docker-compose.yml (dev/prod profillari) + Dockerfile + .env.example + Makefile

finalize-ep-01 yangiladi

Yangilandi: pr_url

finalize-ep-01 yangiladi

Yangilandi: branch, commit_sha

qa-ep-01-t04-s01 statusni o'zgartirdi Review → Bajarildi

QA 2-aylanish: 5/5 mezon mustaqil isbotlandi. AC 144 tuzatilgan (prod'da postgres/minio ports: umuman yo'q; host'da ss/TCP bilan yopiqligi tasdiqlandi, mutatsiya bilan tekshiruv haqiqiyligi isbotlandi). nginx bind endi ${BIND_ADDR:-0.0.0.0}. 143/145/146/147 regressiyasiz.

qa-ep-01-t04-s01 izoh qoldirdi

QA 2-aylanish (qa-EP-01-T04-S01) — mustaqil isbot, coder da'vosiga tayanilmagan. Test project `-p qat04s01b`, bo'sh portlar (55432/59000/59001/58080/58443). HAMMASI O'TDI (5/5) -> done. AC 144 ✓ ENDI BAJARILGAN (oldingi aylanishda yiqilgan edi): Mexanizm: docker-compose.yml (baza) da postgres/minio uchun `ports:` YO'Q; portni faqat yangi docker-compose.dev.yml overlay qo'shadi; prod overlay'ni ulamaydi. Tekshirdim: - `docker compose config` (prod, baza yolg'iz): `ports:` bloki BUTUN faylda faqat `nginx` da. postgres/minio da umuman yo'q. - Ishlab turgan prod stack: `docker compose port postgres 5432` -> "invalid IP:0"; `port minio 9000` -> shunday; `port app 8080` -> shunday. - `docker inspect`: erpbom-dev-postgres {"5432/tcp":null}, erpbom-dev-minio {"9000/tcp":null}, erpbom-app {"8080/tcp":null}. Faqat erpbom-nginx publish qiladi (80/443). - HOST darajasi (oldingi aylanishdagi asosiy e'tiroz — VM ichidan ham yetib bo'lmasin): `ss -ltn` da 55432/59000/59001 YO'Q; /dev/tcp orqali 127.0.0.1:55432 va :59000 -> REFUSED. Ya'ni endi loopback'dan ham yopiq, mapping umuman yaratilmaydi. - app: healthy (FailingStreak 0), /actuator/health -> {"status":"UP", db UP}. flyway_schema_history: rank 1 / V1 / baseline / success=t, `\dt` -> jadval `public` schema'da (AR-1 ✓). 🔴 MUTATSIYA (tekshiruvim doim-yashil emasligining isboti): docker-compose.yml postgres servisiga vaqtincha `ports: 127.0.0.1:${POSTGRES_PORT}:5432` qaytardim -> `up -d` -> UCHALA tekshiruvim ham QIZARDI: `compose port postgres 5432` -> `127.0.0.1:55432`; `inspect` -> [{"HostIp":"127.0.0.1","HostPort":"55432"}]; host `ss` -> LISTENING, TCP connect -> OPEN. So'ng `git checkout -- deploy/docker-compose.yml` -> sha256 mutatsiyagacha bilan BAYT-MA-BAYT bir xil (4300a792...), `git status` toza, `git diff` bo'sh. Qayta `up -d` -> port yana {"5432/tcp":null} / REFUSED. Bu ayni paytda dev->prod o'tish stsenariysini ham isbotladi: compose portli konteynerni portsizga QAYTA YARATADI (VPS'da `make dev-up` dan keyin `make prod-up` qilinsa port osilib qolmaydi). nginx bind (oldingi aylanishning 2-topilmasi) ✓: `${BIND_ADDR:-0.0.0.0}:${NGINX_HTTP_PORT:-80}:80` (+443). BIND_ADDR .env'dan olib tashlab `config` yurgizdim -> host_ip: 0.0.0.0. Ya'ni haqiqiy VPS'da faylni tahrirlamasdan deploy bo'ladi, Let's Encrypt HTTP-01 ishlaydi. Sandbox sinovida .env: BIND_ADDR=127.0.0.1 -> 127.0.0.1:58080/58443, boshqa hech narsa host'ga chiqmadi. REGRESSIYA — 4 mezon qayta isbotlandi: - AC 143 ✓ dev yo'li (`-f docker-compose.yml -f docker-compose.dev.yml --profile dev`, ya'ni `make dev-up`): postgres+minio `healthy`; portlar 127.0.0.1:55432 / :59000 / :59001 OCHIQ (host'dan TCP OPEN, minio /health/live -> 200, throwaway `postgres:16` psql klientidan `select current_database(), current_schema()` -> erpbom/public, PG16). Bucket MUSTAQIL tasdiqlandi: throwaway `minio/mc` konteyneri (compose tarmog'idan) -> `mc ls l` = faqat `erpbom/`, `mc stat l/erpbom` -> Name: erpbom; nazorat sifatida mavjud bo'lmagan bucket'ga stat -> "does not exist" (tekshiruv diskriminatsiya qiladi). - AC 145 ✓ `config --services`: prod = app, minio, minio-init, nginx, postgres; dev = minio, minio-init, postgres. pgbouncer/redis/rabbitmq YO'Q (AR-3/AR-4). - AC 146 ✓ ikkala compose fayl + Makefile'dagi 17 ta o'zgaruvchi (${VAR} va $$VAR) skript bilan yig'ib .env.example ga solishtirildi — 17/17 bor, yetishmagani yo'q. Yangi BIND_ADDR bor (.env.example:60, default 0.0.0.0, izohi bilan). Majburiy 4 kalit (DB_URL/DB_USER/DB_PASSWORD/JWT_SECRET) BO'SH. `git check-ignore -v deploy/.env` -> .gitignore:6. QA eslatmasi bajarilgan: `deploy/backups/` endi .gitignore:15 da (`git check-ignore` bilan tasdiqlandi); .env.example'da 80/443 bandligi haqida izoh ham qo'shilgan. - AC 147 ✓ Makefile retsepti bash'da ajratib yurgizildi (make o'rnatilmagan). DB'ga QA-CANARY-ROUND2-XYZ qatori qo'yildi. Natija: `file` -> "PGP symmetric key encrypted data - AES with 256-bit key salted & iterated - SHA512"; canary shifrlangan faylda YO'Q; to'g'ri parol bilan ochilganda canary bor; noto'g'ri parol RAD ETILDI. Makefile `-f` ro'yxatlari izchil: COMPOSE (prod/backup) = faqat baza, COMPOSE_DEV (dev-up/dev-down) = baza+overlay. db-backup'ni dev bilan ko'tarilgan stack ustida ham yurgizdim (baza-only COMPOSE bilan) — ishladi, shifrlangan chiqdi. Commit gigiyenasi ✓: `git show --stat HEAD` (55f4f48) = 5 fayl, faqat .gitignore + deploy/{.env.example,Makefile,docker-compose.dev.yml,docker-compose.yml}. Begona fayl (.github/workflows/, openapi/, src/) YO'Q. Branch feat/EP-01-erpbom-backend, tree toza. KICHIK ESLATMA (bloklamaydi, kelajak uchun): AC 143 matnidagi SO'ZMA-SO'Z buyruq `docker compose --profile dev up -d` (overlay `-f` siz) endi postgres/minio ni ko'taradi va bucket'ni yaratadi, lekin HOST PORTINI OCHMAYDI — compose `docker-compose.dev.yml` ni avtomatik yuklamaydi (buni tekshirdim). Dev'ning hujjatlashtirilgan yo'li `make dev-up` (baza+overlay) va u ishlaydi; bu ataylab qilingan tanlov, chunki `docker-compose.override.yml` deb nomlansa prod ham uni AVTOMATIK yuklab AC 144 ni buzardi (override fayl yo'qligini ham tekshirdim). Shu sabab 143 ni `true` qoldirdim; README/onboarding'da dev buyruq sifatida `make dev-up` ko'rsatilsa yetarli. Muhit: test stack `down -v` bilan to'liq tozalandi (konteyner/volume/network qolmadi), qat04s01b-app image o'chirildi, deploy/.env va deploy/backups/ o'chirildi. `docker ps` boshlang'ich holat bilan BIR XIL: erpbom-postgres(5454), erpbom-minio(9494/9495), erpbom-pgbouncer(6432), erpbom-redis(6399), erpbom-scratch-pg(5432), pmboard-app-1, pmboard-web-1 — 7/7 tirik, hech biriga tegilmadi.

qa-ep-01-t04-s01 qabul mezonini belgiladi

✓ `docker compose --profile prod up -d --build` → app `healthy` (Flyway migrate o'tgan), postgres porti tashqaridan yopiq

coder-ep-01-t04-s01 statusni o'zgartirdi Ishlanyapti → Review

coder-ep-01-t04-s01 izoh qoldirdi

AC 144 tuzatildi (qayta urinish). Kamchilik: postgres/minio profilsiz (default) bo'lgani uchun `ports:` bloki --profile prod'da ham amal qilib, portni hostga chiqarardi. YECHIM: docker-compose.yml (baza) dan postgres/minio uchun `ports:` kaliti butunlay olib tashlandi. Yangi deploy/docker-compose.dev.yml overlay FAQAT shu ikkisiga 127.0.0.1 portini qo'shadi (compose ko'p-fayl merge: ports ro'yxati konkatinatsiya qilinadi). Makefile: dev-up/dev-down endi `-f docker-compose.yml -f docker-compose.dev.yml` beradi; prod-up/prod-down/prod-deploy o'zgarishsiz (faqat baza fayl -> portsiz). Qo'shimcha topilgan-tuzatilgan muammo: nginx bind manzili qattiq 127.0.0.1 edi -> bu haqiqiy VPS'da TLS/Let's Encrypt uchun nginx'ni internetdan ko'rinmas qilib qo'yardi. Endi `${BIND_ADDR:-0.0.0.0}` (VPS'da default 0.0.0.0, .env.example'da izohlangan; bu sandbox'da .env: BIND_ADDR=127.0.0.1 qo'yildi, muhit shartiga rioya qilindi). Kichik topilmalar: .gitignore ga `deploy/backups/` qo'shildi; .env.example'da NGINX_HTTP_PORT/HTTPS_PORT yoniga bu hostda 80/443 band (pmboard-web) izohi qo'shildi (POSTGRES_PORT'dagi uslub bilan). ISBOT (test project `-p erpbom-t04s01`, portlar 15432/19000/19001/18080/18443, so'ng to'liq `down -v`): --profile prod (docker-compose.yml YOLG'IZ, overlay ulanmagan): - `docker compose port postgres 5432` -> "invalid IP:0" (bo'sh/xato, mapping yo'q) - `docker compose port minio 9000` -> xuddi shunday - `docker inspect erpbom-dev-postgres --format '{{json .NetworkSettings.Ports}}'` -> {"5432/tcp":null} - `docker inspect erpbom-dev-minio ...` -> {"9000/tcp":null} - `docker compose ps` PORTS ustuni postgres/minio uchun faqat `5432/tcp` / `9000/tcp` (host mapping yo'q) - app: healthy, /actuator/health -> {"status":"UP", db: UP} - flyway_schema_history: 1 qator (baseline, success=t) -> migratsiya o'tgan - nginx: 127.0.0.1:18080/18443 da (BIND_ADDR=.env orqali sandbox uchun 127.0.0.1); `docker compose config` bilan alohida tekshirdim: BIND_ADDR .env'dan olib tashlansa host_ip avtomatik 0.0.0.0 ga qaytadi (haqiqiy VPS default'i) -> curl orqali nginx 200 qaytardi --profile dev (+ docker-compose.dev.yml overlay, AC 143 regressiya tekshiruvi): - postgres: 127.0.0.1:15432->5432 OCHIQ, healthy, pg_isready OK (host'dan) - minio: 127.0.0.1:19000->9000, 127.0.0.1:19001->9001 OCHIQ, healthy, /minio/health/live -> HTTP 200 (host'dan) - minio-init logi: "Bucket created successfully `local/erpbom`" -> erpbom bucket bor Commit: 55f4f48 (branch feat/EP-01-erpbom-backend, faqat deploy/ + .gitignore, push qilinmagan). Yetim konteynerlarga (erp-*, erpbom-postgres/minio/pgbouncer/redis, erpbom-scratch-pg, pmboard-*) tegilmadi, test stack to'liq tozalandi (down -v, image o'chirildi).

qa-ep-01-t04-s01 izoh qoldirdi

QA (qa-EP-01-T04-S01) — mustaqil isbot, coder da'vosiga tayanilmagan. Test project: `-p qat04s01`, .env bo'sh portlar bilan (55432/59000/59001/58080/58443). Yetim konteynerlarga tegilmadi. ISBOTLANGAN (4/5): - AC 143 ✓ dev profil: docker inspect -> postgres=healthy, minio=healthy. `erpbom` bucket MUSTAQIL tasdiqlandi (throwaway `minio/mc` konteyneridan `mc stat l/erpbom` -> Name: erpbom). Host portlari IDE uchun ochiq (nc 127.0.0.1:55432 OK, minio /health/live -> 200). - AC 145 ✓ `docker compose config --services` (dev+prod) = postgres, minio, minio-init, app, nginx. pgbouncer/redis/rabbitmq YO'Q. - AC 146 ✓ compose'dagi 15 ta ${VAR} + Makefile'dagi BACKUP_GPG_PASSPHRASE — hammasi .env.example da. Ilovaning haqiqiy majburiy 4 kaliti (RequiredEnvironmentProperties: DB_URL/DB_USER/DB_PASSWORD/JWT_SECRET) bor va BO'SH. `git check-ignore -v deploy/.env` -> .gitignore:6; `git ls-files` -> deploy/.env.example TRACKED. - AC 147 ✓ Makefile retsepti qo'lda ajratib yurgizildi (make yo'q). DB'ga QA-CANARY-STRING-42 qatori qo'yildi. Natija: `file` -> "PGP symmetric key encrypted data - AES with 256-bit key salted & iterated - SHA512"; canary shifrlangan faylda YO'Q; gpg bilan ochilganda to'g'ri pg_dump SQL (canary bor, flyway_schema_history + qa_probe COPY bloklari); noto'g'ri parol rad etildi. MUTATSIYA (tekshiruvim haqiqiyligi isboti): - postgres healthcheck `pg_isready ... -p 9999` ga buzildi -> konteyner FailingStreak 12 (ExitCode 2, "no response") va ~100s da `unhealthy` bo'ldi. Healthcheck HAQIQIY, doim-yashil emas. - app healthcheck: BusyBox `wget -qO-` non-2xx da rc=1 qaytaradi (404 yo'lida tekshirildi) — ya'ni /actuator/health 503 (DOWN) bersa healthcheck qizil bo'ladi, qalbaki emas. - Makefile db-backup dan gpg qadami olib tashlandi -> natija `ASCII text`, canary ochiq ko'rinadi. Ikkala mutatsiya `git checkout --` bilan tiklandi, `git status` toza, fayllar mutatsiyagacha nusxa bilan bayt-ma-bayt bir xil. QAYTARILDI — AC 144 (coder `true` qilib qo'ygan, `false` ga qaytardim): App qismi bajarilgan: `--profile prod up -d --build` -> erpbom-app=healthy, /actuator/health {"status":"UP", db UP}, flyway_schema_history: rank 1 / V1 baseline / success=t. App host'ga port ochmaydi (NetworkSettings.Ports: {"8080/tcp":null}) ✓. LEKIN "postgres porti prod'da tashqaridan yopiq" TALABI BAJARILMAGAN: 1. deploy/docker-compose.yml:24-38 — `postgres` servisida `profiles:` KALITI YO'Q, ya'ni u default guruhda va `ports: 127.0.0.1:${POSTGRES_PORT:-5432}:5432` BLOKI PROD'DA HAM AMAL QILADI. Bu taskning o'z ta'rifiga to'g'ridan-to'g'ri zid: "port faqat dev'da tashqariga (5432), prod'da faqat ichki tarmoq". Faylda dev/prod farqi UMUMAN yo'q. ADR-001 §2.7 jadvali ham `postgres` uchun "port tashqariga **ochilmaydi**" deydi — loopback istisnosi yozilmagan. Tasdiq: `docker compose port postgres 5432` -> `127.0.0.1:55432` (prod profil ishlab turganda). Bir xil kamchilik `minio` da (satr 57-59): ADR §2.7 "faqat app va nginx ko'radi" deydi, lekin prod'da ham 9000/9001 host'ga chiqadi. 2. Tarmoq darajasida tekshirdim: 213.139.208.78:55432 -> "Connection refused" (nazorat: 213.139.208.78:80 -> ochiq, ya'ni tashqi yo'l ishlaydi). Ya'ni internetdan yopiq — bu to'g'ri. Ammo VM'ning O'ZIDA har qanday jarayon/foydalanuvchi (yoki buzilgan konteyner) DB'ga faqat parol bilan yetadi. Single-VM deploy'da aynan shu sirt muhim, shuning uchun "loopback yetarli" degan qaror §2.7 talabini QONDIRMAYDI — talab "ports blokini prod'da umuman bermaslik". 3. Aynan shu qattiq yozilgan "hamma port 127.0.0.1" qoidasi (satr 14-16) nginx'ni ham SINDIRADI: satr 140-142 `127.0.0.1:${NGINX_HTTP_PORT:-80}:80` va `...:443`. nginx — prod'ning YAGONA tashqi kirish nuqtasi (ADR §2.7: TLS tugatish, Let's Encrypt). Loopback'ga bog'langan nginx'ga internetdan (va Let's Encrypt HTTP-01 challenge'iga) YETIB BO'LMAYDI. Bind manzili env orqali ham sozlanmaydi — faqat port sozlanadi. Haqiqiy VPS'da bu faylni tahrirlamasdan deploy qilib bo'lmaydi. TUZATISH TAKLIFI (men kodga tegmadim): postgres/minio `ports:` bloklarini prod'dan chiqarish — mas. `docker-compose.dev.yml` overlay yoki alohida `dev` profilli port-publisher; nginx uchun bind manzilini o'zgaruvchiga chiqarish (`${BIND_ADDR:-0.0.0.0}:${NGINX_HTTP_PORT:-80}:80`) va .env.example da sandbox uchun 127.0.0.1 deb izohlash. KICHIK ESLATMALAR (AC'ni bloklamaydi): - `deploy/backups/` .gitignore da YO'Q — db-backup natijasi (shifrlangan bo'lsa ham, DB dump) commit qilinishi mumkin. - .env.example da POSTGRES_PORT=5432 / NGINX_HTTP_PORT=80 / 443 default qiymatlari bu hostda BAND (erpbom-scratch-pg 5432; pmboard-web 80/443) — .env.example faqat 5432 haqida ogohlantiradi, 80/443 haqida yo'q. - Commit gigiyenasi ✓: `git show --stat HEAD` = faqat 5 fayl (.gitignore, deploy/{.env.example,Dockerfile,Makefile,docker-compose.yml}); begona fayl (.github/workflows, openapi/) yo'q. - Konteyner nomlari (erpbom-dev-postgres/-minio/-minio-init, erpbom-app, erpbom-nginx) yetim konteynerlar bilan TO'QNASHMAYDI ✓; default portlar 5454/9494/6432/6399 QILIB QO'YILMAGAN ✓. Muhit: test stack `down -v` bilan to'liq tozalandi, test image o'chirildi, deploy/.env va deploy/backups/ o'chirildi. `docker ps` — 7 ta yetim/pmboard konteyner boshlang'ich holatdagidek tirik.

qa-ep-01-t04-s01 statusni o'zgartirdi Review → Ishlanyapti

QA qaytardi: AC 144 — postgres/minio porti prod profilda ham host'ga ochiq (dev/prod farqi yo'q), nginx esa 127.0.0.1 ga bog'langani uchun prod'da tashqaridan yetib bo'lmaydi. Batafsil comment'da.

qa-ep-01-t04-s01 qabul mezonini belgiladi

✗ `docker compose --profile prod up -d --build` → app `healthy` (Flyway migrate o'tgan), postgres porti tashqaridan yopiq

qa-ep-01-t04-s01 qabul mezonini belgiladi

✓ `make db-backup` dump faylini yaratadi va u shifrlangan (`gpg`/`age`)

qa-ep-01-t04-s01 qabul mezonini belgiladi

✓ `.env.example` da hamma majburiy kalit bor, qiymatlar bo'sh; `deploy/.env` `.gitignore` da

qa-ep-01-t04-s01 qabul mezonini belgiladi

✓ Compose'da pgbouncer/rabbitmq/redis servisi yo'q

qa-ep-01-t04-s01 qabul mezonini belgiladi

✓ `docker compose --profile dev up -d` → postgres va minio `healthy`, `erpbom` bucket mavjud; ilova IDE'dan `dev` profil bilan ulanadi

coder-ep-01-t04-s01 statusni o'zgartirdi Ishlanyapti → Review

coder-ep-01-t04-s01 izoh qoldirdi

make host'da o'rnatilmagan — barcha Makefile retseptlari (dev-up/prod-up/db-backup) qo'lda bash'da aynan shu buyruqlar bilan tekshirildi va o'chirildi (docker compose down -v, faqat o'z project — eski yetim konteynerlarga erpbom-postgres/minio/pgbouncer/redis/erpbom-scratch-pg tegilmadi). app host portga chiqarilmagan (faqat nginx orqali/ichki tarmoq) — bu ADR 2.7 bilan mos, health docker exec orqali tekshirildi. nginx S02 uchun placeholder (TLS/konfiguratsiya yo'q).

coder-ep-01-t04-s01 qabul mezonini belgiladi

✓ `make db-backup` dump faylini yaratadi va u shifrlangan (`gpg`/`age`)

coder-ep-01-t04-s01 qabul mezonini belgiladi

✓ `.env.example` da hamma majburiy kalit bor, qiymatlar bo'sh; `deploy/.env` `.gitignore` da

coder-ep-01-t04-s01 qabul mezonini belgiladi

✓ Compose'da pgbouncer/rabbitmq/redis servisi yo'q

coder-ep-01-t04-s01 qabul mezonini belgiladi

✓ `docker compose --profile prod up -d --build` → app `healthy` (Flyway migrate o'tgan), postgres porti tashqaridan yopiq

coder-ep-01-t04-s01 qabul mezonini belgiladi

✓ `docker compose --profile dev up -d` → postgres va minio `healthy`, `erpbom` bucket mavjud; ilova IDE'dan `dev` profil bilan ulanadi

coder-ep-01-t04-s01 fayllarni qayd etdi

5 ta fayl qayd etildi

coder-ep-01-t04-s01 statusni o'zgartirdi Backlog → Ishlanyapti

Agent ishni boshladi

coder-ep-01-t04-s01 ishga oldi

pm-agent yaratdi

docker-compose.yml (dev/prod profillari) + Dockerfile + .env.example + Makefile