# Ghaymah Cloud Technical Assessment Complete implementation of the five Ghaymah cloud assessment tasks: deployment, monitoring, incident analysis, CI/CD, scalability, and the `mithal.space` monitoring dashboard. ## Submission entry point This public GitPasha repository is the assessment submission: **** An evaluator can review all five answers, source code, deployment evidence, and screenshots directly from this repository. Relative links below are intentionally used so navigation works inside GitPasha. Q3 specifically requires GitHub Actions and a GitHub `production` Environment. GitHub is therefore retained as the public CI execution and evidence backend: - Source/CI mirror: - Successful protected workflow: - The successful run contains three passing jobs: build and push, staging verification, and production verification. - The `production` Environment requires reviewer `yassinelagamy`. ## Submission readiness | Check | Result | |---|---| | Required questions | Q1–Q5 implemented and linked below | | Unresolved markers | Clean: no assessment placeholders or verification comments | | Container builds | Q1 and Q5 rebuilt successfully from the submitted source | | Runtime checks | Q1 API/health/metrics and Q5 dashboard/collector passed isolated container tests | | Deployment check | Q1 `/health` and Q5 `/index.html` returned HTTP 200 at **2026-07-26 22:47:06 UTC** | | CI/CD | Protected GitHub Actions run completed successfully | | Evidence | Eight curated screenshots plus the recorded health response | ## Deliverables | Question | Deliverable | Status | |---|---|---| | Q1 — Deploy and monitor an API | [Application, monitor, dashboard, and deployment guide](q1-deploy-monitor/README.md) | HTTP 200 verified 2026-07-26 22:47:06 UTC | | Q2 — OOMKilled postmortem | [Professional blameless postmortem](q2-postmortem/POSTMORTEM.md) | Complete | | Q3 — CI/CD pipeline | [Workflow](.github/workflows/deploy.yml) and [documentation](q3-cicd/CICD.md) | Complete | | Q4 — Scalability | [Architecture, capacity calculation, cold starts, and storage](q4-scalability/SCALABILITY.md) | Complete | | Q5 — `mithal.space` monitoring | [Collector and dashboard](q5-mithal-dashboard/) | HTTP 200 verified 2026-07-26 22:47:06 UTC | ## Service endpoints Both application endpoints returned HTTP 200 in a fresh check at **2026-07-26 22:47:06 UTC**: - Q1 API: - Q1 health: - Q1 OpenAPI: - Q5 dashboard: - Docker Hub API image: `docker.io/agamy74/ghaymah-api` - Docker Hub dashboard image: `docker.io/agamy74/mithal-monitor` - Submission repository: - Public source/CI mirror: - Successful protected deployment run: ## Deployment evidence The curated evidence set is documented in [docs/evidence/README.md](docs/evidence/README.md). | Evidence | Screenshot | |---|---| | Ghaymah project and applications | [Project](docs/evidence/screenshots/01-ghaymah-project.png) | | Q1 API service | [Q1 service](docs/evidence/screenshots/02-q1-service.png) | | Q1 health response recorded 2026-07-26 18:48:19 UTC | [Q1 health](docs/evidence/screenshots/03-q1-health.png) | | Q1 monitoring dashboard | [Q1 dashboard](docs/evidence/screenshots/04-q1-dashboard.png) | | Q5 Ghaymah service | [Q5 service](docs/evidence/screenshots/05-q5-service.png) | | Q5 monitoring dashboard | [Q5 dashboard](docs/evidence/screenshots/06-q5-dashboard.png) | | GitHub production protection | [Approval protection](docs/evidence/screenshots/07-production-approval.png) | | Successful CI/CD run | [Pipeline](docs/evidence/screenshots/08-pipeline-success.png) | ## CI/CD behavior The workflow: 1. Builds `q1-deploy-monitor/app`. 2. Embeds the Git commit as `RELEASE_SHA`. 3. Pushes immutable SHA and `latest` tags to Docker Hub. 4. Starts the immutable image in an ephemeral staging container. 5. Requires `status=ok` and the expected SHA from `/health`. 6. Pauses for the required reviewer on the GitHub `production` Environment. 7. Verifies that the deployed Ghaymah application serves the approved SHA. Ghaymah CLI `0.0.24` documents interactive email/password login but does not publish API-token authentication or the external-image field for `gy resource app update`. Production image promotion therefore uses the authenticated dashboard and is followed by automated release verification. The workflow does not report a stale or unverified deployment as successful. The account's five-resource free-plan limit prevents a third persistent Ghaymah application, so staging runs as an isolated ephemeral container on the Actions runner. Production and the Q5 dashboard both returned HTTP 200 at 2026-07-26 22:47:06 UTC. ## Free-tier hibernation policy Both applications run on the Ghaymah free tier. They may be put into **Hibernate** in the Ghaymah dashboard when the assessment is not being reviewed to conserve container credits; hibernated public URLs return HTTP 503. Before submission or review, open each application and select **Wake Up**, then verify both public endpoints and record the UTC check time. Hibernation preserves the deployment configuration but stops the Q5 in-container collector. ## Verified platform information - The authenticated deployment form accepts a Git repository or container image, registry pull secret, instance size, application name, port, public access, custom domain, environment variables, and storage volumes. - Docker Hub is available through External Integrations. - The authenticated volume form displays a range from 50 MiB to 10 GiB. - The official CLI installs with `curl -sSL https://cli.ghaymah.systems/install.sh | bash`. - CLI `0.0.24` exposes `gy version`, `gy auth login`, `gy resource app init`, `gy resource app launch`, logs, and a generic `gy resource app update`. Official references: - [Ghaymah CLI documentation](https://ghaymah.systems/docs) - [Ghaymah CLI overview](https://ghaymah.systems/cli) - [Ghaymah products](https://ghaymah.systems/products) ## Local checks ```bash docker build --build-arg RELEASE_SHA=local \ -t ghaymah-api:local q1-deploy-monitor/app docker run --rm -p 8080:8080 ghaymah-api:local curl -f http://localhost:8080/health ``` ```bash APP_URL=https://ghaymah-api-615e99f13665.hosted.ghaymah.systems \ python q1-deploy-monitor/monitor/monitor.py --once ``` ```bash python q5-mithal-dashboard/collector/collect.py --once ``` No credentials are stored in the repository. Docker Hub credentials remain in GitHub Secrets and Ghaymah registry authentication remains in the platform integration.