# π οΈ Task Manager β Cloud Deployment (SK1)
---
## π Application Description
The **Task Manager** is a premium, full-stack web application designed for personal productivity. It features:
* β¨ **Apple-inspired UI:** Sleek glassmorphism style with light/dark adaptive layout.
* π **High-Speed API:** Powered by Node.js/Express with database connection pooling.
* β‘ **Redis Caching:** Transparent query caching (30s TTL) with instant write invalidation.
* π **Automated Security:** Automatic HTTPS certificate management and VM hardening out of the box.
---
## βοΈ Cloud & Architecture Description
The architecture is deployed to **Microsoft Azure** using an **Azure for Students** subscription and runs entirely inside an isolated container network.
### ποΈ Visual Topology
### π¦ Container Registry & Services
| Badge | Service | Port | Description / Purpose |
| :--- | :--- | :---: | :--- |
|  | **Caddy** | `443`, `80` | Entry point. Handles SSL negotiation via ACME (Let's Encrypt) and reverse proxies traffic to Nginx. |
|  | **Frontend** | `80` | High-performance Nginx server serving the static single-page app and proxying API endpoints. |
|  | **Express API** | `3000` | Core backend container managing authentication, CRUD tasks, Redis interactions, and PostgreSQL queries. |
|  | **Database** | `5432` | Relational storage using **PostgreSQL 16**. Mounted to a persistent host volume. |
|  | **Cache** | `6379` | In-memory cache using **Redis 7** for ultra-fast response times on read queries. |
### π Network Segmentation
* π **`frontend-net`:** Public-facing network segment including Caddy, Nginx, and Node.js.
* π **`backend-net`:** Completely isolated private network segment enclosing Node.js, PostgreSQL, and Redis. **No direct internet access** is allowed into PostgreSQL or Redis.
---
## π Quick Deploy & Usage
> [!IMPORTANT]
> Ensure you have the **Azure CLI** installed and are logged in (`az login`) with a valid subscription before executing deployment scripts.
### π οΈ One-Command Deployment
```bash
# 1. Clone the repository
git clone git@git.kemt.fei.tuke.sk:gs699he/zkt26.git
cd zkt26/sk1
# 2. Setup your private configurations
cp env.example .env
nano .env # Input a strong POSTGRES_PASSWORD
# 3. Deploy everything in under 3 minutes
./prepare-app.sh
```
---
## πΎ Maintenance & Administration
### ποΈ Database Backup
You can easily back up your production database from your local terminal with one command:
```bash
./backup-db.sh
```
*How it works:* The script opens a secure SSH tunnel to the Azure VM, triggers `pg_dump` directly inside the container, pipes the binary stream back over SSH, and saves the `.sql` dump directly inside your local `backups/` folder.
### π Real-time Monitoring & Logs
Retrieve access sheets, web logs, and application logs securely:
```bash
./view-logs.sh --caddy # Read HTTPS entry/access logs
./view-logs.sh --api # Monitor Backend API requests in real-time
```
### ποΈ Complete Decommissioning
Tear down the deployment and completely avoid any ongoing Azure subscription costs:
```bash
./remove-app.sh
```
*Action:* Automatically deletes the entire Azure Resource Group, eliminating the VM, Disks, Public IPs, and Firewalls instantly.
---
## π Repository Directory Structure
```text
sk1/
βββ api/ # Express Backend API & DB connection pool
βββ frontend/ # Single-Page Web Frontend (Nginx, HTML/CSS/JS)
βββ caddy/ # Caddy configuration (Let's Encrypt TLS setup)
βββ db/ # Database schema seeding files
βββ docs/ # TeX documentation and static assets
β βββ architecture.png # Visual architecture diagram
β βββ documentation.tex # Main exam document source
βββ prepare-app.sh # Deployment orchestration shell script
βββ remove-app.sh # Resource cleanup script
βββ backup-db.sh # Secure DB snapshot utility
βββ view-logs.sh # Remote secure logging client
```
---
## βοΈ Configuration Variables (`.env`)
The system uses standard environment parameters injected dynamically at launch. Secrets are kept entirely outside of Git.
| Variable Name | Default Value | Purpose |
| :--- | :---: | :--- |
| `POSTGRES_PASSWORD` | *[None]* | Database superuser credential (Secret). |
| `AZURE_RESOURCE_GROUP` | `taskmanager-rg` | Resource container inside Azure. |
| `AZURE_LOCATION` | `swedencentral` | Selected regional datacenter. |
| `AZURE_VM_SIZE` | `Standard_B2ts_v2` | Sizing of deployment node. |
| `AZURE_DNS_LABEL` | `taskmanager-gs699he` | Customized FQDN subdomain. |
---
## π° 1-Year Cost Analysis
Projected cloud billing estimation modeled around **1,000 active daily users** storing up to **50 GB** of relational information.
| Azure Resource | Size / Metric Specification | Total Annual Cost |
| :--- | :--- | :---: |
| ποΈ **Compute (VM)** | Standard_B2ts_v2 (2 vCPUs, 1 GB RAM, Burst capable) | **$169.92** |
| πΎ **Storage (SSD)** | 64 GB Premium SSD P6 (Supports high IOPS) | **$115.20** |
| π **Networking** | Dedicated Public Static IPv4 Address | **$36.00** |
| π **Bandwidth** | ~30 GB/Month Outbound Transfer (Within free tiers) | **$0.00** |
| π **Security** | Let's Encrypt ACME SSL/TLS Provision | **$0.00** |
| π **Projected Total** | **Ready for Staging & Production Scaling** | **~$321.12 / Year** |
---
## π Implemented Security Protocols
1. **Transport Encryption:** TLS 1.3 enforced globally with HTTP-to-HTTPS redirects.
2. **Firewall Rigidity:** Closed database ports (5432, 6379) to external traffic. Only `80`, `443`, and SSH (`22`) are open.
3. **Credential Hygiene:** Secrets loaded at runtime from a secure `.env` which is locked inside `.gitignore`.
4. **Auto-Healing Infrastructure:** `restart: always` set on all Docker services to prevent container crashes from creating downtime.
---
## π€ AI Usage Declaration
* **Google Antigravity (Gemini 2.5 Pro):** Employed in planning container network routing, creating optimal bash scripts, writing clean Caddyfile configs, and compiling the TeX project.
* **Audit process:** All files, configs, and shell script variables were thoroughly reviewed, locally validated, and successfully tested against actual cloud executions.
---
*Technical University of KoΕ‘ice β KEMT FEI β Cloud Technologies β 2026*