---
# System prepended metadata

title: Oula 20201222

---

# Oula 20201222

github actions
  - for `staging`
    - run the `make ...up-ecs site=stage` command in an ubuntu container
    - only testing via healthcheck (rollback automatic if healthcheck fails)
  - for `main`
    - use tag that refelcts datestamp
    - ensure `RAILS_ENV=[production]` is set
    - add a template `step` in the `job` that does nothing ... so @sabrina can add whatever command/unit/integration tests she desires
    - for testing... add the parameter that allows continue on error
    - add badge to readme for both `staging` and `main` deployment status

Resources for Production
- RDS
- Redis/Elasticache
- IAM role for GitHub actions
- AWS secrets (prefixed with `production`)

## Sabrina

 - set up subdomain for my.oulahealth.com <-- sabrina action item. https://github.com/oula-health/infrastructure/blob/main/route53-stage.oulahealth.com.tf

 - we need to be able to create a release
        1. First step is to create staging GitHub action to autodeploy on merge
        2. Replicate that for production
        3. Enhance staging GitHub auto deploy to run some checks and fail if they do not pass
 - encryption applied where applicable **** and passes prowler implementation saying we are HIPAA compliant ******
 - implement hippa privacy rules by implementing https://aws.amazon.com/macie/ 
 - drift detection - to maintain compliance measures taken, terraform is run (we already have terraform monitoring and logging changes to infrastructure)
 - 3. Discuss implications of me adding
    1. https://github.com/oula-health/oula/blob/sabrina/athena-integration-prt-2/docker-compose.ecs.yaml#L18
    2. https://github.com/oula-health/oula/blob/sabrina/athena-integration-prt-2/docker-workers-command.sh
    3. Identified this is not possible because there is no cron. Need to look into how to run cron jobs.

## Camilo Research

@sabrina needs to be able to run jobs on a schedule. containers have no cron, as she was expecting.

Immediate options

- cloudwatch event... on `time`, run task in existing cluster
- github action on cron even
    - inject a task
- run your own cron in a container :negative_squared_cross_mark: 
- write own cron :negative_squared_cross_mark: 

## Production requirements (must haves)

"must have" is defined as items needed for practical deployment and troubleshooting of the environment

#### week 0

- centralised logging
    - otherwise impractical to search for failures
    - TIME 2d
- some level of compliance checking
    - prowler
        - 2h
- DNS my.oulahealth.com
    - setup time with @sabrina
        - 1h

#### week 1

- GitHub action - ECS scheduled task
    - NOTE: compose-cli [isn't going to do this](https://github.com/docker/compose-cli/search?q=scheduled&type=issues) ... they're expressing that `x-aws-` extended attributes are getting out of hand and only beneficial to aws users (violating "no code")
    - reference for solution: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/scheduled_tasks.html <-- simply need to codify in terraform or aws cli, if simple enough and add to an action
    - 1d (one dedicated shift will take care of this)
        - GHAction IAM user
            - pull a secret
            - other things ###
        - [reference]()
- Dedicated VPC
    - plus resources (copy/paste of existing)
        - .5d
- Compliance check failure remediation
    - depends on faults found

#### week 2

- any holes or issue that rise up from the prior week
