chore: initial commit of Go API gateway

Baseline for the Kong replacement on api.riotpiao.com. Brings the working tree under version control for the first time: gateway source, the task board that drives the agent runs, test fixtures, and K8s manifests. Anchor the gateway ignore rule to the repo root. Unanchored, "gateway" also matched the cmd/gateway/ source directory, so the program entrypoint was excluded from every commit. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
2026-08-19 20:54:34 -07:00
commit 058f11cf2b
109 changed files with 8992 additions and 0 deletions
@@ -0,0 +1,33 @@
+# 6.1 — Hardened container image (GREEN)
+
+Phase: 6 — Deploy and cutover
+Stage: GREEN
+
+The gateway is the public edge process. It gets no shell, no package manager, no
+writable filesystem and no privileges it does not need.
+
+- [ ] The runtime image is distroless or scratch — no shell, no package manager, no busybox
+- [ ] The container runs as a non-root user, enforced by `runAsNonRoot` and an explicit non-zero UID
+- [ ] The root filesystem is read-only; any writable path the process genuinely needs is an explicitly mounted volume, not a relaxed rootfs
+- [ ] All Linux capabilities are dropped, and none are added back
+- [ ] `seccompProfile` is `RuntimeDefault`
+- [ ] Privilege escalation is disabled
+- [ ] Image tags are the commit SHA of the source that built them. Never `:latest`, never a moving tag — Argo `selfHeal` cannot reconcile a mutable tag reliably, and a rollback needs a tag that still means what it meant yesterday
+- [ ] The image is reproducible from a committed build definition; nothing is built by hand
+- [ ] The image contains no credentials, kubeconfig or service-account token baked in (G2)
+
+## Verify
+
+```bash
+docker run --rm --entrypoint sh <image>:<sha>
+# expected: fails — no shell in the image
+
+docker run --rm --read-only --user 65532 <image>:<sha> --version
+# expected: starts and exits cleanly under a read-only rootfs as a non-root user
+
+docker inspect <image>:<sha> --format '{{.Config.User}}'
+# expected: a non-zero numeric UID, not empty and not "root"
+
+grep -rn 'image:' k8s/ | grep -v '@sha256\|:[0-9a-f]\{7,\}'
+# expected: no matches — every image reference is pinned to a SHA
+```