2.5 KiB
status, phase, source, started, updated
| status | phase | source | started | updated |
|---|---|---|---|---|
| complete | 06-performance-production-hardening | 06-01-SUMMARY.md, 06-02-SUMMARY.md, 06-03-SUMMARY.md, 06-04-SUMMARY.md, 06-05-SUMMARY.md | 2026-06-04T00:00:00Z | 2026-06-04T19:05:00Z |
Current Test
[testing complete]
Tests
1. Cold Start Smoke Test
expected: Stop any running services. Run docker compose up -d --build. All services (backend, celery-worker, celery-beat, postgres, minio, redis, loki, promtail, grafana) start without errors. curl -sf http://localhost:8000/health returns a 200 response.
result: pass
2. X-Correlation-ID response header
expected: Make any authenticated API request (e.g. curl -si http://localhost:8000/health). The response headers include x-correlation-id: <UUID4>. Make a second request — the header value is different (new UUID per request).
result: pass
3. JSON structured logging
expected: Set LOG_JSON=true in the backend service (or .env), restart backend. Then call an endpoint and check docker compose logs backend. Log lines should be valid JSON objects containing an "event" key (e.g. {"event": "...", "level": "info", "correlation_id": "...", ...}).
result: pass
4. Grafana accessible
expected: After docker compose up, navigate to http://localhost:3000 in a browser (or run curl -sf http://localhost:3000/api/health). Grafana loads and the health endpoint returns JSON with "database": "ok".
result: pass
5. Loki ready
expected: Run curl -sf http://localhost:3100/ready. Response body is ready and the command exits 0.
result: pass
6. Container runs as non-root (appuser)
expected: Run docker compose exec backend id. Output shows uid=1000(appuser) — NOT uid=0 (root). The multi-stage hardened Dockerfile creates appuser with uid=1000.
result: pass
7. Read-only rootfs + writable /tmp
expected: Run docker compose exec backend sh -c 'touch /readonly_probe 2>&1 || echo "rootfs is read-only"'. Output contains "read-only". Then run docker compose exec backend sh -c 'touch /tmp/ok && echo "tmp writable"'. Output contains "tmp writable" (the tmpfs mount works).
result: pass
8. Per-account rate limiting (429 after 100 req/min)
expected: Log in as a regular user. Send 101+ rapid requests to GET /api/documents/ (e.g. with a loop or ab/curl). The 101st request (or shortly after) returns HTTP 429 with a rate-limit error. A different user account is NOT affected by the first user hitting the limit.
result: pass
Summary
total: 8 passed: 8 issues: 0 pending: 0 skipped: 0 blocked: 0
Gaps
[none yet]