2 Commits

Author	SHA1	Message	Date
xarmian	34ebf31fdf	fix: resolve Codex review findings across SSE, audit, metrics, and deployment ... - Make SSE limit checks atomic with subscription via SubscribeIfAllowed to prevent TOCTOU races where concurrent requests bypass connection caps - Replace fmt.Sprintf JSON assembly with json.Marshal (auditMeta helper) in all audit log call sites to prevent silent JSONB insert failures on PostgreSQL when metadata contains special characters - Pass database credentials via PGDATABASE env var instead of pg_dump/psql command-line args to avoid leaking passwords in ps/proc output - Fix audit-log query builder to rebind placeholders once after all filters are appended, preventing duplicate $1 placeholders on PostgreSQL - Replace per-workspace SSE GaugeVec with a single Gauge to avoid unbounded Prometheus label cardinality in multi-tenant deployments - Fix prod Docker Compose: override PAD_REDIS_URL with password and add authenticated Redis healthcheck when REDIS_PASSWORD is set	2026-04-07 01:13:44 +00:00
xarmian	af2755d5af	docs: add deployment documentation, Docker Compose, and K8s manifests ... Provide production-ready deployment configurations: - docker-compose.yml: Pad + PostgreSQL + Redis single-command setup - docker-compose.prod.yml: production overlay with resource limits - deploy/k8s/: Kubernetes manifests (deployment, service, ingress, HPA) - deploy/Caddyfile: Caddy reverse proxy with auto-TLS - deploy/nginx.conf: nginx config with SSE-friendly proxy settings - docs/deployment.md: environment variable reference, architecture diagram, quick start, production checklist	2026-04-06 01:58:04 +00:00