# Безопасный Dockerfile
FROM python:3.9-slim as builder

# Использование не-root пользователя
RUN groupadd -r appuser && useradd -r -g appuser appuser

# Копирование с правильными правами
COPY --chown=appuser:appuser . /app
WORKDIR /app

# Установка зависимостей безопасно
RUN pip install --no-cache-dir -r requirements.txt && \
    pip check  # Проверка конфликтов зависимостей

# Запуск от non-root пользователя
USER appuser

# Использование healthcheck
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
    CMD curl -f http://localhost:8080/health || exit 1

# Безопасные переменные окружения
ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1

CMD ["gunicorn", "app:app", "-b", "0.0.0.0:8080"]

# docker-compose.prod.yml
version: '3.8'

services:
  app:
    build: .
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp
    environment:
      - NODE_ENV=production
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 3

  nginx:
    image: nginx:alpine
    ports:
      - "80:80"
    depends_on:
      - app
    security_opt:
      - no-new-privileges:true

# Установка и использование Trivy
wget https://github.com/aquasecurity/trivy/releases/download/v0.45.1/trivy_0.45.1_Linux-64bit.tar.gz
tar -xzf trivy*.tar.gz
sudo mv trivy /usr/local/bin/

# Сканирование образа
trivy image myapp:latest

# Сканирование с экспортом результатов
trivy image --format json --output scan-report.json myapp:latest

# Интеграция в CI/CD
trivy image --exit-code 1 --severity HIGH,CRITICAL myapp:latest

# Просмотр логов с фильтрацией
docker logs -f --tail 100 container_name | grep -i error

# Мониторинг ресурсов
docker stats --format "table {{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}"

# Аудит безопасности
docker bench-security

# Анализ образов
docker image history myapp:latest
docker inspect myapp:latest

# Установка
wget https://releases.hashicorp.com/vault/1.15.0/vault_1.15.0_linux_amd64.zip
unzip vault_1.15.0_linux_amd64.zip
sudo mv vault /usr/local/bin/

# Запуск в dev режиме (для тестирования)
vault server -dev -dev-root-token-id="root"

# Настройка окружения
export VAULT_ADDR='http://127.0.0.1:8200'
export VAULT_TOKEN='root'

# Включение движка секретов
vault secrets enable -path=secret kv-v2

# Запись секретов
vault kv put secret/app/database \
  username="app_user" \
  password="s3cr3t-p@ssw0rd" \
  host="db.example.com"

# Чтение секретов
vault kv get secret/app/database

# Генерация динамических секретов для БД
vault secrets enable database
vault write database/config/postgres \
  plugin_name=postgresql-database-plugin \
  connection_url="postgresql://{{username}}:{{password}}@localhost:5432/postgres?sslmode=disable" \
  allowed_roles="app"

vault write database/roles/app \
  db_name=postgres \
  creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';" \
  default_ttl="1h" \
  max_ttl="24h"

# Python пример
import hvac
import os

client = hvac.Client(
    url=os.getenv('VAULT_ADDR'),
    token=os.getenv('VAULT_TOKEN')
)

# Чтение секретов
secret = client.secrets.kv.v2.read_secret_version(
    path='app/database'
)
db_password = secret['data']['data']['password']

# app-policy.hcl
path "secret/data/app/*" {
  capabilities = ["read"]
}

path "database/creds/app" {
  capabilities = ["read"]
}

# Создание политики
vault policy write app app-policy.hcl

# Создание токена с политикой
vault token create -policy=app

# alertmanager.yml
global:
  smtp_smarthost: 'smtp.example.com:587'
  smtp_from: 'alerts@example.com'
  smtp_auth_username: 'alertmanager'
  smtp_auth_password: 'password'

route:
  group_by: ['alertname', 'cluster']
  group_wait: 10s
  group_interval: 10s
  repeat_interval: 1h
  receiver: 'slack-notifications'
  
  routes:
  - match:
      severity: critical
    receiver: 'pager-duty'
    
  - match:
      severity: warning
    receiver: 'email-notifications'

receivers:
- name: 'slack-notifications'
  slack_configs:
  - api_url: 'https://hooks.slack.com/services/TOKEN'
    channel: '#alerts'
    send_resolved: true
    
- name: 'pager-duty'
  pagerduty_configs:
  - service_key: 'PAGER_DUTY_KEY'
    
- name: 'email-notifications'
  email_configs:
  - to: 'admin@example.com'
    headers:
      subject: '[ALERT] {{ .GroupLabels.alertname }}'

# alerts.yml
groups:
- name: infrastructure
  rules:
  - alert: HighCPUUsage
    expr: 100 - (avg by (instance) (rate(node_cpu_seconds_total{mode="idle"}[5m])) * 100) > 80
    for: 5m
    labels:
      severity: warning
    annotations:
      summary: "High CPU usage on {{ $labels.instance }}"
      description: "CPU usage is above 80% for more than 5 minutes"
      
  - alert: DiskSpaceLow
    expr: (node_filesystem_avail_bytes{mountpoint="/"} / node_filesystem_size_bytes{mountpoint="/"} * 100) < 10
    for: 2m
    labels:
      severity: critical
    annotations:
      summary: "Low disk space on {{ $labels.instance }}"
      description: "Disk space is below 10% on mountpoint {{ $labels.mountpoint }}"
      
  - alert: ServiceDown
    expr: up == 0
    for: 1m
    labels:
      severity: critical
    annotations:
      summary: "Service {{ $labels.job }} on {{ $labels.instance }} is down"

# prometheus.yml
rule_files:
  - "alerts.yml"

alerting:
  alertmanagers:
  - static_configs:
    - targets:
      - alertmanager:9093

# Память заканчивается
(node_memory_MemTotal_bytes - node_memory_MemAvailable_bytes) / node_memory_MemTotal_bytes * 100 > 90

# Сетевые ошибки
rate(node_network_receive_errs_total[5m]) > 0

# Высокая загрузка диска
rate(node_disk_read_time_seconds_total[5m]) > 0.1

# Доступность сервиса
avg_over_time(up[5m]) < 0.8

-- Основные настройки
shared_buffers = '1GB'           -- 25% от общей памяти
effective_cache_size = '3GB'     -- 75% от общей памяти
work_mem = '64MB'                -- Память для операций сортировки
maintenance_work_mem = '256MB'   -- Память для обслуживания
max_connections = 200            -- Оптимальное количество подключений

-- Настройки производительности
random_page_cost = 1.1           -- Для SSD дисков
effective_io_concurrency = 200   -- Для SSD дисков
wal_buffers = '16MB'
checkpoint_completion_target = 0.9

-- Логирование медленных запросов
log_min_duration_statement = 1000  -- Запросы дольше 1 секунды

-- Активные запросы
SELECT 
    pid,
    usename,
    application_name,
    client_addr,
    state,
    query,
    now() - query_start as duration
FROM pg_stat_activity 
WHERE state = 'active' 
  AND now() - query_start > interval '5 seconds';

-- Статистика по индексам
SELECT 
    schemaname,
    tablename,
    indexname,
    idx_scan as index_scans,
    idx_tup_read as tuples_read,
    idx_tup_fetch as tuples_fetched
FROM pg_stat_user_indexes 
WHERE idx_scan = 0;  -- Неиспользуемые индексы

-- Размеры таблик и индексов
SELECT 
    tablename,
    pg_size_pretty(pg_total_relation_size(schemaname||'.'||tablename)) as total_size,
    pg_size_pretty(pg_relation_size(schemaname||'.'||tablename)) as table_size,
    pg_size_pretty(pg_total_relation_size(schemaname||'.'||tablename) - 
                   pg_relation_size(schemaname||'.'||tablename)) as index_size
FROM pg_tables 
WHERE schemaname NOT IN ('information_schema', 'pg_catalog')
ORDER BY pg_total_relation_size(schemaname||'.'||tablename) DESC;

-- Поиск медленных запросов
SELECT 
    query,
    calls,
    total_time,
    mean_time,
    rows,
    100.0 * shared_blks_hit / nullif(shared_blks_hit + shared_blks_read, 0) AS hit_percent
FROM pg_stat_statements 
ORDER BY mean_time DESC 
LIMIT 10;

-- Анализ планов запросов
EXPLAIN (ANALYZE, BUFFERS) 
SELECT * FROM orders WHERE customer_id = 123 AND created_at > NOW() - INTERVAL '30 days';

-- Создание индексов для частых запросов
CREATE INDEX CONCURRENTLY idx_orders_customer_created 
ON orders(customer_id, created_at DESC);

CREATE INDEX CONCURRENTLY idx_orders_status_created 
ON orders(status, created_at) WHERE status IN ('pending', 'processing');

# postgres_exporter configuration
# Запуск экспортера
./postgres_exporter --extend.query-path=queries.yaml

# Пример queries.yaml
pg_stat_database:
  query: "SELECT datname, numbackends, xact_commit, xact_rollback, blks_read, blks_hit, tup_returned, tup_fetched, tup_inserted, tup_updated, tup_deleted FROM pg_stat_database"
  metrics:
    - datname:
        usage: "LABEL"
        description: "Name of the database"
    - numbackends:
        usage: "GAUGE"
        description: "Number of backends connected to this database"

# .gitlab-ci.yml
stages:
  - test
  - build
  - security
  - deploy

variables:
  DOCKER_HOST: tcp://docker:2375
  DOCKER_DRIVER: overlay2

# Кеширование для ускорения сборок
cache:
  key: ${CI_COMMIT_REF_SLUG}
  paths:
    - node_modules/
    - .cache/pip/
    - vendor/bundle

# Общие настройки для всех job'ов
.default_job: &default_job
  image: docker:latest
  services:
    - docker:dind
  before_script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY

unit_tests:
  <<: *default_job
  stage: test
  image: python:3.9
  script:
    - pip install -r requirements.txt
    - pytest tests/unit/ --cov=app --cov-report=xml
  artifacts:
    reports:
      cobertura: coverage.xml
    paths:
      - coverage/
  coverage: '/TOTAL.*\s+(\d+%)$/'

integration_tests:
  <<: *default_job
  stage: test
  script:
    - docker-compose -f docker-compose.test.yml up -d
    - sleep 30
    - ./wait-for-service.sh http://app:8000/health
    - pytest tests/integration/
    - docker-compose -f docker-compose.test.yml down

e2e_tests:
  <<: *default_job
  stage: test
  image: node:16
  script:
    - npm install
    - npm run test:e2e
  artifacts:
    paths:
      - cypress/screenshots/
      - cypress/videos/

build:
  <<: *default_job
  stage: build
  script:
    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
  only:
    - main
    - develop

security_scan:
  <<: *default_job
  stage: security
  image: aquasec/trivy:latest
  script:
    - trivy image --exit-code 0 --format template --template "@/contrib/html.tpl" -o gl-dependency-scan-report.html $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
    - trivy image --exit-code 1 --severity HIGH,CRITICAL $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
  artifacts:
    paths:
      - gl-dependency-scan-report.html
  allow_failure: true

sast:
  stage: security
  image: 
    name: "golang:1.19"
  script:
    - git clone https://github.com/securego/gosec.git
    - cd gosec/cmd/gosec && go install
    - gosec ./...

deploy_staging:
  <<: *default_job
  stage: deploy
  environment:
    name: staging
    url: https://staging.example.com
  script:
    - echo "Deploying to staging..."
    - kubectl set image deployment/app app=$CI_REGISTRY_IMAGE:$CI_COMMIT_SHA -n staging
    - kubectl rollout status deployment/app -n staging
  only:
    - develop

deploy_production:
  <<: *default_job
  stage: deploy
  environment:
    name: production
    url: https://example.com
  script:
    - echo "Deploying to production..."
    - kubectl set image deployment/app app=$CI_REGISTRY_IMAGE:$CI_COMMIT_SHA -n production
    - kubectl rollout status deployment/app -n production
  when: manual
  only:
    - main

# Параллельное выполнение тестов
parallel_tests:
  <<: *default_job
  stage: test
  parallel: 5
  script:
    - pytest tests/ -n auto --dist=loadfile

# Кросс-платформенные сборки
multi_arch_build:
  <<: *default_job
  stage: build
  script:
    - docker buildx create --use
    - docker buildx build --platform linux/amd64,linux/arm64 -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA --push .

# Сканирование зависимостей
dependency_scan:
  stage: security
  image: ruby:3.1
  script:
    - gem install bundler-audit
    - bundle audit check --update

ansible-project/
├── inventory/
│   ├── production
│   ├── staging
│   └── group_vars/
├── roles/
│   ├── nginx/
│   ├── postgresql/
│   └── app/
├── playbooks/
│   ├── site.yml
│   ├── database.yml
│   └── deploy.yml
└── ansible.cfg

# playbooks/site.yml
- name: Configure web servers
  hosts: webservers
  become: yes
  vars:
    nginx_worker_processes: 4
    app_version: "1.2.3"
  
  roles:
    - role: nginx
    - role: app

- name: Configure database servers
  hosts: dbservers
  become: yes
  roles:
    - role: postgresql

# roles/nginx/tasks/main.yml
- name: Install nginx
  apt:
    name: nginx
    state: latest
    update_cache: yes

- name: Configure nginx
  template:
    src: nginx.conf.j2
    dest: /etc/nginx/nginx.conf
    backup: yes
  notify: restart nginx

- name: Enable nginx service
  systemd:
    name: nginx
    enabled: yes
    state: started

# roles/nginx/handlers/main.yml
- name: restart nginx
  systemd:
    name: nginx
    state: restarted

# roles/nginx/templates/nginx.conf.j2
user www-data;
worker_processes {{ nginx_worker_processes }};
pid /run/nginx.pid;

events {
    worker_connections 1024;
    use epoll;
}

http {
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    gzip on;
    gzip_types text/plain text/css application/json application/javascript;

    server {
        listen 80;
        server_name {{ inventory_hostname }};
        
        location / {
            proxy_pass http://127.0.0.1:8000;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
        }
    }
}

# Динамический inventory для облачных провайдеров
- name: Configure AWS instances
  hosts: localhost
  gather_facts: false
  tasks:
    - ec2_instance_info:
        region: us-east-1
        filters:
          "tag:Environment": production
      register: ec2_instances

    - add_host:
        name: "{{ item.public_ip_address }}"
        groups: aws_instances
      loop: "{{ ec2_instances.instances }}"

# Обработка ошибок и повторные попытки
- name: Deploy application
  command: /opt/app/deploy.sh
  register: deploy_result
  retries: 3
  delay: 5
  until: deploy_result.rc == 0
  ignore_errors: yes

- name: Check deployment status
  debug:
    msg: "Deployment completed successfully"
  when: deploy_result.rc == 0

- name: Handle deployment failure
  debug:
    msg: "Deployment failed after 3 attempts"
  when: deploy_result.rc != 0

# Шифрование секретов
ansible-vault encrypt_string 's3cr3t-p@ssw0rd' --name 'db_password'

# В плейбуке:
- name: Configure database
  hosts: dbservers
  vars:
    db_password: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          3132333435363738393031323334353637383930313233343536373839303132
          
  tasks:
    - name: Create database user
      postgresql_user:
        name: app_user
        password: "{{ db_password }}"

# docker-compose.yml для ELK
version: '3.8'

services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.9.0
    environment:
      - discovery.type=single-node
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      - xpack.security.enabled=false
    volumes:
      - elasticsearch_data:/usr/share/elasticsearch/data
    ports:
      - "9200:9200"

  logstash:
    image: docker.elastic.co/logstash/logstash:8.9.0
    volumes:
      - ./logstash/pipeline:/usr/share/logstash/pipeline
      - ./logstash/config:/usr/share/logstash/config
    ports:
      - "5044:5044"
    depends_on:
      - elasticsearch

  kibana:
    image: docker.elastic.co/kibana/kibana:8.9.0
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
    ports:
      - "5601:5601"
    depends_on:
      - elasticsearch

volumes:
  elasticsearch_data:

# logstash/pipeline/01-inputs.conf
input {
  beats {
    port => 5044
  }
  
  tcp {
    port => 5000
    codec => json
  }
}

# logstash/pipeline/02-filters.conf
filter {
  # Парсинг nginx логов
  if [fileset][module] == "nginx" {
    grok {
      match => { "message" => "%{IPORHOST:remote_ip} - %{DATA:user_name} \[%{HTTPDATE:timestamp}\] \"%{WORD:method} %{DATA:url} HTTP/%{NUMBER:http_version}\" %{NUMBER:response_code} %{NUMBER:body_sent_bytes} \"%{DATA:referrer}\" \"%{DATA:agent}\"" }
    }
    
    date {
      match => [ "timestamp", "dd/MMM/YYYY:HH:mm:ss Z" ]
    }
    
    geoip {
      source => "remote_ip"
    }
  }
  
  # Парсинг application логов
  if [logger_name] == "app" {
    grok {
      match => { "message" => "\[%{TIMESTAMP_ISO8601:timestamp}\] %{LOGLEVEL:level} %{DATA:class} - %{GREEDYDATA:message}" }
    }
  }
}

# logstash/pipeline/03-outputs.conf
output {
  elasticsearch {
    hosts => ["elasticsearch:9200"]
    index => "logs-%{+YYYY.MM.dd}"
  }
}

# filebeat.yml
filebeat.inputs:
- type: log
  paths:
    - /var/log/nginx/access.log
  fields:
    type: nginx
    environment: production

- type: log
  paths:
    - /var/log/app/app.log
  fields:
    type: application
    environment: production

output.logstash:
  hosts: ["logstash:5044"]

setup.template:
  name: "logs"
  pattern: "logs-*"

// Пример сохраненного поиска для ошибок
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "level": "ERROR"
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": "now-1h"
            }
          }
        }
      ]
    }
  }
}

// Kibana Alert для мониторинга ошибок
{
  "name": "High Error Rate",
  "schedule": {
    "interval": "5m"
  },
  "conditions": {
    "agg_type": "count",
    "threshold_comparator": ">",
    "threshold": [100]
  },
  "actions": [
    {
      "type": "email",
      "subject": "High Error Rate Detected",
      "to": ["admin@example.com"],
      "message": "Error count: {{context.conditions.0.agg_value}}"
    }
  ]
}

# Индекс-темплейты для оптимизации
PUT _template/logs_template
{
  "index_patterns": ["logs-*"],
  "settings": {
    "number_of_shards": 3,
    "number_of_replicas": 1,
    "refresh_interval": "30s"
  },
  "mappings": {
    "properties": {
      "@timestamp": {"type": "date"},
      "message": {"type": "text"},
      "level": {"type": "keyword"},
      "remote_ip": {"type": "ip"}
    }
  }
}

# Политика управления индексами (ILM)
PUT _ilm/policy/logs_policy
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_size": "50gb",
            "max_age": "7d"
          }
        }
      },
      "delete": {
        "min_age": "30d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

# Добавление репозитория и установка
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm repo update

# Установка kube-prometheus-stack
helm install monitoring prometheus-community/kube-prometheus-stack \
  --namespace monitoring \
  --create-namespace \
  --set grafana.adminPassword=admin \
  --set prometheus.service.type=NodePort \
  --set alertmanager.service.type=NodePort

# ServiceMonitor для кастомного приложения
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: app-monitor
  namespace: default
spec:
  selector:
    matchLabels:
      app: my-app
  endpoints:
  - port: web
    path: /metrics
    interval: 30s
    relabelings:
    - sourceLabels: [__meta_kubernetes_pod_name]
      targetLabel: pod
    - sourceLabels: [__meta_kubernetes_namespace]
      targetLabel: namespace

# Просмотр логов нескольких подов
kubectl logs -f deployment/app --all-containers=true --prefix=true --tail=100

# Отладка проблем с сетью
kubectl run debug-pod --image=nicolaka/netshoot --rm -i --tty -- /bin/bash

# Проверка DNS
nslookup kubernetes.default.svc.cluster.local

# Проверка сетевой связности
curl -v http://app-service:8080/health

# Анализ ресурсов
kubectl top pods --containers
kubectl describe pod app-pod-12345
kubectl get events --sort-by=.lastTimestamp

# Использование CPU по неймспейсам
sum(rate(container_cpu_usage_seconds_total{namespace="production"}[5m])) by (pod)

# Использование памяти
container_memory_working_set_bytes{container!="", container!="POD"}

# Rate HTTP ошибок
rate(http_requests_total{status=~"5.."}[5m])

# Latency перцентили
histogram_quantile(0.95, rate(http_request_duration_seconds_bucket[5m]))

# Pod для отладки с полным доступом
apiVersion: v1
kind: Pod
metadata:
  name: debug-pod
spec:
  hostNetwork: true
  hostPID: true
  containers:
  - name: debug
    image: busybox
    command: ["sleep", "3600"]
    securityContext:
      privileged: true
    volumeMounts:
    - name: host-root
      mountPath: /host
  volumes:
  - name: host-root
    hostPath:
      path: /

# Horizontal Pod Autoscaler
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: app-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: app
  minReplicas: 2
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300
      policies:
      - type: Percent
        value: 50
        periodSeconds: 60

git reset --soft HEAD~1

git reset --hard HEAD~1

git reset HEAD~1 config.py  # Вытаскиваем файл из коммита
git restore config.py       # Откатываем его в рабочей директории
git commit --amend          # Перезаписываем предыдущий коммит

git checkout -b feature/magic-button

git switch -c feature/magic-button

git switch main
git merge feature/magic-button

print("Hello, World!")
<<<<<<< HEAD
print("Новая крутая фича от меня!")
=======
print("Исправление критического бага от коллеги!")
>>>>>>> branch-hotfix