From b77de0c9d011b221d4c82fc9562ca7c287b824cf Mon Sep 17 00:00:00 2001
From: "Gan, Jimmy" <jimmy.gan@adidas.com>
Date: Sat, 11 Jul 2026 04:58:57 +0800
Subject: [PATCH] docs: add sprint 07 operations hardening summary

---
 docs/sprint-07-hardening-summary.md | 52 +++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 docs/sprint-07-hardening-summary.md

diff --git a/docs/sprint-07-hardening-summary.md b/docs/sprint-07-hardening-summary.md
new file mode 100644
index 0000000..dc41494
--- /dev/null
+++ b/docs/sprint-07-hardening-summary.md
@@ -0,0 +1,52 @@
+# Sprint 07 — Operations Hardening Summary
+
+This document summarizes the changes implemented and deployed during Sprint 07 for the `nas-tools` repository.
+
+## Completed Tasks
+
+### S07.1 — Audit Log Rotation
+- **Files modified:** `dashboard/backend/main.py`
+- **Changes:** Replaced standard `logging.FileHandler` with `logging.handlers.RotatingFileHandler`. Set a file size limit of 10MB (`maxBytes=10*1024*1024`) and retained 5 backup files (`backupCount=5`) to prevent disk space exhaustion.
+- **Path:** `/volume1/docker/nas-dashboard/audit.log`
+
+### S07.2 — Database Backups (OPC & Config Paths)
+- **Files modified:** `backup.sh`
+- **Changes:**
+  1. Added `OPC DB` dump using `pg_dump` targeting the database container `gitea-db` on port 5432, database `opc`.
+  2. Added `/volume1/docker/nas-dashboard/rbac.json` and `/volume1/docker/nas-dashboard/audit.log` to the configuration backups list.
+  3. Removed the deprecated and dead path `/volume1/docker/openclaw/data`.
+
+### S07.3 — Dynamic Health Check Endpoint
+- **Files modified:** `dashboard/backend/main.py`
+- **Changes:**
+  - Enhanced `/api/health` to dynamically query database pool availability, Docker socket ping status, and disk space usage (free GB).
+  - Returns `200 OK` with JSON statistics on success: `{"status":"ok","db":"connected","docker":"healthy","disk":{"free_gb": N}}`.
+  - Returns `503 Service Unavailable` with details if any critical dependency is down.
+
+### S07.4 — Docker Resource Limits & Synology CPU CFS Fix
+- **Files modified:** `dashboard/docker-compose.yml`, `claude-dev/docker-compose.yml`
+- **Changes:**
+  - Set container memory limits (`mem_limit: 128m` for proxy, `mem_limit: 2g` for dashboard/claude-dev).
+  - Added a container health check block in the dashboard configuration.
+  - **Synology Kernel Portability Fix:** Initially, CPU limits (`cpus:`) were added. However, the Synology NAS kernel does not support the CPU CFS scheduler, causing the deployment workflow to fail with:
+    `Error response from daemon: NanoCPUs can not be set, as your kernel does not support CPU CFS scheduler...`
+    To resolve this, all `cpus:` constraints were removed, retaining only `mem_limit` (which is fully supported by Synology).
+
+### S07.5 — Sidebar Integration (OpenConnector)
+- **Files modified:** `dashboard/backend/config.py`, `dashboard/frontend/src/components/Sidebar.svelte`, `dashboard/frontend/src/App.svelte`
+- **Changes:**
+  - Added OpenConnector (`https://connector.jimmygan.com` with LAN port 3002 bypass) as an external tool in the Sidebar config under the "Tools" section.
+  - Integrated OpenConnector into the command palette search index (`App.svelte`).
+
+---
+
+## Infrastructure & CI/CD Adjustments
+
+### 1. Gitea SSH Ports Configuration (`~/.ssh/config`)
+- Fixed Gitea repository authentication and remote sync issues.
+- Updated `~/.ssh/config` to force Gitea host remotes (`100.78.131.124`, `gitea-nas`, `gitea-jp`, and LAN `192.168.31.222`) to use SSH Port `2222` instead of default Port `22`.
+- Tied the LAN IP `192.168.31.222` to `IdentityFile ~/.ssh/id_ed25519_nas`.
+
+### 2. CI/CD Deployment Verification
+- CI workflows (Runs #1177, #1178, and #1179) were triggered for both `main` and `dev` branches.
+- Verified that local containers `nas-dashboard` and `nas-dashboard-dev` are running and healthy on the Synology target.