Condo Consult · 2024 · Production
CI/CD & Security Pipeline
Turning a manual, review-after-the-fact delivery process into a pipeline where quality and security are enforced gates, across an internal platform of more than ten containerised services.
Context
An internal platform of more than ten services handling data that needed encryption at rest and access control per role. Delivery relied on manual steps and security review happened after the fact, so problems were found late and fixed under pressure.
Architecture
Decisions & trade-offs
SAST as a blocking merge gate
chosen over Scheduled scans reported to a backlog
A scan that produces a report produces a backlog. A scan that blocks a merge produces a fix. Moving the check into the required-checks set turned security from a periodic audit into a property of the pipeline, at the cost of some pull requests taking longer to land.
AES-256-GCM at the application layer
chosen over Database-level or disk-level encryption only
Disk encryption protects against a stolen disk, not against an over-broad query or a leaked backup. Encrypting sensitive fields in the application keeps them unreadable in dumps, logs and replicas. GCM was chosen over CBC for authenticated encryption — tampering fails loudly instead of decrypting into garbage.
Role-based access control at a single boundary
chosen over Per-endpoint permission checks scattered across handlers
Permission logic spread across handlers drifts, and every new endpoint is another chance to forget a check. One enforcement boundary makes the policy auditable and turns 'who can do what' into a question with a single answer.
CI/CD & operations
- GitHub Actions runs lint, type checks, tests and SAST on every pull request — all four are required checks, not advisory ones.
- A failing security scan blocks the merge. Findings are triaged in the pull request rather than deferred to a backlog.
- Docker Compose orchestrates 10+ services locally from the same image definitions used in delivery, so 'works on my machine' and 'works in CI' converge.
- Self-hosted workloads run on Proxmox, with the deployment path scripted rather than performed by hand.
Results
Services orchestrated
10+
Security posture
SAST gating on every PR
Encryption at rest
AES-256-GCM
Access control
RBAC at one boundary