Session 4 — Infrastructure & Operations

Goal: Confirm infrastructure, deployment, observability, and operational runbooks are production-ready. Estimated time: 60 min

Reading Order

Core Architecture

#	File	What It Covers
1	infrastructure.md	Full deployment architecture: Terraform, Docker Swarm, backup/DR, Ubicloud cutover.
2	observability.md	LGTM stack, instrumentation, PII redaction, SLIs/SLOs, volume monitoring.
3	infrastructure/README.md	Directory layout for docker/, terraform/, scripts/.
4	ssh-access-guide.md	Server access instructions.

CI/CD & Alerting

#	File	What It Covers
5	ci-cd.md	Full CI/CD pipeline spec: Terraform, app deploys, security tooling, quality gates, preview envs.
6	observability-alerts.md	Alert definitions and triage procedures.

Runbooks

#	File	What It Covers
7	backup-verify-runbook.md	Backup integrity verification procedure.
8	secrets-rotation-runbook.md	Docker Swarm secret rotation procedure.
9	manager-failover-runbook.md	Swarm manager node failover procedure.
10	postgres-cutover.md	Ubicloud PostgreSQL migration procedure.
11	legal-hold-runbook.md	GDPR legal hold procedure.
12	observability-terraform-migration.md	Observability stack Terraform migration.

🔍 What to Validate

• [ ] infrastructure.md has a duplicated line about "Edge Routing" (lines 20–21). Confirm and fix.
• [ ] The Ubicloud cutover section is extremely detailed — is this still the plan, or has anything changed?
• [ ] observability.md references promtail in the preview section but the Loki Docker logging driver in the retention section — which is actually deployed?
• [ ] Runbooks: are they executable as written? Could you follow each one step-by-step during an incident?
• [ ] ci-cd.md §3 lists several security mitigations as "⚠️ TODO" — are any resolved?
• [ ] Cross-reference the 14 GitHub Actions workflows in .github/workflows/ against what ci-cd.md describes — any drift?
• [ ] observability.md SLO definitions — are these still the right targets?
• [ ] Production container resource limits: infrastructure.md §5 flags this as mandatory but TODOS.md says none are set. Still true?

GitHub Workflows to Cross-Check

.github/workflows/
├── _build-images.yml
├── backup-verify.yml
├── ci.yml
├── deploy-infra.yml
├── deploy-observability.yml
├── deploy-studio.yml
├── deploy.yml
├── docs-lint.yml
├── index-docs.yml
├── preview-lifecycle.yml
├── preview.yml
├── release.yml
├── secrets-sync.yml
└── terraform.yml

Findings