OPS-02 — CI/CD & environments — staging, pre-production, production
GitHub Actions gates, Docker images, Dokploy apps for staging (dev branch) and production (master), domains and TLS, secrets, nightly backups to object storage, docs deployment.
| Field | Details |
|---|---|
| Task code | OPS-02 |
| Phase | P0 — Foundations (cadrage, UX/UI, architecture & contract) |
| Product scope | V1 |
| Status | Planned |
| Start | Mon 19 Oct 2026 |
| Due | Mon 19 Oct 2026 |
| Responsible | Anis — Full-stack developer |
| Co-responsible | — |
| Effort | 1 person-day(s) planned · 4 from scratch · size S |
| Area · app | DevOps · ops |
| Depends on | SRV-04 |
| Unblocks | — |
| Milestones | — |
Summary
GitHub Actions gates, Docker images, Dokploy apps for staging (dev branch) and production (master), domains and TLS, secrets, nightly backups to object storage, docs deployment.
Description
The cahier requires development, pre-production (client acceptance) and production environments with backups, domains and certificates (§13.1, §13.2; OPS-01, OPS-02, SEC-03, SEC-05, NFR-02). This task sets up GitHub Actions gates and Docker images, then Dokploy on the VPS: staging auto-deployed from dev, pre-production (recette) deployed from a release-candidate tag, production from master tags, each with its own PostgreSQL and Redis, env groups for secrets, domains with Let's Encrypt TLS through Traefik, migrations as a pre-deploy step, nightly database backups to object storage with a retention policy, uptime checks, and the docs deployment on the VPS (restricted access). Domains follow AUTHORING §3 (api.hoco.dz, api-staging.hoco.dz, app.hoco.dz; back-office domain to confirm). Out of scope: the restore drill (SRV-28) and production data import (LCH-01).
Note
Subtasks
| # | Subtask | Owner |
|---|---|---|
| 1 | CI workflow: lint, typecheck, unit + DB tests with Postgres/Redis service containers, contract checks, build; required checks on dev and master | Anis |
| 2 | Image workflow: build server (api/worker), dashboard and web images, push to GHCR tagged with commit sha and version | Anis |
| 3 | Dokploy staging: apps hoco-api-staging, hoco-worker-staging, hoco-dashboard-staging, hoco-web-staging, mock-api-staging; Postgres and Redis services; auto-deploy on dev | Anis |
| 4 | Dokploy pre-production (hoco-*-preprod) deployed from release/x.y.z RC tags, seeded with anonymised demo data for recette | Anis |
| 5 | Dokploy production (hoco-api, hoco-worker, hoco-dashboard, hoco-web) deployed from master tags with manual approval | Anis |
| 6 | Env groups per environment (database, Redis, S3, FCM, SMS, email, Better Auth secret, Sentry DSN); no secret in the repository | Anis |
| 7 | Domains and TLS: api-staging.hoco.dz, api.hoco.dz, app.hoco.dz, back-office domain, HSTS and HTTP→HTTPS redirect | Anis |
| 8 | Pre-deploy migration job (prisma migrate deploy) and rollback procedure by image tag | Anis |
| 9 | Nightly pg_dump cron to object storage, retention 7 daily / 4 weekly / 12 monthly (to validate with HOCO), MinIO/S3 bucket versioning | Anis |
| 10 | Uptime checks on /health and /ready, alert to email; docs deployed on the VPS with the other apps | Anis |
Deliverables
- .github/workflows/{ci,images,deploy-staging,deploy-preprod,deploy-production,docs}.yml
- Dokploy projects hoco-staging, hoco-preprod, hoco-production with apps and services
- Backup cron and bucket with retention rules; runbook /docs/srs/deployment-and-operations
- DNS records and TLS certificates for staging and production domains
Acceptance criteria
- A merge to dev deploys staging automatically and the new version is visible at https://api-staging.hoco.dz/health within 10 minutes
- A failing test or lint blocks the merge; a migration failure aborts the deploy and keeps the previous version running
- Production deploys only from a master tag with a manual approval step
- All environments are HTTPS only with valid certificates (SEC-03)
- A nightly backup file exists in object storage for each of the last 3 nights and old files are pruned per the policy (SEC-05)
Requirements covered
| Requirement | Title | Release |
|---|---|---|
| OPS-01 | Three environments: development, pre-production (client acceptance), production | V1 |
| OPS-02 | Deployment: server, database, storage, backups, domains, certificates, external services, store publication | V1 |
| SEC-03 | HTTPS everywhere | V1 |
| SEC-05 | Automatic backups, retention policy and restore tests | V1 |
| NFR-02 | Availability: supervised service, backups and a tested restore procedure | V1 |
Test measures
- Deploy a no-op change through dev → staging and a tagged RC → pre-production
- Rollback drill: redeploy the previous image tag on staging
- Check backup job logs and object listing after the first three nights
Risks
- Single VPS is a single point of failure — off-site backups from day one, documented re-provisioning, and a sizing review in SRV-28
- Final domain not confirmed by HOCO — use staging subdomains under a project domain and switch DNS during LCH-01
KPI
- Delivered by Mon 19 Oct 2026 within 1 person-day(s).
- Every acceptance criterion above demonstrated before hand-off; linked requirements' acceptance criteria pass.
- Zero open critical defects, permission gaps or data-integrity regressions at sign-off.
Generated from content/plan/tasks.json by scripts/generate-team-tasks.mjs. Dates are computed by the scheduler (Sunday–Thursday weeks, holidays excluded) — change the plan, not this page.
SRV-08 — Jobs & notifications infrastructure
BullMQ queues and scheduler, transactional outbox, notification service (inbox, FCM push, SMS, email adapters with dev simulators), templates and the event → channel matrix.
SRV-11 — Catalog module
Brands, category tree with sub-categories, products, variants, images, specs, per-category filterable attributes, statuses (incl. automatic out-of-stock), visibility, guest-safe search with combinable filters, facets with counts and barcode lookup.