chore: refactoring the project

.dockerignore

@@ -0,0 +1,8 @@
+.github
+manifests
+.gitignore
+Dockerfile
+docker-compose.yml
+helmfile.yaml
+LICENSE
+README.md

Dockerfile

@@ -0,0 +1,14 @@
+FROM cgr.dev/chainguard/python:latest-dev as builder
+WORKDIR /app
+COPY . /app
+RUN pip install --no-cache-dir -r requirements.txt --user
+
+FROM cgr.dev/chainguard/python:latest-dev 
+WORKDIR /app
+COPY --from=builder /home/nonroot/.local/lib/python3.12/site-packages /home/nonroot/.local/lib/python3.12/site-packages
+COPY --from=builder /app /app
+
+ENV REDIS_HOST="redis-server"
+HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
+    CMD curl --fail http://localhost:5000/health || exit 1
+ENTRYPOINT ["python", "-m", "flask", "run", "--host=0.0.0.0"]

Dockerfile.redis

@@ -0,0 +1,7 @@
+FROM cgr.dev/chainguard/redis:latest
+
+COPY redis.conf /etc/redis/redis.conf
+
+EXPOSE 6379
+
+ENTRYPOINT [ "redis-server", "/etc/redis/redis.conf" ]

giropops-senhas/app.py → app.py

@@ -5,7 +5,6 @@
 import os
 from prometheus_client import Counter, start_http_server, generate_latest
 
-
 app = Flask(__name__)
 
 redis_host = os.environ.get('REDIS_HOST', 'redis-service')
@@ -16,7 +15,6 @@
 
 senha_gerada_counter = Counter('senha_gerada', 'Contador de senhas geradas')
 
-
 def criar_senha(tamanho, incluir_numeros, incluir_caracteres_especiais):
     caracteres = string.ascii_letters
 
@@ -46,7 +44,6 @@ def index():
         return render_template('index.html', senhas_geradas=senhas_geradas, senha=senhas_geradas[0]['senha'] or '' )
     return render_template('index.html')
 
-
 @app.route('/api/gerar-senha', methods=['POST'])
 def gerar_senha_api():
     dados = request.get_json()
@@ -72,8 +69,12 @@ def listar_senhas():
 def metrics():
     return generate_latest()
 
+@app.route('/health')
+def health():
+    return jsonify({"status": "healthy"}), 200
+
 if __name__ == '__main__':
     import logging
     logging.basicConfig(filename='error.log', level=logging.DEBUG)
     start_http_server(8088)
-    app.run(debug=False)
+    app.run(debug=False)

docker-compose.yml

@@ -1,8 +1,6 @@
-version: '3.9'
-
 services:
   giropops-senhas:
-    build: .
+    image: nataliagranato/giropops-senhas:v1.0.0
     ports:
       - "5000:5000"
     networks:
@@ -20,21 +18,28 @@ services:
         limits:
           cpus: '0.50'
           memory: 256M
+    depends_on:
+      - redis
 
   redis:
-    image: redis
-    command: redis-server --appendonly yes
+    image: nataliagranato/redis:v1.0.0
     networks:
       - giropops-senhas
+    ports:
+      - "6380:6379"
+    volumes:
+      - redis-data:/data
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:5000"]
+      test: ["CMD", "redis-cli", "ping"]
       interval: 30s
       timeout: 5s
       retries: 3
       start_period: 10s
+
 networks:
   giropops-senhas:
     driver: bridge
 
 volumes:
-  natalia:
+  redis-data:
+  natalia:

helmfile.yaml

@@ -0,0 +1 @@
+teste

manifests/giropops-senhas-deployment.yaml

@@ -19,7 +19,18 @@ spec:
         name: giropops-senhas
         ports:
         - containerPort: 5000
-        imagePullPolicy: Always
+        securityContext:
+          runAsGroup: 10001
+          runAsUser: 10001
+          allowPrivilegeEscalation: false
+          runAsNonRoot: true
+          seccompProfile:
+            type: RuntimeDefault
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+        imagePullPolicy: IfNotPresent
         resources:
           limits:
             memory: "256Mi"

manifests/redis-deployment.yaml

@@ -15,10 +15,21 @@ spec:
         app: redis
     spec:
       containers:
-      - image: redis
+      - image: cgr.dev/chainguard/redis
         name: redis
         ports:
-          - containerPort: 6379
+        - containerPort: 6379
+        securityContext:
+          runAsGroup: 10001
+          runAsUser: 10001
+          allowPrivilegeEscalation: false
+          runAsNonRoot: true
+          seccompProfile:
+            type: RuntimeDefault
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
         resources:
           limits:
             memory: "256Mi"