archetecture security fix

scripts/docker-prod-deploy.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+source "${ROOT_DIR}/scripts/docker-prod-common.sh"
+
+echo "Deploying production release ${APP_IMAGE:-<missing>}:${APP_VERSION:-<missing>}"
+
+ensure_env_file
+ensure_traefik_network
+ensure_api_uploads_volume
+require_release_image
+login_registry_if_configured
+
+echo "Pulling release images"
+pull_prod_release_images
+
+echo "Starting shared infrastructure"
+start_traefik
+prod_compose up -d postgres redis
+wait_for_healthy postgres 120
+
+echo "Running database migrations"
+run_prod_migrations
+
+echo "Starting application services"
+prod_compose up -d api marketplace dashboard admin
+wait_for_healthy api 180
+wait_for_healthy marketplace 180
+wait_for_healthy dashboard 180
+wait_for_healthy admin 180
+
+echo "Pruning old images"
+docker image prune -f >/dev/null
+
+echo "Production release ${APP_IMAGE}:${APP_VERSION} is up and healthy."