DevSecOps-Lab - GitLite

KO | EN

gitlite — search

#php #tensorflow #go #privacy #sql #dotnet #react-native #large-language-models #security #vue

DevSecOps-Lab

(★ 9)

End-to-end DevSecOps Task Manager demonstrating automated testing, security scanning, containerization, monitoring, and cloud deployment.

파일 탐색기

ZIP 다운로드

- - auth.integration.test.ts
  - tasks.integration.test.ts
- - auth.controller.test.ts
  - tasks.controller.test.ts
- health.test.ts
- setup.ts
- docker.md
- ESLint.md
- grafana.md
- jenkins.md
- Trivy&SonarQube.md
- - nodejs-app-dashboard.json
- Dockerfile
- jenkins.yaml
- devops-lifecycle-diagram.png
- - auth.controller.ts
  - auth.router.ts
  - auth.service.ts
- - category.controller.ts
  - category.router.ts
  - category.service.ts
- - logger.ts
  - mailer.ts
  - queue.ts
  - rate-limiter.ts
- - db.ts
  - migrate.ts
  - reset-db.ts
  - schema.ts
  - seed.ts
- - bearAuth.ts
  - prometheus.ts
- - tasks.controller.ts
  - tasks.router.ts
  - tasks.service.ts
- - category.validator.ts
  - task.validator.ts
  - user.validator.ts
- index.ts
- server.ts
.dockerignore
.env.example
.eslintrc.js
.gitignore
CI-PIPELINE-EXPLAINED.md
CONTRIBUTING.md
docker-compose.prod.yml
docker-compose.staging.yml
docker-compose.yml
Dockerfile
drizzle.config.ts
eslint.config.mjs
healthcheck.ts
Jenkinsfile
jest.config.ts
LICENSE
main.tf
package.json
pnpm-lock.yaml
prometheus.yml
README.md
requests.http
sonar-project.properties
tsconfig.json

# CDN으로 사용하기

jsDelivr

jsDelivr는 공개 GitHub 리포지토리를 별도 설정 없이 CDN으로 즉시 서빙합니다. 버전과 파일을 고르면 웹페이지에 바로 붙일 수 있는 링크와 예시 코드가 만들어집니다.

버전

파일

링크

예시

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

## Overview

**DevSecOps-TaskManager** is a comprehensive learning project that demonstrates the complete **DevOps lifecycle** through a **Node.js (Express) Task Manager API**. This project showcases how to implement DevOps practices while integrating security (DevSecOps) across all stages of the software development lifecycle.

## 🚀 DevOps Lifecycle Implementation

![DevOps Lifecycle](https://raw.githubusercontent.com/Codeprojectingfuture/DevSecOps-Lab/master/Readme-images/devops-lifecycle-diagram.png)

This project implements the complete DevOps lifecycle:

### **Plan** 📋

- **Requirements gathering** and **project planning**
- **Architecture design** with security considerations
- **Technology stack selection** (Node.js, Express, PostgreSQL, Docker)

### **Code** 💻

- **Version control** with GitHub
- **Code quality standards** with ESLint
- **Security-first coding practices**
- **Documentation** and **code comments**

### **Build** 🔨

- **Automated builds** with GitHub Actions
- **Docker containerization** for consistent environments
- **Dependency management** with pnpm
- **TypeScript compilation** and **optimization**

### **Test** 🧪

- **Unit testing** with Jest (22/22 tests passing)
- **Integration testing** with real database connections
- **Code coverage** reporting
- **Security testing** with Trivy vulnerability scanning

### **Release** 📦

- **Automated versioning** and **tagging**
- **Artifact generation** and **storage**
- **Quality gates** with SonarQube
- **Security scanning** before release

### **Deploy** 🚀

- **Container orchestration** with Docker Compose
- **Azure deployment** strategies
- **Environment configuration** management
- **Rollback capabilities**

### **Operate** ⚙️

- **Application monitoring** with Prometheus
- **Log aggregation** and **analysis**
- **Performance monitoring**
- **Health checks** and **alerts**

### **Monitor** 📊

- **Real-time dashboards** with Grafana
- **Metrics collection** and **visualization**
- **Alert management**
- **Continuous feedback loops**

---

## 🔒 DevSecOps Integration

While implementing the DevOps lifecycle, this project also demonstrates **DevSecOps** principles:

- **Security in Planning**: Threat modeling and security requirements
- **Secure Coding**: Input validation, authentication, and authorization
- **Secure Building**: Container security scanning with Trivy
- **Security Testing**: SAST with SonarQube, vulnerability scanning
- **Secure Deployment**: Secrets management, secure configurations
- **Security Monitoring**: Security metrics and incident response

---

## 🛠️ Technology Stack

### **Core Application**

- **Backend**: Node.js with Express.js
- **Database**: PostgreSQL with Drizzle ORM
- **Authentication**: JWT with bcrypt
- **Validation**: Zod schemas
- **Testing**: Jest with Supertest

### **DevOps Tools**

- **CI/CD**: GitHub Actions + Jenkins
- **Containerization**: Docker + Docker Compose
- **Code Quality**: ESLint + SonarQube
- **Security**: Trivy vulnerability scanner
- **Monitoring**: Prometheus + Grafana
- **Cloud**: Azure deployment

### **Development Tools**

- **Package Manager**: pnpm
- **TypeScript**: Type safety and modern JavaScript
- **Database Migrations**: Drizzle Kit
- **API Documentation**: Built-in with Express

---

## 📌 Observations & Learnings

When starting this project, I approached it mainly from a **DevSecOps mindset**, focusing heavily on security.  
However, as I progressed, I realized that:

- **DevOps is a full lifecycle** (plan → code → build → test → release → deploy → operate → monitor), not just CI/CD pipelines.
- **DevSecOps extends DevOps** by embedding security across all stages, but DevOps itself also emphasizes collaboration, automation, and monitoring.
- Automation is important, but so is **team culture** and **continuous feedback loops**.
- Observability (logs, monitoring, alerts) is just as essential as testing and security.
- CI/CD pipelines are the backbone — in this project, I implemented CI (linting, migrations, tests, coverage reports) and can extend into CD (deployment).

This project is therefore both a **DevOps learning journey** and a **DevSecOps practice project**, combining security awareness with the broader DevOps lifecycle.

### **Key DevOps Principles Demonstrated:**

- **Collaboration**: Cross-functional team practices
- **Automation**: Automated testing, building, and deployment
- **Continuous Integration**: Automated code quality checks
- **Continuous Delivery**: Ready-to-deploy artifacts
- **Monitoring**: Application and infrastructure observability
- **Feedback Loops**: Continuous improvement based on metrics

### **DevSecOps Security Integration:**

- **Shift Left Security**: Security considerations from the planning phase
- **Security as Code**: Infrastructure and configuration as code
- **Automated Security Testing**: SAST, vulnerability scanning
- **Security Monitoring**: Real-time security metrics and alerts

---

## ⚙ DevOps Lifecycle Setup Guide

### **Phase 1: Plan & Code** 📋💻

```bash
# Clone the repository
	git clone https://https://github.com/Codeprojectingfuture/DevSecOps-Lab-.git
cd DevSecOps-TaskManager

# Review the architecture and requirements
# - Node.js Express API
# - PostgreSQL database
# - Docker containerization
# - Security considerations
```

### **Phase 2: Build & Test** 🔨🧪

```bash
# Install dependencies
pnpm install

# Run the development environment
docker-compose up -d

# Execute tests
pnpm run test:unit        # Unit tests (22/22 passing)
pnpm run test: integration # Integration tests
pnpm run lint            # Code quality checks
```

### **Phase 3: Release & Deploy** 📦🚀

```bash
# Build Docker images
docker build -t taskmanager-api .

# Run security scans
trivy image taskmanager-api

# Deploy to Azure
# Configure Azure Container Instances or VM deployment
```

### **Phase 4: Operate & Monitor** ⚙️📊

```bash
# Start monitoring stack
docker-compose -f docker-compose.prod.yml up -d

# Access monitoring dashboards
# - Grafana: http://localhost:3000
# - Prometheus: http://localhost:9090
# - Application: http://localhost:5000
```

---

## 🛠️ DevOps Tools Configuration

### **CI/CD Pipeline Setup**

```bash
# GitHub Actions (already configured)
# - Automated testing on push/PR
# - Code quality checks
# - Security scanning

# Jenkins Integration
# - Webhook URL: http://<jenkins-server>/github-webhook/
# - Configure credentials for GitHub, SonarQube, and Azure
```

### **Monitoring & Observability**

- **Prometheus**: Metrics collection and storage
- **Grafana**: Visualization and alerting
- **Application Metrics**: Custom business metrics
- **Infrastructure Monitoring**: System and container metrics