bakery-admin/bakery-ia
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add improvements

Browse Source
This commit is contained in:
Urtzi Alfaro
2026-01-12 14:24:14 +01:00
parent 6037faaf8c
commit 230bbe6a19
61 changed files with 1668 additions and 894 deletions
Download Patch File Download Diff File Expand all files Collapse all files

207
docs/PILOT_LAUNCH_GUIDE.md
View File

@@ -87,13 +87,32 @@ Your manifests need the following updates before deploying to production:
**Impact if skipped:** Kustomize apply fails
**Status:** ✅ Fixed in latest commit
#### 4. Generate Production Secrets (HIGH PRIORITY)
**Why:** Default secrets are placeholders and insecure
**Impact if skipped:** CRITICAL security vulnerability
#### 4. Production Secrets (ALREADY CONFIGURED) ✅
**Status:** Strong production secrets have been generated and configured
**Impact if skipped:** N/A - This step is already completed
#### 5. Update Cert-Manager Email (HIGH PRIORITY)
#### 5. Update Cert-Manager Email (HIGH PRIORITY) - ✅ **ALREADY FIXED**
**Why:** Receive Let's Encrypt renewal notifications
**Impact if skipped:** Won't receive SSL expiry warnings
**Status:** ✅ Fixed - email is now `admin@bakewise.ai`
#### 6. Update Stripe Publishable Key (HIGH PRIORITY)
**Why:** Payment processing requires production Stripe key
**Impact if skipped:** Payments will use test mode (no real charges)
**File:** `infrastructure/kubernetes/base/configmap.yaml` line 378
**Current value:** `pk_test_your_stripe_publishable_key_here`
**Required:** Your Stripe production publishable key from https://dashboard.stripe.com/apikeys
#### 7. Pilot Coupon Configuration (OPTIONAL)
**Why:** Control pilot program settings
**Files:** `infrastructure/kubernetes/base/configmap.yaml` lines 375-377
**Current values (defaults are correct for pilot):**
- `VITE_PILOT_MODE_ENABLED: "true"` - Enables pilot UI features
- `VITE_PILOT_COUPON_CODE: "PILOT2025"` - Coupon code for 3 months free
- `VITE_PILOT_TRIAL_MONTHS: "3"` - Trial extension duration
**Note:** The PILOT2025 coupon is automatically created when tenant-service starts.
No manual seeding required - it's handled by `app/jobs/startup_seeder.py`.
### ✅ Already Correct (No Changes Needed)
@@ -136,45 +155,44 @@ grep "newTag:" infrastructure/kubernetes/overlays/prod/kustomization.yaml | grep
echo "✅ All images now use version v${VERSION}"
# ========================================
# STEP 3: Generate Production Secrets
# STEP 3: Production Secrets (ALREADY DONE) ✅
# ========================================
echo -e "\nStep 3: Generating production secrets..."
echo "Copy these values to infrastructure/kubernetes/base/secrets.yaml"
echo "================================================================"
# JWT and API secrets
echo -e "\n### JWT and API Keys ###"
export JWT_SECRET=$(openssl rand -base64 32)
export JWT_REFRESH_SECRET=$(openssl rand -base64 32)
export SERVICE_API_KEY=$(openssl rand -hex 32)
echo "JWT_SECRET_KEY: $(echo -n $JWT_SECRET | base64)"
echo "JWT_REFRESH_SECRET_KEY: $(echo -n $JWT_REFRESH_SECRET | base64)"
echo "SERVICE_API_KEY: $(echo -n $SERVICE_API_KEY | base64)"
# Database passwords
echo -e "\n### Database Passwords ###"
for db in auth tenant inventory sales orders procurement forecasting analytics notification monitoring users products recipes stock menu demo_session orchestrator cleanup; do
password=$(openssl rand -base64 24)
echo "${db^^}_DB_PASSWORD: $(echo -n $password | base64)"
done
echo -e "\n================================================================"
echo "⚠️ SAVE THESE SECRETS SECURELY!"
echo "Update infrastructure/kubernetes/base/secrets.yaml with the values above"
echo "Press Enter when you've updated secrets.yaml..."
read
echo -e "\nStep 3: Verifying production secrets..."
echo "✅ Production secrets have been pre-configured with strong passwords"
echo " - JWT secrets: 256-bit cryptographically secure"
echo " - Database passwords: 24-character random strings"
echo " - Redis password: 24-character random string"
echo " - RabbitMQ password: 24-character random string"
echo " - Service API key: 64-character hex string"
echo ""
echo "All secrets are already set in infrastructure/kubernetes/base/secrets.yaml"
echo "No manual action required for this step."
# ========================================
# STEP 4: Update Cert-Manager Email
# STEP 4: Cert-Manager Email (ALREADY FIXED)
# ========================================
echo -e "\nStep 4: Updating cert-manager email..."
sed -i.bak 's/admin@bakery-ia.local/admin@bakewise.ai/g' \
infrastructure/kubernetes/base/components/cert-manager/cluster-issuer-production.yaml
echo -e "\nStep 4: Verifying cert-manager email..."
grep "admin@bakewise.ai" infrastructure/kubernetes/base/components/cert-manager/cluster-issuer-production.yaml && \
echo "✅ Cert-manager email updated" || \
echo "⚠️ WARNING: Email not updated"
echo "✅ Cert-manager email already set to admin@bakewise.ai" || \
echo "⚠️ WARNING: Cert-manager email needs updating"
# ========================================
# STEP 5: Update Stripe Publishable Key
# ========================================
echo -e "\nStep 5: Stripe Publishable Key Configuration..."
echo "================================================================"
echo "⚠️ MANUAL STEP REQUIRED"
echo ""
echo "Edit: infrastructure/kubernetes/base/configmap.yaml"
echo "Find: VITE_STRIPE_PUBLISHABLE_KEY: \"pk_test_your_stripe_publishable_key_here\""
echo "Replace with your production Stripe publishable key from:"
echo " https://dashboard.stripe.com/apikeys"
echo ""
echo "Example:"
echo " VITE_STRIPE_PUBLISHABLE_KEY: \"pk_live_XXXXXXXXXXXXXXXXXXXX\""
echo ""
echo "Press Enter when you've updated the Stripe key..."
read
# ========================================
# FINAL VALIDATION
@@ -187,8 +205,10 @@ echo "Validation Checklist:"
echo " ✅ imagePullSecrets removed"
echo " ✅ Image tags updated to v${VERSION}"
echo " ✅ SigNoz namespace fixed (bakery-ia)"
echo " ⚠️ Production secrets updated in secrets.yaml (manual verification required)"
echo " ✅ Cert-manager email updated"
echo " ✅ Production secrets configured with strong passwords"
echo " ✅ Cert-manager email set to admin@bakewise.ai"
echo " ⚠️ Stripe publishable key updated (manual verification required)"
echo " ✅ Pilot coupon auto-seeded on tenant-service startup"
echo ""
echo "Next: Copy manifests to VPS and begin deployment"
```
@@ -197,11 +217,12 @@ echo "Next: Copy manifests to VPS and begin deployment"
After running the script above:
1. **Verify secrets.yaml updated:**
1. **Verify production secrets are configured:**
```bash
# Check that JWT_SECRET_KEY is not the placeholder
# Verify secrets.yaml has strong passwords (not placeholders)
grep "JWT_SECRET_KEY" infrastructure/kubernetes/base/secrets.yaml
# Should NOT show the old placeholder value
# Should show: dXNNSHc5a1FDUW95cmM3d1BtTWkzYkNscjBsVFk5d3Z6Wm1jVGJBRHZMMD0=
# (This is the base64-encoded production JWT secret)
```
2. **Check image tags:**
@@ -832,30 +853,19 @@ sed -i "s/admin@bakery-ia.local/admin@bakewise.ai/g" \
infrastructure/kubernetes/base/components/cert-manager/cluster-issuer-production.yaml
```
**Step 2.5: Generate and Update Production Secrets**
**Step 2.5: Verify Production Secrets (Already Configured) ✅**
```bash
# Generate JWT secrets
export JWT_SECRET=$(openssl rand -base64 32)
export JWT_REFRESH_SECRET=$(openssl rand -base64 32)
export SERVICE_API_KEY=$(openssl rand -hex 32)
# Production secrets have been pre-configured with strong cryptographic passwords
# No manual action required - secrets are already set in secrets.yaml
# Display base64-encoded values for secrets.yaml
echo "=== JWT Secrets (copy these to secrets.yaml) ==="
echo "JWT_SECRET_KEY: $(echo -n $JWT_SECRET | base64)"
echo "JWT_REFRESH_SECRET_KEY: $(echo -n $JWT_REFRESH_SECRET | base64)"
echo "SERVICE_API_KEY: $(echo -n $SERVICE_API_KEY | base64)"
echo ""
# Verify the secrets are configured (optional)
echo "Verifying production secrets configuration..."
grep "JWT_SECRET_KEY" infrastructure/kubernetes/base/secrets.yaml | head -1
grep "AUTH_DB_PASSWORD" infrastructure/kubernetes/base/secrets.yaml | head -1
grep "REDIS_PASSWORD" infrastructure/kubernetes/base/secrets.yaml | head -1
# Generate strong database passwords for all 18 databases
echo "=== Database Passwords (copy these to secrets.yaml) ==="
for db in auth tenant inventory sales orders procurement forecasting analytics notification monitoring users products recipes stock menu demo_session orchestrator cleanup; do
password=$(openssl rand -base64 24)
echo "${db}_DB_PASSWORD: $(echo -n $password | base64)"
done
# Now manually update infrastructure/kubernetes/base/secrets.yaml with the generated values
nano infrastructure/kubernetes/base/secrets.yaml
echo "✅ All production secrets are configured and ready for deployment"
```
**Production URLs:**
@@ -868,62 +878,46 @@ nano infrastructure/kubernetes/base/secrets.yaml
## Configuration & Secrets
### Step 1: Generate Strong Passwords
### Production Secrets Status ✅
```bash
# Generate passwords for all services
openssl rand -base64 32 # For each database
openssl rand -hex 32 # For JWT secrets and API keys
**All core secrets have been pre-configured with strong cryptographic passwords:**
- ✅ **Database passwords** (19 databases) - 24-character random strings
- ✅ **JWT secrets** - 256-bit cryptographically secure tokens
- ✅ **Service API key** - 64-character hexadecimal string
- ✅ **Redis password** - 24-character random string
- ✅ **RabbitMQ password** - 24-character random string
- ✅ **RabbitMQ Erlang cookie** - 64-character hexadecimal string
# Save all passwords securely!
# Recommended: Use a password manager (1Password, LastPass, Bitwarden)
```
### Step 1: Configure External Service Credentials (Email & WhatsApp)
### Step 2: Update Application Secrets
You still need to update these external service credentials:
```bash
# Edit the secrets file
nano infrastructure/kubernetes/base/secrets.yaml
# Update ALL of these values:
# Database passwords (14 databases):
AUTH_DB_PASSWORD: <base64-encoded-password>
TENANT_DB_PASSWORD: <base64-encoded-password>
# ... (all 14 databases)
# Redis password:
REDIS_PASSWORD: <base64-encoded-password>
# JWT secrets:
JWT_SECRET_KEY: <base64-encoded-secret>
JWT_REFRESH_SECRET_KEY: <base64-encoded-secret>
# Update ONLY these external service credentials:
# SMTP settings (from email setup):
SMTP_HOST: <base64-encoded-host> # smtp.zoho.com or smtp.gmail.com
SMTP_PORT: <base64-encoded-port> # 587
SMTP_USERNAME: <base64-encoded-username> # your email
SMTP_USER: <base64-encoded-username> # your email
SMTP_PASSWORD: <base64-encoded-password> # app password
DEFAULT_FROM_EMAIL: <base64-encoded-email> # noreply@yourdomain.com
# WhatsApp credentials (from WhatsApp setup):
WHATSAPP_ACCESS_TOKEN: <base64-encoded-token>
WHATSAPP_PHONE_NUMBER_ID: <base64-encoded-id>
WHATSAPP_BUSINESS_ACCOUNT_ID: <base64-encoded-id>
WHATSAPP_WEBHOOK_VERIFY_TOKEN: <base64-encoded-token>
# WhatsApp credentials (from WhatsApp setup - optional):
WHATSAPP_API_KEY: <base64-encoded-key>
# Database connection strings (update with actual passwords):
AUTH_DATABASE_URL: postgresql+asyncpg://auth_user:PASSWORD@auth-db:5432/auth_db?ssl=require
# ... (all 14 databases)
# Payment processing (from Stripe setup):
STRIPE_SECRET_KEY: <base64-encoded-key>
STRIPE_WEBHOOK_SECRET: <base64-encoded-secret>
```
**To base64 encode:**
```bash
echo -n "your-password-here" | base64
echo -n "your-value-here" | base64
```
**CRITICAL:** Never commit real secrets to git! Use `.gitignore` for secrets files.
**CRITICAL:** Never commit real secrets to git! The secrets.yaml file should be in `.gitignore`.
### Step 3: Apply Application Secrets
### Step 2: Apply Application Secrets
```bash
# Copy manifests to VPS (from local machine)
@@ -1787,12 +1781,14 @@ kubectl scale deployment monitoring -n bakery-ia --replicas=0
## Summary Checklist
### Pre-Deployment Configuration (LOCAL MACHINE)
- [ ] **imagePullSecrets removed** - Deleted from all 67 manifests
- [ ] **Image tags updated** - Changed all 'latest' to v1.0.0 (semantic version)
- [ ] **SigNoz namespace fixed** - ✅ Already done (bakery-ia namespace)
- [ ] **Production secrets generated** - JWT, database passwords, API keys
- [ ] **secrets.yaml updated** - Replaced all placeholder values
- [ ] **Cert-manager email updated** - admin@bakewise.ai
- [x] **Production secrets configured** - ✅ JWT, database passwords, API keys (ALREADY DONE)
- [ ] **External service credentials** - Update SMTP, WhatsApp, Stripe in secrets.yaml
- [ ] **imagePullSecrets removed** - Delete from all 67 manifests
- [ ] **Image tags updated** - Change all 'latest' to v1.0.0 (semantic version)
- [x] **SigNoz namespace fixed** - ✅ Already done (bakery-ia namespace)
- [x] **Cert-manager email updated** - ✅ Already set to admin@bakewise.ai
- [ ] **Stripe publishable key updated** - Replace `pk_test_...` with production key in configmap.yaml
- [x] **Pilot mode verified** - ✅ VITE_PILOT_MODE_ENABLED=true (default is correct)
- [ ] **Manifests validated** - No 'latest' tags, no imagePullSecrets remaining
### Infrastructure Setup
@@ -1830,6 +1826,7 @@ kubectl scale deployment monitoring -n bakery-ia --replicas=0
- [ ] Email delivery working
- [ ] SigNoz monitoring accessible
- [ ] Metrics flowing to SigNoz
- [ ] **Pilot coupon verified** - Check tenant-service logs for "Pilot coupon created successfully"
### Post-Deployment
- [ ] Backups configured and tested