Auto-Healing Infrastructure & CI/CD
Sentinel
Flask app plus Docker monitor on Compose locally and on EC2. GitHub Actions runs flake8, Terraform, and Ansible deploy with S3 remote state.
0
touch deployments
0%
health-checked services
Goal
Sentinel runs a small Flask service on port 5000 with routes /, /health, and /crash. A sidecar monitor container watches /health and restarts the app container through the Docker API when checks fail.
The same stack runs locally via docker compose up and on AWS EC2 after Terraform plus Ansible. GitHub Actions automates lint, image build, infrastructure apply, and playbook run on push to main.
Local Docker Compose
docker-compose.yml builds app/ and monitor/ images. The app listens on host port 5000. curl http://localhost:5000/crash simulates failure; docker logs -f sentinel-monitor shows detection and restart.
This path validates monitor logic before any AWS spend.
Monitor service
monitor/ implements HTTP polling against APP_URL, treats non-success responses as unhealthy, and calls the Docker SDK to restart the container named CONTAINER_NAME.
CHECK_INTERVAL defaults to 5 seconds in the Compose file. The monitor mounts the Docker socket read-only in production patterns; local Compose grants socket access for restart.
AWS infrastructure
infra/ Terraform creates Ubuntu 22.04 EC2 (t2.micro default), security group allowing SSH 22 and app 5000, and key pair from ~/.ssh/sentinel_key.pub.
Region default ap-south-1. Remote backend uses bucket sentinel-tf-state-prashant-12345 (create bucket and sentinel-state-lock DynamoDB table before init). README documents aws s3api and dynamodb create-table commands.
GitHub Actions
.github/workflows/ci.yml on push and pull_request: Python 3.9, flake8 on app/ and monitor/ with --select=E9,F63,F7,F82, docker compose build.
.github/workflows/deploy.yml on push to main: configure SSH from SSH_PRIVATE_KEY secret, terraform apply, terraform output -raw server_public_ip, generate Ansible inventory, ansible-playbook ansible/setup.yml.
Secrets and CI fixes
Required secrets: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, SSH_PRIVATE_KEY. Deploy writes the private key to ~/.ssh/sentinel_key and derives the public key with ssh-keygen -y.
Challenges documented in README: hashicorp/setup-terraform output masking blocked passing the EC2 IP to Ansible until terraform_wrapper was set to false. Local state was migrated to S3 plus DynamoDB lock so CI and laptop share one state file.