Flash 75 swap to using nginx ansible docker

[ree13d]

DONT MERGE JUST YET, IRONING OUT A BUG

Merge Request: Infrastructure, Deployment & Developer Experience Overhaul

Overview

This MR introduces a set of improvements aimed at stabilising and simplifying three core areas:

• Local development workflow
• Build & deployment reliability
• Infrastructure provisioning and management

---

1. Local Development Experience Improvements

Improves the ability to develop and test the application locally with minimal friction:

• Simplified workflows for:

  • Edit → run
  • Build → run
  • Running behind nginx locally

• More consistent parity between local and production-like environments via Docker

---

2. Build & Deployment Reliability

This change significantly improves reproducibility and deployment stability:

• The Django application is now fully containerised using Docker

• Dependency management is standardised via pyproject.toml

• Application startup is handled through docker-compose

• Uses a stable Alpine-based nginx container for TLS termination

• nginx is now responsible for:

  • Correct static file serving
  • Media file handling via a dedicated Django media directory

---

3. Infrastructure Provisioning (VM Setup via Runbook)

A major addition is the ability to provision a VM from near-scratch using a runbook.

The runbook automates:

• SSH setup and hardening

• Firewall provisioning

• Docker installation

• Creation of a restricted deploy user (CI-only SSH access for deployment)

• Docker service configuration to:

  • Auto-restart on VM reboot

• Environment and secrets setup

Key outcome:
A VM can now be fully built and deployment-ready on demand via a repeatable process.

---

4. Security & Operational Hardening

Fail2ban

• Enabled on VM
• 5 failed SSH attempts results in a 1-hour IP ban
• Mitigation approach is operationally flexible (alternative access via OCI or alternate IP)

Firewall (UFW)

• Configured with a minimal allow-list
• Aligned with existing Security Rules baseline
• Can be modified or removed if requirements change

---

5. Secrets Management

• Template files added for all required secrets (not stored in-repo)
• Local secret files are excluded via .gitignore and .dockerignore (please verify locally)
• settings.py is no longer treated as sensitive and should not contain credentials or secrets

Secret Injection Model

• Secrets are injected into the VM at build time
• Secrets are then passed into Docker at runtime

Note:
This improves isolation and control compared to the previous setup, but secrets still exist as files on the VM.

Future improvement direction:

• Migrate to a proper secrets manager:

  • Oracle Secret Manager (requires additional IAM/role setup)
  • Or Kubernetes-native secret management if moving to K8s

---

6. Logging & Session Handling

• Log files are capped at 30MB
• Log rotation is enabled

Media/session cleanup behaviour:

• Media downloads tied to expired sessions are cleaned up
• Sessions expire after 1 hour of inactivity
• Cleanup is triggered when the next request hits the index endpoint

---

Summary

This MR establishes a more production-grade foundation by:

• Containerising the full application stack
• Standardising builds and deployments
• Introducing repeatable VM provisioning via runbook
• Hardening security (SSH, firewall, fail2ban)
• Improving media handling and log management
• Laying groundwork for future secrets management improvements

---

(Note: I wrote my own MR description which ended up like 4x A4 pages of solid text and asked a LLM to summarise it, no sensitive or identifying info was included)

(Note2: I am sure the ansible runbooks could be optimized, tightend up, have some more useful tools that we expect in it to be added etc, we should iterate on it.)

(Note3: This new VM+CI/CD doesnt handle pipeline cronjobs triggering yet, but thats next on my todo)