Привет, я junior DevOps-инженер

# Docker Compose — app + postgres + redis + nginx
version: '3.9'

services:
  app:
    image: ghcr.io/user/my-app:latest
    restart: unless-stopped
    environment:
      NODE_ENV:     production
      DATABASE_URL: postgresql://app:${DB_PASS}@db:5432/appdb
      REDIS_URL:    redis://redis:6379
    depends_on:
      db:    { condition: service_healthy }
      redis: { condition: service_started }
    ports: [ "127.0.0.1:3000:3000" ]
    networks: [ app-net ]

  db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB:       appdb
      POSTGRES_USER:     app
      POSTGRES_PASSWORD: ${DB_PASS}
    volumes: [ pgdata:/var/lib/postgresql/data ]
    healthcheck:
      test:     [ "CMD-SHELL", "pg_isready -U app -d appdb" ]
      interval: 10s
      retries:  5
    networks: [ app-net ]

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    command: redis-server --maxmemory 256mb --maxmemory-policy allkeys-lru
    networks: [ app-net ]

volumes:
  pgdata:

networks:
  app-net:
    driver: bridge

# Kubernetes Deployment + Service + HPA
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
  labels:
    app: my-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-app
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge:       1
      maxUnavailable: 0
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
        - name: app
          image: ghcr.io/user/my-app:latest
          ports:
            - containerPort: 3000
          resources:
            requests:
              cpu:    100m
              memory: 128Mi
            limits:
              cpu:    500m
              memory: 512Mi
          env:
            - name:  NODE_ENV
              value: production
            - name: DB_PASS
              valueFrom:
                secretKeyRef:
                  name: app-secrets
                  key:  db-password
          livenessProbe:
            httpGet:
              path: /health
              port: 3000
            initialDelaySeconds: 15
            periodSeconds:       20
          readinessProbe:
            httpGet:
              path: /health
              port: 3000
            initialDelaySeconds: 5
---
apiVersion: v1
kind: Service
metadata:
  name: my-app-svc
spec:
  selector:
    app: my-app
  ports:
    - port:       80
      targetPort: 3000
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: my-app-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind:       Deployment
    name:       my-app
  minReplicas: 2
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type:               Utilization
          averageUtilization: 70

# prometheus.yml
global:
  scrape_interval:     15s
  evaluation_interval: 15s

rule_files:
  - "alert.rules.yml"

alerting:
  alertmanagers:
    - static_configs:
        - targets: [ "alertmanager:9093" ]

scrape_configs:
  - job_name: prometheus
    static_configs:
      - targets: [ "localhost:9090" ]

  - job_name: node
    static_configs:
      - targets: [ "node-exporter:9100" ]

  - job_name: nginx
    static_configs:
      - targets: [ "nginx-exporter:9113" ]

  - job_name: app
    metrics_path: /metrics
    static_configs:
      - targets: [ "app:3000" ]
---
# alert.rules.yml
groups:
  - name: server
    rules:
      - alert: HighCPU
        expr:  100 - (avg by(instance)(rate(node_cpu_seconds_total{mode="idle"}[5m])) * 100) > 85
        for:   5m
        labels:
          severity: warning
        annotations:
          summary:     "High CPU on {{ $labels.instance }}"
          description: "CPU > 85% for 5 minutes"

      - alert: InstanceDown
        expr:  up == 0
        for:   1m
        labels:
          severity: critical
        annotations:
          summary: "Instance {{ $labels.instance }} is down"

# Ansible Playbook — деплой Docker-приложения на Ubuntu
---
- name: Deploy Application
  hosts: production
  become: true
  vars:
    app_image:   ghcr.io/user/my-app:latest
    app_port:    3000
    app_dir:     /opt/my-app

  tasks:
    - name: Ensure Docker is installed
      apt:
        name:  docker.io
        state: present
        update_cache: yes

    - name: Create app directory
      file:
        path:  "{{ app_dir }}"
        state: directory
        mode:  '0755'

    - name: Copy docker-compose.yml
      template:
        src:  docker-compose.yml.j2
        dest: "{{ app_dir }}/docker-compose.yml"

    - name: Pull latest image
      community.docker.docker_image:
        name:   "{{ app_image }}"
        source: pull
        force_source: true

    - name: Start / Update services
      community.docker.docker_compose_v2:
        project_src: "{{ app_dir }}"
        state:       present
        pull:        always

    - name: Reload Nginx
      systemd:
        name:  nginx
        state: reloaded

    - name: Prune unused Docker images
      command: docker image prune -f
      changed_when: false