nas-tools/docs/sprint-07-hardening-summary.md

Sprint 07 — Operations Hardening Summary

This document summarizes the changes implemented and deployed during Sprint 07 for the nas-tools repository.

Completed Tasks

S07.1 — Audit Log Rotation

• Files modified: dashboard/backend/main.py
• Changes: Replaced standard logging.FileHandler with logging.handlers.RotatingFileHandler. Set a file size limit of 10MB (maxBytes=10*1024*1024) and retained 5 backup files (backupCount=5) to prevent disk space exhaustion.
• Path: /volume1/docker/nas-dashboard/audit.log

S07.2 — Database Backups (OPC & Config Paths)

• Files modified: backup.sh
• Changes:
  1. Added OPC DB dump using pg_dump targeting the database container gitea-db on port 5432, database opc.
  2. Added /volume1/docker/nas-dashboard/rbac.json and /volume1/docker/nas-dashboard/audit.log to the configuration backups list.
  3. Removed the deprecated and dead path /volume1/docker/openclaw/data.

S07.3 — Dynamic Health Check Endpoint

• Files modified: dashboard/backend/main.py
• Changes:
  • Enhanced /api/health to dynamically query database pool availability, Docker socket ping status, and disk space usage (free GB).
  • Returns 200 OK with JSON statistics on success: {"status":"ok","db":"connected","docker":"healthy","disk":{"free_gb": N}}.
  • Returns 503 Service Unavailable with details if any critical dependency is down.

S07.4 — Docker Resource Limits & Synology CPU CFS Fix

• Files modified: dashboard/docker-compose.yml, claude-dev/docker-compose.yml
• Changes:
  • Set container memory limits (mem_limit: 128m for proxy, mem_limit: 2g for dashboard/claude-dev).
  • Added a container health check block in the dashboard configuration.
  • Synology Kernel Portability Fix: Initially, CPU limits (cpus:) were added. However, the Synology NAS kernel does not support the CPU CFS scheduler, causing the deployment workflow to fail with: Error response from daemon: NanoCPUs can not be set, as your kernel does not support CPU CFS scheduler... To resolve this, all cpus: constraints were removed, retaining only mem_limit (which is fully supported by Synology).

S07.5 — Sidebar Integration (OpenConnector)

• Files modified: dashboard/backend/config.py, dashboard/frontend/src/components/Sidebar.svelte, dashboard/frontend/src/App.svelte
• Changes:
  • Added OpenConnector (https://connector.jimmygan.com with LAN port 3002 bypass) as an external tool in the Sidebar config under the "Tools" section.
  • Integrated OpenConnector into the command palette search index (App.svelte).

---

Infrastructure & CI/CD Adjustments

1. Gitea SSH Ports Configuration (~/.ssh/config)

• Fixed Gitea repository authentication and remote sync issues.
• Updated ~/.ssh/config to force Gitea host remotes (100.78.131.124, gitea-nas, gitea-jp, and LAN 192.168.31.222) to use SSH Port 2222 instead of default Port 22.
• Tied the LAN IP 192.168.31.222 to IdentityFile ~/.ssh/id_ed25519_nas.

2. CI/CD Deployment Verification

• CI workflows (Runs #1177, #1178, and #1179) were triggered for both main and dev branches.
• Verified that local containers nas-dashboard and nas-dashboard-dev are running and healthy on the Synology target.