update guradrails and docker file
This commit is contained in:
@@ -1,38 +1,245 @@
|
||||
# GUARDRAILS
|
||||
|
||||
These systems are currently working and must not be broken by AI refactors.
|
||||
These systems are **currently working** and must **not be broken by AI refactors**.
|
||||
|
||||
## CI/CD
|
||||
AI tools must **prefer minimal changes** and avoid architecture changes unless explicitly instructed.
|
||||
|
||||
Jenkins pipeline builds Docker image and deploys it.
|
||||
---
|
||||
|
||||
# Core Principle
|
||||
|
||||
If a task can be solved with a **small change**, the AI must **not perform a large rewrite**.
|
||||
|
||||
---
|
||||
|
||||
# Git Workflow Rules
|
||||
|
||||
The AI must **NEVER commit directly to `master` or `main`.**
|
||||
|
||||
All changes must be made via a branch.
|
||||
|
||||
## Branch naming conventions
|
||||
|
||||
Feature work:
|
||||
|
||||
feature/<short-description>
|
||||
|
||||
Bug fixes:
|
||||
|
||||
fix/<short-description>
|
||||
|
||||
Examples:
|
||||
|
||||
feature/supabase-public-endpoint
|
||||
fix/smoke-check-url
|
||||
fix/magic-link-auth
|
||||
|
||||
## Required workflow
|
||||
|
||||
1. Create a branch from `master`
|
||||
2. Make the required changes
|
||||
3. Commit changes to that branch
|
||||
4. Show the diff
|
||||
5. Do **not merge automatically**
|
||||
6. Raise a pull request
|
||||
7. User performs merge after review
|
||||
|
||||
---
|
||||
|
||||
# Infrastructure Protection
|
||||
|
||||
The AI must **not modify infrastructure** unless explicitly instructed.
|
||||
|
||||
This includes:
|
||||
|
||||
- DNS records
|
||||
- reverse proxy configuration
|
||||
- SSL certificates
|
||||
- server networking
|
||||
- firewall rules
|
||||
- Proxmox configuration
|
||||
- VM/LXC creation
|
||||
- Nginx Proxy Manager configuration
|
||||
- Supabase server configuration
|
||||
|
||||
These systems are **managed manually**.
|
||||
|
||||
---
|
||||
|
||||
# CI/CD
|
||||
|
||||
The Jenkins pipeline currently **builds and deploys the application**.
|
||||
|
||||
Deployment process:
|
||||
|
||||
docker save → scp → docker load
|
||||
|
||||
## Container
|
||||
The AI must **not change the deployment architecture** without instruction.
|
||||
|
||||
Allowed CI changes:
|
||||
|
||||
- fixing pipeline bugs
|
||||
- improving reliability
|
||||
- adding environment variables
|
||||
- improving logs
|
||||
|
||||
Not allowed:
|
||||
|
||||
- replacing Jenkins
|
||||
- replacing Docker deployment
|
||||
- changing deployment host
|
||||
- introducing Kubernetes
|
||||
- major CI architecture changes
|
||||
|
||||
---
|
||||
|
||||
# Container
|
||||
|
||||
Container name:
|
||||
|
||||
Name:
|
||||
plesk-agency-portal
|
||||
|
||||
Deploy path:
|
||||
Deployment path:
|
||||
|
||||
/opt/plesk-agency-portal
|
||||
|
||||
## Reverse Proxy
|
||||
The AI must **not rename containers or paths** without explicit approval.
|
||||
|
||||
Managed by Nginx Proxy Manager
|
||||
---
|
||||
|
||||
Public URL:
|
||||
# Reverse Proxy
|
||||
|
||||
Reverse proxy is managed by:
|
||||
|
||||
Nginx Proxy Manager
|
||||
|
||||
Public application URL:
|
||||
|
||||
https://portal.rdbcloud.co.uk
|
||||
|
||||
## Auth
|
||||
Supabase public endpoint:
|
||||
|
||||
Supabase Magic Link authentication
|
||||
https://supabase.rdbcloud.co.uk
|
||||
|
||||
Environment variables:
|
||||
The AI must **not change reverse proxy configuration**.
|
||||
|
||||
---
|
||||
|
||||
# Authentication
|
||||
|
||||
Authentication system:
|
||||
|
||||
Supabase Magic Link
|
||||
|
||||
Required environment variables:
|
||||
|
||||
NEXT_PUBLIC_SUPABASE_URL
|
||||
SUPABASE_URL
|
||||
NEXT_PUBLIC_SUPABASE_ANON_KEY
|
||||
|
||||
AI tools must avoid large rewrites or architectural changes without explicit instruction.
|
||||
The AI must **not replace the authentication system**.
|
||||
|
||||
---
|
||||
|
||||
# Environment Variables
|
||||
|
||||
Secrets must **never be committed to the repository**.
|
||||
|
||||
Secrets must come from:
|
||||
|
||||
- Jenkins credentials
|
||||
- environment variables
|
||||
- deployment configuration
|
||||
|
||||
Never commit:
|
||||
|
||||
API keys
|
||||
private tokens
|
||||
database passwords
|
||||
service keys
|
||||
|
||||
---
|
||||
|
||||
# Docker
|
||||
|
||||
Docker is used for **build and deployment**.
|
||||
|
||||
The AI may:
|
||||
|
||||
- update Dockerfile
|
||||
- fix build issues
|
||||
- improve caching
|
||||
|
||||
The AI must **not introduce complex container orchestration**.
|
||||
|
||||
Not allowed:
|
||||
|
||||
kubernetes
|
||||
docker swarm
|
||||
nomad
|
||||
terraform
|
||||
|
||||
Unless explicitly requested.
|
||||
|
||||
---
|
||||
|
||||
# Database
|
||||
|
||||
Database system:
|
||||
|
||||
Supabase Postgres
|
||||
|
||||
The AI must **not perform destructive database changes**.
|
||||
|
||||
Not allowed automatically:
|
||||
|
||||
DROP TABLE
|
||||
DROP COLUMN
|
||||
DELETE large datasets
|
||||
schema rewrites
|
||||
|
||||
Schema changes must be **reviewed first**.
|
||||
|
||||
---
|
||||
|
||||
# Safe Refactoring Rules
|
||||
|
||||
Allowed:
|
||||
|
||||
- small code improvements
|
||||
- bug fixes
|
||||
- performance improvements
|
||||
- logging improvements
|
||||
- type fixes
|
||||
- lint fixes
|
||||
|
||||
Avoid:
|
||||
|
||||
- large rewrites
|
||||
- framework changes
|
||||
- directory restructuring
|
||||
- renaming large parts of the codebase
|
||||
|
||||
Unless specifically requested.
|
||||
|
||||
---
|
||||
|
||||
# When AI Is Unsure
|
||||
|
||||
If the AI is unsure:
|
||||
|
||||
1. Explain the risk
|
||||
2. Ask for clarification
|
||||
3. Do **not proceed with risky changes**
|
||||
|
||||
---
|
||||
|
||||
# Priority Order
|
||||
|
||||
When making decisions, the AI must prioritise:
|
||||
|
||||
1. **Do not break production**
|
||||
2. **Respect guardrails**
|
||||
3. **Make minimal safe changes**
|
||||
4. **Preserve deployment pipeline**
|
||||
5. **Follow branch workflow**
|
||||
|
||||
Reference in New Issue
Block a user