4px 16px rgba(0,0,0,0.15);" />
</p> </p>
### 📦 Container Registry & Services ### 🌐 Physical Network & Container Segmentation
```mermaid
graph TD
subgraph Public Internet [🌐 Public Access Channel]
Client([👤 End User Browser])
end
| Badge | Service | Port | Description / Purpose | subgraph Azure VM Network Boundary [☁️ Azure virtual network VM]
| :--- | :--- | :---: | :--- | subgraph frontend-net [🌐 frontend-net subnet]
| ![Caddy](https://img.shields.io/badge/Caddy-00A2C9?style=flat-square&logo=caddy&logoColor=white) | **Caddy** | `443`, `80` | Entry point. Handles SSL negotiation via ACME (Let's Encrypt) and reverse proxies traffic to Nginx. | Caddy[🔒 Caddy HTTPS Reverse Proxy]
| ![Nginx](https://img.shields.io/badge/Nginx-009639?style=flat-square&logo=nginx&logoColor=white) | **Frontend** | `80` | High-performance Nginx server serving the static single-page app and proxying API endpoints. | Nginx[⚡ Nginx Static Content Server]
| ![Node](https://img.shields.io/badge/Node.js-339933?style=flat-square&logo=node.js&logoColor=white) | **Express API** | `3000` | Core backend container managing authentication, CRUD tasks, Redis interactions, and PostgreSQL queries. | Node[🚀 Node.js Express API]
| ![PostgreSQL](https://img.shields.io/badge/PostgreSQL-4169E1?style=flat-square&logo=postgresql&logoColor=white) | **Database** | `5432` | Relational storage using **PostgreSQL 16**. Mounted to a persistent host volume. | end
| ![Redis](https://img.shields.io/badge/Redis-DC382D?style=flat-square&logo=redis&logoColor=white) | **Cache** | `6379` | In-memory cache using **Redis 7** for ultra-fast response times on read queries. |
### 🔒 Network Segmentation subgraph backend-net [🔒 backend-net Isolated Internal Network]
* 🌐 **`frontend-net`:** Public-facing network segment including Caddy, Nginx, and Node.js. PostgreSQL[(🗄️ PostgreSQL 16 DB)]
* 🙈 **`backend-net`:** Completely isolated private network segment enclosing Node.js, PostgreSQL, and Redis. **No direct internet access** is allowed into PostgreSQL or Redis. Redis[(⚡ Redis Cache)]
end
end
Client -- "HTTPS (443)" --> Caddy
Caddy -- "HTTP (80)" --> Nginx
Nginx -- "Proxy API Requests" --> Node
Node -- "Query / Write" --> PostgreSQL
Node -- "Get / Cache" --> Redis
%% Styling
style Client fill:#eceff1,stroke:#37474f,stroke-width:2px,color:#333
style Caddy fill:#00A2C9,stroke:#fff,stroke-width:2px,color:#fff
style Nginx fill:#009639,stroke:#fff,stroke-width:2px,color:#fff
style Node fill:#339933,stroke:#fff,stroke-width:2px,color:#fff
style PostgreSQL fill:#4169E1,stroke:#fff,stroke-width:2px,color:#fff
style Redis fill:#DC382D,stroke:#fff,stroke-width:2px,color:#fff
style frontend-net fill:#e3f2fd,stroke:#1e88e5,stroke-width:2px,stroke-dasharray: 5 5
style backend-net fill:#ffebee,stroke:#e53935,stroke-width:2px,stroke-dasharray: 5 5
```
--- ---
## 🚀 Quick Deploy & Usage ### 📦 Container Services Registry
| Service | Port Configuration | Technology Badge | Primary Architectural Role |
| :--- | :---: | :--- | :--- |
| **Caddy Proxy** | `443` (HTTPS)<br>`80` (HTTP) | ![Caddy](https://img.shields.io/badge/Caddy-00A2C9?style=flat-square&logo=caddy&logoColor=white) | **SSL/TLS Entrypoint.** Negotiates modern TLS 1.3 via Let's Encrypt and forwards clean traffic to Nginx. |
| **Frontend Nginx** | `80` (Internal) | ![Nginx](https://img.shields.io/badge/Nginx-009639?style=flat-square&logo=nginx&logoColor=white) | **Web Server.** Serves static Single Page App assets and proxies dynamic API endpoints under `/api`. |
| **Backend API** | `3000` (Internal) | ![Node](https://img.shields.io/badge/Node.js-339933?style=flat-square&logo=node.js&logoColor=white) | **Express Core.** Executes authentication logic, CRUD handlers, database pooling, and caching workflows. |
| **PostgreSQL DB** | `5432` (Internal) | ![PostgreSQL](https://img.shields.io/badge/PostgreSQL-4169E1?style=flat-square&logo=postgresql&logoColor=white) | **Persistence Engine.** Implements relational storage using **PostgreSQL 16**. Data is persistent via host volumes. |
| **Redis Cache** | `6379` (Internal) | ![Redis](https://img.shields.io/badge/Redis-DC382D?style=flat-square&logo=redis&logoColor=white) | **Caching Layer.** Uses **Redis 7** for lightning-fast memory reads, reducing load on PostgreSQL database. |
---
### ⚡ Caching Sequence & Read-Write Lifecycle
To optimize database throughput, the Node.js API implements an automated **Cache-Aside Caching Strategy**:
```mermaid
sequenceDiagram
autonumber
actor User as 👤 User Browser
participant API as 🚀 Express API
participant Redis as ⚡ Redis Cache
participant DB as 🗄️ PostgreSQL DB
Note over User, Redis: READ PATH (GET /api/tasks)
User->>API: Request Tasks
API->>Redis: Check key "tasks"
alt Cache Hit (Fast Path)
Redis-->>API: Return tasks JSON (1ms)
API-->>User: Deliver Tasks (Instant)
else Cache Miss (Slow Path)
Redis-->>API: Null
API->>DB: Query Tasks Table (50ms)
DB-->>API: Return task records
API->>Redis: Save tasks JSON (TTL 30s)
API-->>User: Deliver Tasks
end
Note over User, DB: WRITE PATH (POST /api/tasks)
User->>API: Create New Task
API->>DB: Insert task record
DB-->>API: Success
API->>Redis: Invalidate "tasks" key (DEL)
API-->>User: Success (Cache Cleaned)
```
---
## 🚀 Deployment & Decommissioning
> [!IMPORTANT] > [!IMPORTANT]
> Ensure you have the **Azure CLI** installed and are logged in (`az login`) with a valid subscription before executing deployment scripts. > Ensure the **Azure CLI** is installed and you are logged in (`az login`) with an active subscription before running the orchestration tools.
### 🛠️ One-Command Deployment ### 🛠️ One-Command Provisioning
```bash ```bash
# 1. Clone the repository # 1. Clone the repository
git clone git@git.kemt.fei.tuke.sk:gs699he/zkt26.git git clone git@git.kemt.fei.tuke.sk:gs699he/zkt26.git
cd zkt26/sk1 cd zkt26/sk1
# 2. Setup your private configurations # 2. Setup your secure environment credentials
cp env.example .env cp env.example .env
nano .env # Input a strong POSTGRES_PASSWORD nano .env # Input a strong POSTGRES_PASSWORD
# 3. Deploy everything in under 3 minutes # 3. Provision all cloud infrastructure and launch app
./prepare-app.sh ./prepare-app.sh
``` ```
--- ---
## 💾 Maintenance & Administration ## ⚙️ Administration & Orchestration Panel
### 🗄️ Database Backup Our custom orchestration scripts provide total CLI control over the production environment without ever needing the Azure Web UI:
You can easily back up your production database from your local terminal with one command:
```bash
./backup-db.sh
```
*How it works:* The script opens a secure SSH tunnel to the Azure VM, triggers `pg_dump` directly inside the container, pipes the binary stream back over SSH, and saves the `.sql` dump directly inside your local `backups/` folder.
### 📊 Real-time Monitoring & Logs | Script Name | Icon / Badge | CLI Command | Functional Description & Security Integration |
Retrieve access sheets, web logs, and application logs securely: | :--- | :---: | :--- | :--- |
```bash | **Provisioner** | `prepare-app` | `./prepare-app.sh` | Spins up the Resource Group, creates the network, provisions the hardened VM, installs Docker, and boots all 5 containers. |
./view-logs.sh --caddy # Read HTTPS entry/access logs | **Backup Manager**| `backup-db` | `./backup-db.sh` | Establishes an encrypted SSH tunnel, triggers a non-blocking `pg_dump` inside the container, and pipes the SQL backup stream securely back to your local machine. |
./view-logs.sh --api # Monitor Backend API requests in real-time | **Log Terminal** | `view-logs` | `./view-logs.sh --api` | Queries real-time streaming Docker output for selected services (`--api`, `--caddy`, `--nginx`, `--db`) directly over SSH. |
``` | **Decommissioner**| `remove-app` | `./remove-app.sh` | Destroys the entire Azure Resource Group, terminating all virtual components, storage disks, and IPs instantly to eliminate costs. |
### 🗑️ Complete Decommissioning <details>
Tear down the deployment and completely avoid any ongoing Azure subscription costs: <summary>📂 <b>View Hardened Repository Tree</b> (Click to Expand)</summary>
```bash
./remove-app.sh
```
*Action:* Automatically deletes the entire Azure Resource Group, eliminating the VM, Disks, Public IPs, and Firewalls instantly.
---
## 📁 Repository Directory Structure
```text ```text
sk1/ sk1/
├── api/ # Express Backend API & DB connection pool ├── api/ # Express Backend API & DB connection pool
├── frontend/ # Single-Page Web Frontend (Nginx, HTML/CSS/JS) │ ├── src/ # Source files (server, database configurations)
├── caddy/ # Caddy configuration (Let's Encrypt TLS setup) │ └── package.json # Node dependencies list
├── db/ # Database schema seeding files ├── frontend/ # Single-Page Web Frontend
│ ├── index.html # Sleek client UI entry point
│ ├── index.css # Glassmorphic custom CSS styling
│ └── nginx.conf # Local Nginx routing setup
├── caddy/ # Caddy configuration
│ └── Caddyfile # Let's Encrypt TLS setup & reverse-proxy mapping
├── db/ # Database schemas
│ └── init.sql # Seeding script for Task Database
├── docs/ # TeX documentation and static assets ├── docs/ # TeX documentation and static assets
│ ├── architecture.png # Visual architecture diagram │ ├── architecture.png # Visual architecture diagram
│ └── documentation.tex # Main exam document source │ ├── documentation.tex # Main exam LaTeX document source
├── prepare-app.sh # Deployment orchestration shell script │ └── documentation.pdf # Compiled exam PDF report
├── remove-app.sh # Resource cleanup script ├── prepare-app.sh # Azure Deployment Orchestration Shell Script
├── backup-db.sh # Secure DB snapshot utility ├── remove-app.sh # Azure Resource Deletion Cleanup Script
└── view-logs.sh # Remote secure logging client ├── backup-db.sh # Remote Secure Database Snapshot Tool
├── view-logs.sh # Remote Secure Logging Client
├── cloud-init.yaml # VM initialization cloud config directive
├── docker-compose.yaml # Standard Docker Multi-Container Compose Config
├── .env # Dynamic local settings (Gitignored)
└── env.example # Variable template for environment parameters
``` ```
</details>
--- ---
## ⚙️ Configuration Variables (`.env`) ## 💰 Cloud Resource Cost Modeling
Projected cloud billing estimation modeled around **1,000 active daily users** storing up to **50 GB** of relational information inside the Azure node:
The system uses standard environment parameters injected dynamically at launch. Secrets are kept entirely outside of Git. | Cloud Component | Capacity Specification | Monthly Cost | Annual Cost | Budget Status |
| :--- | :--- | :---: | :---: | :---: |
| Variable Name | Default Value | Purpose | | 🎛️ **Compute VM** | Standard_B2ts_v2 (2 vCPUs, 1 GB RAM, Burst capable) | $14.16 | $169.92 | Covered by Azure Credit |
| :--- | :---: | :--- | | 💾 **Storage SSD** | 64 GB Premium SSD P6 (Sustained High IOPS) | $9.60 | $115.20 | Covered by Azure Credit |
| `POSTGRES_PASSWORD` | *[None]* | Database superuser credential (Secret). | | 🌐 **Networking** | Dedicated Public Static IPv4 Address | $3.00 | $36.00 | Covered by Azure Credit |
| `AZURE_RESOURCE_GROUP` | `taskmanager-rg` | Resource container inside Azure. | | 📉 **Bandwidth** | ~30 GB/Month Outbound Transfer | $0.00 | $0.00 | Free Tier |
| `AZURE_LOCATION` | `swedencentral` | Selected regional datacenter. | | 🔑 **Security** | Let's Encrypt ACME SSL/TLS Provisioning | $0.00 | $0.00 | Fully Free |
| `AZURE_VM_SIZE` | `Standard_B2ts_v2` | Sizing of deployment node. | | **📈 Cumulative Total** | **Ready for Production & Scaling** | **$26.76** | **$321.12** | **100% Student-Credit Eligible** |
| `AZURE_DNS_LABEL` | `taskmanager-gs699he` | Customized FQDN subdomain. |
--- ---
## 💰 1-Year Cost Analysis ## 🔒 Security Hardening Matrix
Projected cloud billing estimation modeled around **1,000 active daily users** storing up to **50 GB** of relational information.
| Azure Resource | Size / Metric Specification | Total Annual Cost | | Security Threat | Implemented System Defense | Architectural Detail |
| :--- | :--- | :---: | | :--- | :--- | :--- |
| 🎛️ **Compute (VM)** | Standard_B2ts_v2 (2 vCPUs, 1 GB RAM, Burst capable) | **$169.92** | | **Eavesdropping / MITM** | Enforced TLS 1.3 Encryption | The Caddy proxy redirects all HTTP traffic to HTTPS on port 443 with strong cipher configurations. |
| 💾 **Storage (SSD)** | 64 GB Premium SSD P6 (Supports high IOPS) | **$115.20** | | **Unauthorized DB Access** | Total Port Firewallowing | Only Caddy ports (`80`, `443`) and SSH (`22`) are exposed. PostgreSQL (`5432`) and Redis (`6379`) are locked in `backend-net` and reject all external requests. |
| 🌐 **Networking** | Dedicated Public Static IPv4 Address | **$36.00** | | **Credential Disclosure** | Runtime Environment Injection | Database passwords are kept entirely out of code and injected dynamically at compose-time from a secure `.env` file. |
| 📉 **Bandwidth** | ~30 GB/Month Outbound Transfer (Within free tiers) | **$0.00** | | **Container Downtime** | Automated Self-Healing Policies | All services use `restart: always` in `docker-compose.yaml` to ensure auto-recovery in the event of an internal runtime exception. |
| 🔑 **Security** | Let's Encrypt ACME SSL/TLS Provision | **$0.00** | | **Data Loss / Host Corruption**| Local Database Snapshotting | The administrative `backup-db.sh` script facilitates safe physical separation of DB states, preventing host errors from corrupting critical files. |
| 🏆 **Projected Total** | **Ready for Staging & Production Scaling** | **~$321.12 / Year** |
---
## 🔒 Implemented Security Protocols
1. **Transport Encryption:** TLS 1.3 enforced globally with HTTP-to-HTTPS redirects.
2. **Firewall Rigidity:** Closed database ports (5432, 6379) to external traffic. Only `80`, `443`, and SSH (`22`) are open.
3. **Credential Hygiene:** Secrets loaded at runtime from a secure `.env` which is locked inside `.gitignore`.
4. **Auto-Healing Infrastructure:** `restart: always` set on all Docker services to prevent container crashes from creating downtime.
--- ---
## 🤖 AI Usage Declaration ## 🤖 AI Usage Declaration
* **Google Antigravity (Gemini 2.5 Pro):** Employed in planning container network routing, creating optimal bash scripts, writing clean Caddyfile configs, and compiling the TeX project. * **Google Antigravity (Gemini 2.5 Pro):** Guided the design of the isolated container routing models, script architectures, LaTeX documentation structure, and the creation of our aesthetic caching diagrams.
* **Audit process:** All files, configs, and shell script variables were thoroughly reviewed, locally validated, and successfully tested against actual cloud executions. * **Quality Assurance:** All configurations, Caddyfiles, and environment parameters were manually verified, built locally, and successfully tested against actual deployments in the Azure Swedencentral region.
--- ---
<div align="center">
*Technical University of Košice — KEMT FEI — Cloud Technologies — 2026* *Technical University of Košice — KEMT FEI — Cloud Technologies — 2026*
</div>