DevOps and Operations

DevOps & Operations

This page covers Git, CI/CD, monitoring, logs, releases, and deployment. Git is the source of truth for IdMux code and operational changes.

Git

• Use short-lived branches from main.
• Keep commits small and easy to review.
• Use pull requests for code and security changes.
• Never commit keys, cookies, tokens, or production data.

CI/CD

CI runs tests, lint, CodeQL, vulnerability checks, and image scans. The release workflow builds versioned images, publishes SBOM and provenance data, and pushes approved images to GHCR.

Deploy immutable image digests. Do not use latest in production.

Monitoring

Use these endpoints in the service checks:

• GET /__idmux/healthz checks process health.
• GET /__idmux/readyz checks whether the proxy can receive traffic.

Alert on failed checks, upstream errors, and unusual session or logout errors.

Logs

Logs use JSON. They may contain a path, event name, status, or selected numeric index. They must never contain cookie values, tokens, encryption keys, or IdP session IDs. Keep retention short and protect production log access.

Releases

The release workflow builds Linux AMD64 and ARM64 images, publishes them to GHCR, and creates SBOM and provenance data. It blocks on high or critical Trivy findings.

Use an immutable image digest in production:

ghcr.io/4nass/idmux-proxy@sha256:<digest>

Do not use latest in production.

Environments and secrets

Never store encryption keys, IdP cookies, tokens, or customer data in Git. Use GitHub Environments and an external secret manager. Prefer short-lived OIDC access over long-lived cloud credentials.

Rollback

Roll back by changing the environment configuration to the last known-good image digest. Record the incident, affected digest, and validation steps.