feat(platform): add production CI and containers

src/main/java/com/lab/labtimesheet/config/SecurityConfiguration.java

@@ -12,8 +12,9 @@ import org.springframework.security.web.access.intercept.AuthorizationFilter;
 import org.springframework.security.web.header.writers.ReferrerPolicyHeaderWriter.ReferrerPolicy;
 
 /**
- * Defines form authentication, role-based Admin routes, CSRF protection, and response security headers.
- * Bootstrap access is further constrained by {@link BootstrapAccessFilter} until initialization completes.
+ * Defines form authentication, role-based Admin routes, public health probes, CSRF protection, and response
+ * security headers. Bootstrap access is further constrained by {@link BootstrapAccessFilter} until initialization
+ * completes.
  */
 @Configuration(proxyBeanMethods = false)
 class SecurityConfiguration {
@@ -34,7 +35,7 @@ class SecurityConfiguration {
                 .authorizeHttpRequests(authorize -> authorize
                         .requestMatchers(
                                 "/bootstrap/**", "/activate/**", "/login", "/error", "/assets/**",
-                                "/actuator/health")
+                                "/actuator/health", "/actuator/health/**")
                         .permitAll()
                         .requestMatchers("/admin/**").hasRole("ADMIN")
                         .anyRequest().authenticated())

src/main/java/com/lab/labtimesheet/feature/account/controller/BootstrapAccessFilter.java

@@ -44,7 +44,8 @@ public class BootstrapAccessFilter extends OncePerRequestFilter {
 
     private static boolean allowedBeforeBootstrap(String path) {
         return path.equals("/bootstrap") || path.startsWith("/bootstrap/")
-                || path.equals("/actuator/health") || path.startsWith("/assets/")
+                || path.equals("/actuator/health") || path.startsWith("/actuator/health/")
+                || path.startsWith("/assets/")
                 || path.equals("/error");
     }
 }

src/main/resources/application-prod.yaml

@@ -0,0 +1,53 @@
+# Production profile. Supply every LAB_* value from the deployment environment.
+spring:
+  datasource:
+    url: "${LAB_DB_URL}"
+    username: "${LAB_DB_USERNAME}"
+    password: "${LAB_DB_PASSWORD}"
+  flyway:
+    enabled: true
+    locations: classpath:db/migration
+  jpa:
+    hibernate:
+      ddl-auto: validate
+    open-in-view: false
+  docker:
+    compose:
+      enabled: false
+  lifecycle:
+    timeout-per-shutdown-phase: 30s
+
+server:
+  port: 8080
+  shutdown: graceful
+  forward-headers-strategy: "${LAB_FORWARD_HEADERS_STRATEGY}"
+  servlet:
+    session:
+      cookie:
+        http-only: true
+        secure: true
+        same-site: strict
+  error:
+    include-message: never
+    include-stacktrace: never
+
+management:
+  endpoints:
+    web:
+      exposure:
+        include: "health,info"
+  endpoint:
+    health:
+      show-details: never
+      probes:
+        enabled: true
+      group:
+        liveness:
+          include: "livenessState"
+        readiness:
+          include: "readinessState,db"
+
+lab:
+  public-origin: "${LAB_PUBLIC_ORIGIN}"
+  security:
+    master-key: "${LAB_SECURITY_MASTER_KEY}"

src/main/resources/application.yaml

@@ -10,3 +10,9 @@ spring:
     hibernate:
       ddl-auto: validate
     open-in-view: false
+
+management:
+  endpoint:
+    health:
+      probes:
+        enabled: true