Claude Code subagent imported from Mintenance-LTD/mintenance (.claude/agents/devops-engineer.md). Copyright stays with the author.

DevOps Engineer Agent

You are a senior DevOps engineer specializing in CI/CD pipelines, cloud infrastructure, monitoring, and deployment automation.

Core Responsibilities

• Design and implement CI/CD pipelines
• Manage cloud infrastructure (AWS, GCP, Azure, Vercel)
• Container orchestration and microservices
• Monitoring, logging, and alerting systems
• Infrastructure as Code (IaC)
• Security and compliance automation

Technical Expertise

CI/CD Pipeline Stack

• Version Control: Git, GitHub Actions, GitLab CI
• Build Tools: Docker, Buildpack, Nx
• Testing: Jest, Playwright, Cypress
• Deployment: Vercel, AWS ECS, Kubernetes
• Artifact Management: GitHub Packages, AWS ECR
• Secret Management: GitHub Secrets, AWS Secrets Manager, Vault

Infrastructure Tools

• IaC: Terraform, CloudFormation, Pulumi
• Containers: Docker, Docker Compose, Kubernetes
• Monitoring: Datadog, New Relic, Prometheus/Grafana
• Logging: ELK Stack, CloudWatch, LogDNA
• Cloud Platforms: AWS, GCP, Vercel Edge

CI/CD Best Practices

GitHub Actions Workflow

name: Production Deployment

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  NODE_VERSION: '18'
  PNPM_VERSION: '8'

jobs:
  # Quality checks
  quality:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v2
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Lint
        run: pnpm lint

      - name: Type check
        run: pnpm type-check

      - name: Security audit
        run: pnpm audit --production

  # Test suite
  test:
    runs-on: ubuntu-latest
    needs: quality
    strategy:
      matrix:
        shard: [1, 2, 3, 4]
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v2
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Run unit tests
        run: pnpm test:unit -- --shard=${{ matrix.shard }}/4

      - name: Upload coverage
        uses: codecov/codecov-action@v3
        with:
          file: ./coverage/coverage-final.json
          flags: unit-tests-shard-${{ matrix.shard }}

  # E2E tests
  e2e:
    runs-on: ubuntu-latest
    needs: quality
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v2
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Install Playwright
        run: pnpm exec playwright install --with-deps

      - name: Run E2E tests
        run: pnpm test:e2e
        env:
          PLAYWRIGHT_TEST_BASE_URL: ${{ secrets.STAGING_URL }}

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: playwright-results
          path: test-results/

  # Build and deploy
  deploy:
    runs-on: ubuntu-latest
    needs: [test, e2e]
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v2
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build applications
        run: pnpm build
        env:
          NEXT_PUBLIC_SUPABASE_URL: ${{ secrets.SUPABASE_URL }}
          NEXT_PUBLIC_SUPABASE_ANON_KEY: ${{ secrets.SUPABASE_ANON_KEY }}

      - name: Deploy to Vercel
        uses: amondnet/vercel-action@v25
        with:
          vercel-token: ${{ secrets.VERCEL_TOKEN }}
          vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}
          vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }}
          vercel-args: '--prod'

      - name: Lighthouse CI
        uses: treosh/lighthouse-ci-action@v10
        with:
          urls: |
            https://mintenance.com
            https://mintenance.com/dashboard
          uploadToken: ${{ secrets.LHCI_TOKEN }}
          temporaryPublicStorage: true

Docker Configuration

# Multi-stage build for production
FROM node:18-alpine AS deps
RUN apk add --no-cache libc6-compat
WORKDIR /app

# Install pnpm
RUN npm install -g pnpm@8

# Copy package files
COPY package.json pnpm-lock.yaml ./
COPY apps/web/package.json ./apps/web/
COPY apps/mobile/package.json ./apps/mobile/
COPY packages/*/package.json ./packages/*/

# Install dependencies
RUN pnpm install --frozen-lockfile

# Builder stage
FROM node:18-alpine AS builder
WORKDIR /app
RUN npm install -g pnpm@8

COPY --from=deps /app/node_modules ./node_modules
COPY . .

# Build the application
ENV NEXT_TELEMETRY_DISABLED 1
RUN pnpm build

# Runner stage
FROM node:18-alpine AS runner
WORKDIR /app

ENV NODE_ENV production
ENV NEXT_TELEMETRY_DISABLED 1

RUN addgroup --system --gid 1001 nodejs
RUN adduser --system --uid 1001 nextjs

# Copy built application
COPY --from=builder --chown=nextjs:nodejs /app/apps/web/.next/standalone ./
COPY --from=builder --chown=nextjs:nodejs /app/apps/web/.next/static ./apps/web/.next/static
COPY --from=builder --chown=nextjs:nodejs /app/apps/web/public ./apps/web/public

USER nextjs

EXPOSE 3000

ENV PORT 3000

CMD ["node", "apps/web/server.js"]

Infrastructure as Code

Terraform Configuration

# AWS Infrastructure for Mintenance
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }

  backend "s3" {
    bucket = "mintenance-terraform-state"
    key    = "prod/terraform.tfstate"
    region = "eu-west-2"
  }
}

# VPC Configuration
module "vpc" {
  source = "terraform-aws-modules/vpc/aws"

  name = "mintenance-vpc"
  cidr = "10.0.0.0/16"

  azs             = ["eu-west-2a", "eu-west-2b"]
  private_subnets = ["10.0.1.0/24", "10.0.2.0/24"]
  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24"]

  enable_nat_gateway = true
  enable_vpn_gateway = true
  enable_dns_hostnames = true

  tags = {
    Environment = "production"
    Project     = "mintenance"
  }
}

# ECS Cluster
resource "aws_ecs_cluster" "main" {
  name = "mintenance-cluster"

  setting {
    name  = "containerInsights"
    value = "enabled"
  }
}

# Application Load Balancer
resource "aws_lb" "main" {
  name               = "mintenance-alb"
  internal           = false
  load_balancer_type = "application"
  security_groups    = [aws_security_group.alb.id]
  subnets           = module.vpc.public_subnets

  enable_deletion_protection = true
  enable_http2              = true

  tags = {
    Name = "mintenance-alb"
  }
}

# Auto Scaling
resource "aws_autoscaling_policy" "scale_up" {
  name                   = "mintenance-scale-up"
  scaling_adjustment     = 2
  adjustment_type        = "ChangeInCapacity"
  cooldown              = 300
  autoscaling_group_name = aws_autoscaling_group.main.name
}

resource "aws_cloudwatch_metric_alarm" "cpu_high" {
  alarm_name          = "mintenance-cpu-high"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = "2"
  metric_name        = "CPUUtilization"
  namespace          = "AWS/ECS"
  period             = "300"
  statistic          = "Average"
  threshold          = "75"
  alarm_description  = "This metric monitors CPU utilization"
  alarm_actions      = [aws_autoscaling_policy.scale_up.arn]
}

Monitoring & Observability

Datadog Configuration

// datadog.config.ts
import { datadogRum } from '@datadog/browser-rum';
import { datadogLogs } from '@datadog/browser-logs';

// Initialize RUM
datadogRum.init({
  applicationId: process.env.NEXT_PUBLIC_DD_APPLICATION_ID!,
  clientToken: process.env.NEXT_PUBLIC_DD_CLIENT_TOKEN!,
  site: 'datadoghq.eu',
  service: 'mintenance-web',
  env: process.env.NODE_ENV,
  version: process.env.NEXT_PUBLIC_APP_VERSION,
  sessionSampleRate: 100,
  sessionReplaySampleRate: 20,
  trackUserInteractions: true,
  trackResources: true,
  trackLongTasks: true,
  defaultPrivacyLevel: 'mask-user-input'
});

// Initialize Logs
datadogLogs.init({
  clientToken: process.env.NEXT_PUBLIC_DD_CLIENT_TOKEN!,
  site: 'datadoghq.eu',
  forwardErrorsToLogs: true,
  sessionSampleRate: 100
});

// Custom metrics
export const trackMetric = (name: string, value: number, tags?: string[]) => {
  datadogRum.addAction(name, {
    value,
    tags
  });
};

// Performance monitoring
export const trackPerformance = () => {
  const perfData = performance.getEntriesByType('navigation')[0] as PerformanceNavigationTiming;

  trackMetric('page.load.time', perfData.loadEventEnd - perfData.fetchStart);
  trackMetric('page.dom.ready', perfData.domContentLoadedEventEnd - perfData.fetchStart);
  trackMetric('page.ttfb', perfData.responseStart - perfData.fetchStart);
};

Alert Configuration

# alerts.yaml
groups:
  - name: mintenance-alerts
    interval: 30s
    rules:
      - alert: HighErrorRate
        expr: rate(http_requests_total{status=~"5.."}[5m]) > 0.05
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: High error rate detected
          description: "Error rate is {{ $value }} errors per second"

      - alert: HighResponseTime
        expr: histogram_quantile(0.95, http_request_duration_seconds) > 1
        for: 10m
        labels:
          severity: warning
        annotations:
          summary: High response time
          description: "95th percentile response time is {{ $value }} seconds"

      - alert: PodMemoryUsage
        expr: container_memory_usage_bytes / container_spec_memory_limit_bytes > 0.9
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: High memory usage
          description: "Pod {{ $labels.pod }} memory usage is above 90%"

Deployment Strategies

Blue-Green Deployment

#!/bin/bash
# blue-green-deploy.sh

set -e

# Configuration
APP_NAME="mintenance"
BLUE_ENV="${APP_NAME}-blue"
GREEN_ENV="${APP_NAME}-green"

# Determine current active environment
CURRENT=$(aws elbv2 describe-target-health \
  --target-group-arn $TARGET_GROUP_ARN \
  --query 'TargetHealthDescriptions[0].Target.Id' \
  --output text)

if [[ $CURRENT == *"blue"* ]]; then
  NEW_ENV=$GREEN_ENV
  OLD_ENV=$BLUE_ENV
else
  NEW_ENV=$BLUE_ENV
  OLD_ENV=$GREEN_ENV
fi

echo "Deploying to $NEW_ENV..."

# Deploy new version
aws ecs update-service \
  --cluster $CLUSTER_NAME \
  --service $NEW_ENV \
  --force-new-deployment

# Wait for deployment
aws ecs wait services-stable \
  --cluster $CLUSTER_NAME \
  --services $NEW_ENV

# Run smoke tests
npm run test:smoke -- --url=https://$NEW_ENV.mintenance.com

# Switch traffic
aws elbv2 modify-listener \
  --listener-arn $LISTENER_ARN \
  --default-actions Type=forward,TargetGroupArn=$NEW_TARGET_GROUP_ARN

echo "Deployment complete. Traffic switched to $NEW_ENV"

# Keep old environment for rollback
echo "Previous version available at $OLD_ENV for rollback"

Rollback Strategy

// rollback.ts
interface DeploymentHistory {
  version: string;
  timestamp: Date;
  commit: string;
  status: 'success' | 'failed' | 'rolled_back';
}

export class RollbackManager {
  async rollback(toVersion?: string) {
    const history = await this.getDeploymentHistory();
    const target = toVersion || this.getLastSuccessful(history);

    console.log(`Rolling back to version ${target.version}`);

    // Revert database migrations
    await this.revertMigrations(target.timestamp);

    // Deploy previous version
    await this.deployVersion(target.commit);

    // Verify deployment
    const health = await this.healthCheck();
    if (!health.passed) {
      throw new Error('Rollback health check failed');
    }

    // Update deployment history
    await this.updateHistory({
      version: target.version,
      timestamp: new Date(),
      commit: target.commit,
      status: 'rolled_back'
    });

    // Notify team
    await this.notifySlack(`🔄 Rolled back to version ${target.version}`);
  }

  private async healthCheck(): Promise<{ passed: boolean; checks: any[] }> {
    const checks = await Promise.all([
      fetch('/health').then(r => r.ok),
      fetch('/api/health').then(r => r.ok),
      this.checkDatabase(),
      this.checkRedis(),
      this.checkExternalServices()
    ]);

    return {
      passed: checks.every(Boolean),
      checks
    };
  }
}

Security & Compliance

Security Scanning

# security-scan.yml
name: Security Scan

on:
  schedule:
    - cron: '0 0 * * *'  # Daily
  pull_request:
    branches: [main]

jobs:
  dependency-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run Snyk to check for vulnerabilities
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

      - name: OWASP Dependency Check
        uses: dependency-check/Dependency-Check_Action@main
        with:
          project: 'mintenance'
          path: '.'
          format: 'HTML'

      - name: Upload results
        uses: actions/upload-artifact@v3
        with:
          name: dependency-check-report
          path: reports/

  container-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Run Trivy scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'mintenance:latest'
          format: 'sarif'
          output: 'trivy-results.sarif'

      - name: Upload Trivy results to GitHub Security
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'

  code-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v2
        with:
          languages: javascript, typescript

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v2

Performance Optimization

CDN Configuration

# nginx.conf for CDN edge
server {
    listen 443 ssl http2;
    server_name cdn.mintenance.com;

    # SSL configuration
    ssl_certificate /etc/ssl/certs/mintenance.crt;
    ssl_certificate_key /etc/ssl/private/mintenance.key;

    # Security headers
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options DENY;
    add_header X-XSS-Protection "1; mode=block";
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # Caching
    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        add_header Vary Accept-Encoding;

        # Brotli compression
        brotli on;
        brotli_types text/plain text/css application/javascript application/json;
        brotli_comp_level 6;
    }

    # Image optimization
    location ~ ^/images/(.*)$ {
        set $width -;
        set $height -;

        if ($arg_w) {
            set $width $arg_w;
        }
        if ($arg_h) {
            set $height $arg_h;
        }

        proxy_pass http://imaginary:9000/resize?width=$width&height=$height&url=$1;
        proxy_cache images;
        proxy_cache_valid 200 30d;
        proxy_cache_valid 404 1m;
    }
}

Disaster Recovery

Backup Strategy

#!/bin/bash
# backup.sh

# Database backup
pg_dump $DATABASE_URL | gzip > backup-$(date +%Y%m%d-%H%M%S).sql.gz
aws s3 cp backup-*.sql.gz s3://mintenance-backups/postgres/

# Application state backup
aws s3 sync ./uploads s3://mintenance-backups/uploads/

# Redis snapshot
redis-cli --rdb /tmp/redis-backup.rdb
aws s3 cp /tmp/redis-backup.rdb s3://mintenance-backups/redis/

# Verify backups
aws s3 ls s3://mintenance-backups/ --recursive --summarize

# Clean old backups (keep last 30 days)
aws s3 rm s3://mintenance-backups/ \
  --recursive \
  --exclude "*" \
  --include "*.sql.gz" \
  --include "*.rdb" \
  --older-than 30

Project-Specific Configurations

• Vercel deployment for web application
• Expo EAS for mobile builds
• Supabase for database and real-time
• GitHub Actions for CI/CD
• Datadog for monitoring
• CloudFlare for CDN and DDoS protection