# Infrastructure And Runtime

## Production Hosting Model

Target production topology:

- Public edge: managed WAF/reverse proxy terminates TLS and injects `X-Forwarded-Proto: https`.
- App network: API and worker containers run on private subnets only.
- Data network: managed PostgreSQL is reachable only from app/worker private service identities.
- Observability network: Prometheus or metrics gateway can reach `/metrics`; public clients cannot.

Runtime config gates:

- `BANKING_HOSTING_ARCHITECTURE` must describe the hosting model for preprod/production.
- `BANKING_NETWORK_SEGMENTATION` must describe public edge, private app and private data boundaries.
- `BANKING_PRIVATE_SERVICE_ACCESS=true` is required for preprod/production.
- `BANKING_ALLOWED_HOSTS`, `BANKING_TLS_REQUIRED=true`, `BANKING_TRUSTED_PROXY_REQUIRED=true`, `BANKING_HSTS_ENABLED=true` and `BANKING_WAF_MODE=enforce` are required at the edge.

`deploy/nginx.runtime.example.conf` shows the expected reverse proxy shape. The API should bind to localhost or a private service address, not directly to the internet.

## Internal Metrics

`/metrics` is protected in two layers:

- Reverse proxy allow rules should only allow internal monitoring CIDRs.
- The API enforces `BANKING_METRICS_ALLOWED_CIDRS` against the direct peer IP.

Default API CIDRs include loopback, RFC1918 and carrier-grade NAT ranges. Production should set a narrower monitoring CIDR list.

`deploy/observability/` contains the Prometheus scrape config, alert rules, Alertmanager routing and Grafana dashboard pack. Preprod and production config requires observability references through `BANKING_OBSERVABILITY_DASHBOARD_PACK`, `BANKING_OBSERVABILITY_ALERT_RULES`, `BANKING_INCIDENT_RUNBOOK_PACK`, `BANKING_MAJOR_INCIDENT_CONTACTS`, `BANKING_BCDR_TEST_REFERENCE` and `BANKING_CHAOS_TEST_PLAN`.

## Request Correlation And Logs

Every API request can preserve or generate:

- `X-Request-ID`
- `X-Correlation-ID`
- W3C `traceparent`

The same values are returned in response headers and are available for outbound provider adapters through the correlation helper. Structured redacted logs include `request_id` and `trace_id` when `BANKING_STRUCTURED_LOGS_ENABLED=true`, which is required for preprod and production.

## PostgreSQL HA, PITR, And Restore

Preprod and production refuse to boot unless these controls are declared:

- `BANKING_POSTGRES_HA_ENABLED=true`
- `BANKING_POSTGRES_PITR_ENABLED=true`
- `BANKING_RESTORE_DRILL_REFERENCE=<ticket-or-report>`

The database should be a managed PostgreSQL cluster or equivalent with:

- multi-AZ or equivalent failover,
- encrypted storage and backups,
- point-in-time recovery,
- tested restore drill evidence,
- private connectivity from API and worker services only.

## Environments

Supported application environments:

- `development`: local developer defaults allowed.
- `staging`: shared smoke/integration environment; can use local compose defaults.
- `preprod`: production-like config gates, provider rehearsals and migration approval evidence.
- `production`: production-like config gates, protected CD environments and signed digest deploys.

Use `deploy/.env.staging.example` for local staging smoke and `deploy/.env.preprod.example` as a production-like template.

## Resources And Health

The runtime image contains `/healthcheck`, which verifies `/readyz` using the trusted proxy headers expected by the API. Docker Compose examples configure:

- `cpus`,
- `mem_limit`,
- `pids_limit`,
- API healthchecks,
- private port binding through `BANKING_API_BIND_ADDR`.

Kubernetes or another orchestrator should map `/healthcheck` to readiness/liveness probes and enforce memory/CPU requests and limits matching `BANKING_RESOURCE_PROFILE`.

## Async Workers

The API image includes `/banking-worker` for asynchronous settlement work. Production should run:

- API containers with `BANKING_EMBEDDED_WORKER_ENABLED=false`.
- Worker containers with `/banking-worker`.
- `BANKING_ASYNC_BACKEND=postgres` for the current database-backed work queue, or `managed_queue` once a dedicated provider queue is integrated.

`deploy/docker-compose.remote.yml` includes a `worker` service under the `workers` profile.

## Autoscaling And Rollouts

Preprod and production require `BANKING_AUTOSCALING_POLICY` and support:

- `BANKING_DEPLOYMENT_STRATEGY=rolling`
- `BANKING_DEPLOYMENT_STRATEGY=blue_green`
- `BANKING_DEPLOYMENT_STRATEGY=canary`

The CD workflow records `deployment_strategy` and `canary_percent` in the deployment manifest and passes them to the remote deploy hook. A production orchestrator should map those values to the platform's native blue/green or canary controller before traffic is shifted.