fix(platform): apply production hardening from audit plan

Close billing, tenancy, migration, build, and CI/CD gaps identified in the
audit: wallet/gateway guards, full-UUID namespaces, idempotent migrations with
base schema, stateful service stability, safer Dockerfiles/git builds, and
platform chart hardening (Redis auth, RollingUpdate, backups, Swagger off).

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/helm/cloudhost-platform/migrations/001_service_access_grants.sql

@@ -1,16 +1,20 @@
 -- Temporary external access grants (Redis, RabbitMQ, database)
-CREATE TYPE service_access_target AS ENUM (
-  'database',
-  'redis',
-  'rabbitmq_amqp',
-  'rabbitmq_management'
-);
+DO $$ BEGIN
+  CREATE TYPE service_access_target AS ENUM (
+    'database',
+    'redis',
+    'rabbitmq_amqp',
+    'rabbitmq_management'
+  );
+EXCEPTION WHEN duplicate_object THEN null; END $$;
 
-CREATE TYPE service_access_grant_status AS ENUM (
-  'active',
-  'expired',
-  'revoked'
-);
+DO $$ BEGIN
+  CREATE TYPE service_access_grant_status AS ENUM (
+    'active',
+    'expired',
+    'revoked'
+  );
+EXCEPTION WHEN duplicate_object THEN null; END $$;
 
 CREATE TABLE IF NOT EXISTS service_access_grants (
   id UUID PRIMARY KEY DEFAULT gen_random_uuid(),

backend/helm/cloudhost-platform/migrations/015_application_product_type.sql

@@ -3,7 +3,7 @@ ALTER TABLE applications
   ADD COLUMN IF NOT EXISTS product_type VARCHAR(32) NOT NULL DEFAULT 'application';
 
 CREATE INDEX IF NOT EXISTS idx_applications_user_product_type
-  ON applications (user_id, product_type);
+  ON applications ("userId", product_type);
 
 ALTER TABLE resource_credits
   ADD COLUMN IF NOT EXISTS product_type VARCHAR(32) NOT NULL DEFAULT 'application';

backend/helm/cloudhost-platform/templates/backend-deployment.yaml

@@ -9,8 +9,14 @@ metadata:
     {{- include "cloudhost-platform.labels" . | nindent 4 }}
 spec:
   replicas: {{ .Values.backend.replicas }}
+  # Zero-downtime rollouts: DB migrations run in a pre-upgrade hook Job, so the
+  # new pod only starts against a ready schema. The uploads PVC is RWO but
+  # local-path volumes pin pods to the same node, so surge pods can attach.
   strategy:
-    type: Recreate
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
   selector:
     matchLabels:
       app: {{ include "cloudhost-platform.backend.fullname" . }}
@@ -72,6 +78,11 @@ spec:
               value: {{ include "cloudhost-platform.redis.fullname" . }}
             - name: REDIS_PORT
               value: "6379"
+            - name: REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "cloudhost-platform.secretName" . }}
+                  key: redis-password
             - name: JWT_SECRET
               valueFrom:
                 secretKeyRef:

backend/helm/cloudhost-platform/templates/migrations-job.yaml

@@ -7,7 +7,9 @@ metadata:
   labels:
     {{- include "cloudhost-platform.labels" . | nindent 4 }}
   annotations:
-    helm.sh/hook: post-install,post-upgrade
+    # Run BEFORE the backend rolls out so schema-dependent code never starts
+    # against an unmigrated database.
+    helm.sh/hook: pre-install,pre-upgrade
     helm.sh/hook-weight: "5"
     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
 spec:
@@ -47,9 +49,20 @@ spec:
             - -c
             - |
               set -e
+              # Track applied migrations so each file runs exactly once — the
+              # loop is idempotent across every helm upgrade.
+              psql -v ON_ERROR_STOP=1 -c "CREATE TABLE IF NOT EXISTS schema_migrations (filename TEXT PRIMARY KEY, applied_at TIMESTAMPTZ NOT NULL DEFAULT NOW());"
               for f in $(ls /migrations/*.sql | sort); do
-                echo ">>> Applying $f"
-                psql -v ON_ERROR_STOP=1 -f "$f"
+                name=$(basename "$f")
+                applied=$(psql -tA -c "SELECT 1 FROM schema_migrations WHERE filename = '$name';")
+                if [ "$applied" = "1" ]; then
+                  echo ">>> Skipping $name (already applied)"
+                  continue
+                fi
+                echo ">>> Applying $name"
+                psql -v ON_ERROR_STOP=1 --single-transaction \
+                  -f "$f" \
+                  -c "INSERT INTO schema_migrations (filename) VALUES ('$name');"
               done
               echo ">>> All migrations applied"
           volumeMounts:

backend/helm/cloudhost-platform/templates/postgres-backup.yaml

@@ -41,6 +41,8 @@ spec:
                   FILE="/backup/cloudhost-${STAMP}.sql.gz"
                   pg_dump | gzip > "$FILE"
                   echo "Backup written to $FILE"
+                  # Retention: keep the last {{ .Values.backups.postgres.retentionDays | default 7 }} days
+                  find /backup -name 'cloudhost-*.sql.gz' -mtime +{{ .Values.backups.postgres.retentionDays | default 7 }} -delete
               volumeMounts:
                 - name: backup
                   mountPath: /backup

backend/helm/cloudhost-platform/templates/postgres-deployment.yaml

@@ -19,6 +19,10 @@ spec:
       labels:
         app: {{ include "cloudhost-platform.postgres.fullname" . }}
     spec:
+      {{- with .Values.postgres.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: postgres
           image: {{ .Values.images.postgres | quote }}

backend/helm/cloudhost-platform/templates/redis-deployment.yaml

@@ -19,9 +19,26 @@ spec:
       labels:
         app: {{ include "cloudhost-platform.redis.fullname" . }}
     spec:
+      {{- with .Values.redis.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: redis
           image: {{ .Values.images.redis | quote }}
+          args: ["--requirepass", "$(REDIS_PASSWORD)"]
+          env:
+            - name: REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "cloudhost-platform.secretName" . }}
+                  key: redis-password
+            # redis-cli reads REDISCLI_AUTH so authenticated probes need no -a flag
+            - name: REDISCLI_AUTH
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "cloudhost-platform.secretName" . }}
+                  key: redis-password
           ports:
             - containerPort: 6379
           volumeMounts:

backend/helm/cloudhost-platform/templates/secret.yaml

@@ -22,6 +22,10 @@ Secret out-of-band (e.g. SealedSecret in the gitops repo).
 {{- if not $kubeconfigKey }}
 {{- if and $existing (hasKey $existing.data "cluster-kubeconfig-key") }}{{- $kubeconfigKey = index $existing.data "cluster-kubeconfig-key" | b64dec }}{{- else }}{{- $kubeconfigKey = randAlphaNum 32 }}{{- end }}
 {{- end }}
+{{- $redisPass := .Values.redis.password }}
+{{- if not $redisPass }}
+{{- if and $existing (hasKey $existing.data "redis-password") }}{{- $redisPass = index $existing.data "redis-password" | b64dec }}{{- else }}{{- $redisPass = randAlphaNum 24 }}{{- end }}
+{{- end }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -35,4 +39,5 @@ stringData:
   jwt-secret: {{ $jwt | quote }}
   jwt-refresh-secret: {{ $jwtRefresh | quote }}
   cluster-kubeconfig-key: {{ $kubeconfigKey | quote }}
+  redis-password: {{ $redisPass | quote }}
 {{- end }}

backend/helm/cloudhost-platform/values-production.example.yaml

@@ -8,6 +8,11 @@ global:
   storageClass: local-path   # k3s example
 
 images:
+  # Mirror Docker Hub images through your private registry so cluster nodes
+  # never pull from docker.io directly (matches the kaniko/Harbor setup).
+  postgres: registry.example.com/mirror/postgres:16-alpine
+  redis: registry.example.com/mirror/redis:7-alpine
+  busybox: registry.example.com/mirror/busybox:1.36
   backend:
     repository: registry.example.com/cloudhost-backend
     tag: "1.0.0"
@@ -19,6 +24,15 @@ images:
 
 postgres:
   password: "CHANGE_ME_STRONG_POSTGRES_PASSWORD"
+  # Pull secret for the mirrored postgres image
+  imagePullSecrets:
+    - name: registry-pull-secret
+
+redis:
+  # Auto-generated and persisted in the platform Secret when left empty.
+  password: ""
+  imagePullSecrets:
+    - name: registry-pull-secret
 
 secrets:
   jwtSecret: "CHANGE_ME_LONG_JWT_SECRET"
@@ -44,6 +58,20 @@ backend:
     PLATFORM_DOMAIN: apps.example.com
     REGISTRY_URL: registry.cloudhost-builds.svc.cluster.local:5000
     REGISTRY_PULL_URL: registry.cloudhost-builds.svc.cluster.local:5000
+    # Mirror prefix for base images in generated Dockerfiles + managed services
+    BASE_IMAGE_REGISTRY: registry.example.com/mirror
+    # Elastic log-stack credentials (must match the logging namespace Secret)
+    ELASTIC_PASSWORD: "CHANGE_ME_ELASTIC_PASSWORD"
+    FLUENTBIT_PASSWORD: "CHANGE_ME_FLUENTBIT_PASSWORD"
+    KIBANA_SYSTEM_PASSWORD: "CHANGE_ME_KIBANA_PASSWORD"
+    # Swagger stays off in production; set SWAGGER_ENABLED: "true" to expose it
 
 migrations:
   enabled: true
+
+backups:
+  postgres:
+    enabled: true
+    schedule: "0 3 * * *"
+    storageSize: 10Gi
+    retentionDays: 7

backend/helm/cloudhost-platform/values.yaml

@@ -12,6 +12,9 @@ createNamespace: true
 global:
   storageClass: ""
 
+# For clusters without direct docker.io access, point these at your mirror,
+# e.g. registry.abrban.com/abrban/postgres:16-alpine, and set
+# postgres.imagePullSecrets / redis.imagePullSecrets accordingly.
 images:
   postgres: postgres:16-alpine
   redis: redis:7-alpine
@@ -32,12 +35,31 @@ postgres:
   # Leave empty to auto-generate on first install (stored in Secret)
   password: ""
   storage: 10Gi
-  resources: {}
+  # Needed when images.postgres points at a private mirror
+  imagePullSecrets: []
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: "2"
+      memory: 2Gi
 
 redis:
   enabled: true
   storage: 1Gi
-  resources: {}
+  # Leave empty to auto-generate on first install (stored in Secret as redis-password).
+  # With secrets.existingSecret, that Secret must also contain a redis-password key.
+  password: ""
+  # Needed when images.redis points at a private mirror
+  imagePullSecrets: []
+  resources:
+    requests:
+      cpu: 50m
+      memory: 64Mi
+    limits:
+      cpu: 500m
+      memory: 512Mi
 
 backend:
   enabled: true
@@ -49,7 +71,13 @@ backend:
   sourceStorage:
     enabled: false
     existingSecret: ceph-app-sources-credentials
-  resources: {}
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: "2"
+      memory: 2Gi
   extraEnv: {}
   env:
     NODE_ENV: production
@@ -73,7 +101,13 @@ frontend:
   replicas: 1
   imagePullSecrets:
     - name: registry-pull-secret
-  resources: {}
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: "1"
+      memory: 1Gi
 
 # JWT secrets — set in production (values-production.example.yaml)
 secrets:
@@ -117,6 +151,7 @@ monitoring:
 
 backups:
   postgres:
-    enabled: false
+    enabled: true
     schedule: "0 3 * * *"
     storageSize: 10Gi
+    retentionDays: 7