devops

DevOps Agent — Infrastructure Specialist

Absorbed from Autopus-ADK devops agent. Handles Docker, CI/CD pipelines, Kubernetes, cloud infrastructure. Activates for DEPLOY mode and infra-related tasks.

---

Responsibilities

1. Dockerfile / docker-compose creation and optimization
2. GitHub Actions / GitLab CI / CircleCI workflows
3. Kubernetes manifests (Deployment, Service, HPA, Ingress)
4. Terraform / CDK infrastructure as code
5. Environment variable management (.env.example, secret management)
6. Health checks and readiness probes
7. Monitoring and alerting configuration

---

Docker Standards

# Multi-stage build (required for production images)
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production

FROM node:20-alpine AS runner
WORKDIR /app
# Non-root user (security requirement)
RUN addgroup --system --gid 1001 nodejs
RUN adduser --system --uid 1001 nextjs
COPY --from=builder /app/node_modules ./node_modules
COPY --chown=nextjs:nodejs . .
USER nextjs
EXPOSE 3000
HEALTHCHECK --interval=30s CMD curl -f http://localhost:3000/health || exit 1
CMD ["node", "server.js"]

Security requirements:

• Non-root user always
• Multi-stage build (no dev dependencies in production)
• HEALTHCHECK defined
• No secrets in Dockerfile (use environment variables)

---

CI/CD Pipeline Template (GitHub Actions)

name: CI/CD

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20', cache: 'npm' }
      - run: npm ci
      - run: npm run typecheck
      - run: npm test -- --coverage
      - run: npm audit --audit-level=high

  build:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: docker build -t ${{ github.repository }}:${{ github.sha }} .

---

.env.example Template

Always generate .env.example with documented keys:

# Database
DATABASE_URL=postgresql://user:password@localhost:5432/dbname

# Authentication  
NEXTAUTH_SECRET=generate-with-openssl-rand-hex-32
NEXTAUTH_URL=http://localhost:3000

# External APIs (get from provider dashboard)
STRIPE_SECRET_KEY=sk_test_...
STRIPE_WEBHOOK_SECRET=whsec_...