@hivehub/rulebook 5.5.2 → 5.7.0

package/templates/services/KUBERNETES.md

@@ -1,208 +0,0 @@
-<!-- KUBERNETES:START -->
-# Kubernetes Instructions
-
-**CRITICAL**: Follow these Kubernetes best practices for all cluster deployments.
-
-## Resource Requirements
-
-ALL Deployments MUST define resource requests and limits:
-```yaml
-resources:
-  requests:
-    memory: "128Mi"
-    cpu: "100m"
-  limits:
-    memory: "512Mi"
-    cpu: "500m"
-```
-
-Omitting resource limits causes unbounded resource consumption and can destabilize the cluster.
-
-## Health Probes
-
-ALL Deployments MUST define both readiness and liveness probes:
-```yaml
-readinessProbe:
-  httpGet:
-    path: /health
-    port: 3000
-  initialDelaySeconds: 5
-  periodSeconds: 10
-  failureThreshold: 3
-livenessProbe:
-  httpGet:
-    path: /health
-    port: 3000
-  initialDelaySeconds: 15
-  periodSeconds: 20
-  failureThreshold: 3
-```
-
-### Probe Guidelines
-- **readinessProbe**: Gates traffic to the pod. Use a lightweight endpoint
-- **livenessProbe**: Restarts the pod if unhealthy. Set `initialDelaySeconds` high enough for startup
-- Consider a **startupProbe** for slow-starting applications
-
-## Security Context
-
-ALL Pods MUST define a security context:
-```yaml
-securityContext:
-  runAsNonRoot: true
-  runAsUser: 1000
-  runAsGroup: 1000
-  fsGroup: 1000
-  allowPrivilegeEscalation: false
-  readOnlyRootFilesystem: true
-  capabilities:
-    drop:
-      - ALL
-```
-
-### Pod Security Standards
-- Apply `restricted` Pod Security Standard where possible
-- Never run containers as root
-- Drop all Linux capabilities unless explicitly required
-
-## Namespace
-
-- Use explicit namespaces for all resources (never use `default`)
-- Apply least-privilege RBAC per namespace
-- Use `ResourceQuota` and `LimitRange` per namespace
-
-```yaml
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: my-app
-  labels:
-    pod-security.kubernetes.io/enforce: restricted
-```
-
-## Secrets Management
-
-- NEVER put secrets in YAML files committed to git
-- Use Kubernetes Secrets or external secret managers:
-  - HashiCorp Vault
-  - AWS Secrets Manager / SSM Parameter Store
-  - Azure Key Vault
-  - Google Secret Manager
-- Use `ExternalSecret` CRD or `sealed-secrets` for GitOps workflows
-
-```yaml
-apiVersion: v1
-kind: Secret
-metadata:
-  name: app-secrets
-  namespace: my-app
-type: Opaque
-stringData:
-  DATABASE_URL: "postgresql://user:pass@host:5432/db"
-```
-
-## Deployment Pattern
-
-```yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: my-app
-  namespace: my-app
-  labels:
-    app: my-app
-spec:
-  replicas: 3
-  selector:
-    matchLabels:
-      app: my-app
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
-  template:
-    metadata:
-      labels:
-        app: my-app
-    spec:
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 1000
-      containers:
-        - name: my-app
-          image: my-registry/my-app:1.0.0
-          ports:
-            - containerPort: 3000
-          env:
-            - name: NODE_ENV
-              value: "production"
-          envFrom:
-            - secretRef:
-                name: app-secrets
-          resources:
-            requests:
-              memory: "128Mi"
-              cpu: "100m"
-            limits:
-              memory: "512Mi"
-              cpu: "500m"
-          readinessProbe:
-            httpGet:
-              path: /health
-              port: 3000
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          livenessProbe:
-            httpGet:
-              path: /health
-              port: 3000
-            initialDelaySeconds: 15
-            periodSeconds: 20
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop: ["ALL"]
-```
-
-## Service Pattern
-
-```yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: my-app
-  namespace: my-app
-spec:
-  selector:
-    app: my-app
-  ports:
-    - port: 80
-      targetPort: 3000
-      protocol: TCP
-  type: ClusterIP
-```
-
-## Labels and Annotations
-
-Apply consistent labels to all resources:
-```yaml
-metadata:
-  labels:
-    app.kubernetes.io/name: my-app
-    app.kubernetes.io/version: "1.0.0"
-    app.kubernetes.io/component: backend
-    app.kubernetes.io/managed-by: helm
-```
-
-## Best Practices
-
-- Use `RollingUpdate` strategy with `maxUnavailable: 0` for zero-downtime deploys
-- Set `PodDisruptionBudget` for high-availability workloads
-- Use `HorizontalPodAutoscaler` for auto-scaling
-- Pin container image tags (never use `latest`)
-- Use `NetworkPolicy` to restrict pod-to-pod communication
-- Store configuration in `ConfigMap`, secrets in `Secret`
-- Use `topologySpreadConstraints` for multi-zone distribution
-
-<!-- KUBERNETES:END -->

package/templates/services/MARIADB.md

@@ -1,183 +0,0 @@
-<!-- MARIADB:START -->
-# MariaDB Database Instructions
-
-**CRITICAL**: Use MariaDB for MySQL-compatible relational database with enhanced features, performance improvements, and open-source licensing.
-
-## Core Features
-
-### Connection
-```typescript
-// Using mysql2 (compatible with MySQL)
-import mysql from 'mysql2/promise'
-
-const pool = mysql.createPool({
-  host: process.env.DB_HOST || 'localhost',
-  port: parseInt(process.env.DB_PORT || '3306'),
-  database: process.env.DB_NAME || 'myapp',
-  user: process.env.DB_USER,
-  password: process.env.DB_PASSWORD,
-  waitForConnections: true,
-  connectionLimit: 10,
-  queueLimit: 0,
-  enableKeepAlive: true,
-  keepAliveInitialDelay: 0,
-})
-
-// Using Prisma
-import { PrismaClient } from '@prisma/client'
-const prisma = new PrismaClient()
-```
-
-### Basic Queries
-```typescript
-// SELECT
-const [rows] = await pool.execute('SELECT * FROM users WHERE id = ?', [userId])
-const users = rows as User[]
-
-// INSERT
-const [result] = await pool.execute(
-  'INSERT INTO users (name, email) VALUES (?, ?)',
-  ['John Doe', 'john@example.com']
-)
-const insertId = (result as any).insertId
-
-// UPDATE
-const [result] = await pool.execute(
-  'UPDATE users SET name = ? WHERE id = ?',
-  ['Jane Doe', userId]
-)
-
-// DELETE
-await pool.execute('DELETE FROM users WHERE id = ?', [userId])
-```
-
-### Advanced Features
-```typescript
-// JSON operations (MariaDB 10.2.7+)
-const [rows] = await pool.execute(
-  "SELECT * FROM products WHERE JSON_EXTRACT(metadata, '$.category') = ?",
-  ['electronics']
-)
-
-// Window functions (MariaDB 10.2+)
-const [rows] = await pool.execute(`
-  SELECT 
-    name,
-    salary,
-    ROW_NUMBER() OVER (PARTITION BY department ORDER BY salary DESC) as rank
-  FROM employees
-`)
-
-// Common Table Expressions (CTE) (MariaDB 10.2+)
-const [rows] = await pool.execute(`
-  WITH RECURSIVE cte AS (
-    SELECT id, name, parent_id FROM categories WHERE parent_id IS NULL
-    UNION ALL
-    SELECT c.id, c.name, c.parent_id FROM categories c
-    INNER JOIN cte ON c.parent_id = cte.id
-  )
-  SELECT * FROM cte
-`)
-
-// Sequences (MariaDB 10.3+)
-await pool.execute('CREATE SEQUENCE user_id_seq START WITH 1 INCREMENT BY 1')
-const [result] = await pool.execute('SELECT NEXT VALUE FOR user_id_seq')
-```
-
-## Common Patterns
-
-### Connection Pooling
-```typescript
-let pool: mysql.Pool | null = null
-
-export function getPool(): mysql.Pool {
-  if (!pool) {
-    pool = mysql.createPool({
-      // ... config
-    })
-  }
-  return pool
-}
-
-// Graceful shutdown
-process.on('SIGINT', async () => {
-  if (pool) {
-    await pool.end()
-  }
-  process.exit(0)
-})
-```
-
-### Error Handling
-```typescript
-try {
-  const [rows] = await pool.execute('SELECT * FROM users WHERE id = ?', [userId])
-  if ((rows as any[]).length === 0) {
-    throw new Error('User not found')
-  }
-  return rows[0]
-} catch (error: any) {
-  if (error.code === 'ER_DUP_ENTRY') {
-    throw new Error('Duplicate entry')
-  }
-  throw error
-}
-```
-
-## Best Practices
-
-✅ **DO:**
-- Use connection pooling (10-20 connections)
-- Always use parameterized queries (?)
-- Use transactions for multi-step operations
-- Create indexes on frequently queried columns
-- Use InnoDB engine (ACID compliance)
-- Set appropriate charset (utf8mb4)
-- Monitor slow query log
-- Use prepared statements
-
-❌ **DON'T:**
-- Use string concatenation for queries
-- Create too many connections
-- Skip error handling
-- Use MyISAM engine
-- Hardcode connection strings
-- Ignore query performance
-
-## Configuration
-
-### Environment Variables
-```bash
-DB_HOST=localhost
-DB_PORT=3306
-DB_NAME=myapp
-DB_USER=myuser
-DB_PASSWORD=securepassword
-```
-
-### Docker Compose
-```yaml
-services:
-  mariadb:
-    image: mariadb:11
-    environment:
-      MYSQL_DATABASE: myapp
-      MYSQL_USER: myuser
-      MYSQL_PASSWORD: securepassword
-      MYSQL_ROOT_PASSWORD: rootpassword
-    ports:
-      - "3306:3306"
-    volumes:
-      - mariadb_data:/var/lib/mysql
-    healthcheck:
-      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-
-volumes:
-  mariadb_data:
-```
-
-<!-- MARIADB:END -->
-

package/templates/services/MEMCACHED.md

@@ -1,242 +0,0 @@
-<!-- MEMCACHED:START -->
-# Memcached Cache Instructions
-
-**CRITICAL**: Use Memcached for simple, high-performance distributed caching with minimal overhead.
-
-## Core Features
-
-### Connection
-```typescript
-// Using memcached (Node.js)
-import Memcached from 'memcached'
-
-const memcached = new Memcached(process.env.MEMCACHED_SERVERS || 'localhost:11211', {
-  maxKeySize: 250,
-  maxExpiration: 2592000, // 30 days
-  maxValue: 1048576, // 1MB
-  poolSize: 10,
-  reconnect: true,
-  timeout: 5000,
-  retries: 3,
-  retry: 1000,
-  remove: true,
-  idle: 5000,
-})
-```
-
-### Basic Operations
-```typescript
-// Set
-memcached.set('user:1', { name: 'John', email: 'john@example.com' }, 3600, (err) => {
-  // Expires in 1 hour
-})
-
-// Get
-memcached.get('user:1', (err, data) => {
-  console.log(data)
-})
-
-// Delete
-memcached.del('user:1', (err) => {
-  // Deleted
-})
-
-// Replace (only if key exists)
-memcached.replace('user:1', newData, 3600, (err) => {
-  // Replaced
-})
-
-// Add (only if key doesn't exist)
-memcached.add('user:1', data, 3600, (err) => {
-  // Added
-})
-```
-
-### Advanced Operations
-```typescript
-// Multiple gets
-memcached.getMulti(['user:1', 'user:2', 'user:3'], (err, data) => {
-  // Returns object with keys as properties
-})
-
-// Increment/Decrement
-memcached.incr('counter', 1, (err, value) => {
-  // Incremented
-})
-
-memcached.decr('counter', 1, (err, value) => {
-  // Decremented
-})
-
-// Touch (update expiration)
-memcached.touch('user:1', 7200, (err) => {
-  // Expiration updated to 2 hours
-})
-
-// Stats
-memcached.stats((err, stats) => {
-  console.log(stats)
-})
-```
-
-## Common Patterns
-
-### Caching with Promises
-```typescript
-function getCached(key: string): Promise<any> {
-  return new Promise((resolve, reject) => {
-    memcached.get(key, (err, data) => {
-      if (err) reject(err)
-      else resolve(data)
-    })
-  })
-}
-
-function setCached(key: string, value: any, ttl: number): Promise<void> {
-  return new Promise((resolve, reject) => {
-    memcached.set(key, value, ttl, (err) => {
-      if (err) reject(err)
-      else resolve()
-    })
-  })
-}
-
-// Usage
-async function getCachedUser(userId: string) {
-  const cached = await getCached(`user:${userId}`)
-  if (cached) {
-    return cached
-  }
-  
-  const user = await fetchUserFromDatabase(userId)
-  await setCached(`user:${userId}`, user, 3600)
-  return user
-}
-```
-
-### Cache-Aside Pattern
-```typescript
-async function getWithCache(key: string, fetchFn: () => Promise<any>, ttl: number) {
-  try {
-    const cached = await getCached(key)
-    if (cached) {
-      return cached
-    }
-  } catch (err) {
-    // Cache miss or error, continue to fetch
-  }
-  
-  const data = await fetchFn()
-  try {
-    await setCached(key, data, ttl)
-  } catch (err) {
-    // Cache set failed, but we have the data
-  }
-  
-  return data
-}
-```
-
-### Rate Limiting
-```typescript
-async function checkRateLimit(identifier: string, limit: number, window: number): Promise<boolean> {
-  const key = `ratelimit:${identifier}`
-  
-  return new Promise((resolve) => {
-    memcached.incr(key, 1, (err, value) => {
-      if (err || value === false) {
-        // Key doesn't exist, create it
-        memcached.set(key, 1, window, () => {
-          resolve(true)
-        })
-      } else if (value > limit) {
-        resolve(false)
-      } else {
-        if (value === 1) {
-          // First increment, set expiration
-          memcached.touch(key, window, () => {})
-        }
-        resolve(true)
-      }
-    })
-  })
-}
-```
-
-## Best Practices
-
-✅ **DO:**
-- Use connection pooling
-- Set appropriate TTL for cached data
-- Handle cache misses gracefully
-- Use consistent key naming conventions
-- Monitor cache hit rates
-- Use multiple servers for redundancy
-- Compress large values before storing
-- Implement cache warming strategies
-- Use appropriate data serialization
-- Monitor memory usage
-
-❌ **DON'T:**
-- Store large values (> 1MB, use external storage)
-- Use Memcached as primary database
-- Store sensitive data without encryption
-- Skip error handling
-- Ignore connection failures
-- Hardcode server addresses
-- Use blocking operations
-- Store complex nested objects (flatten when possible)
-- Ignore eviction policies
-- Skip monitoring
-
-## Configuration
-
-### Environment Variables
-```bash
-MEMCACHED_SERVERS=localhost:11211
-MEMCACHED_SERVERS=server1:11211,server2:11211,server3:11211
-```
-
-### Docker Compose
-```yaml
-services:
-  memcached:
-    image: memcached:1.6-alpine
-    ports:
-      - "11211:11211"
-    command: ["-m", "64", "-I", "1m"]  # 64MB memory, 1MB max item size
-    healthcheck:
-      test: ["CMD", "nc", "-z", "localhost", "11211"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-```
-
-## Integration with Development
-
-### Testing
-```typescript
-// Use test Memcached instance
-const testMemcached = new Memcached('localhost:11212') // Different port
-
-// Clean up after tests
-afterEach((done) => {
-  testMemcached.flush((err) => {
-    done()
-  })
-})
-```
-
-### Health Checks
-```typescript
-function checkMemcachedHealth(): Promise<boolean> {
-  return new Promise((resolve) => {
-    memcached.stats((err) => {
-      resolve(!err)
-    })
-  })
-}
-```
-
-<!-- MEMCACHED:END -->
-