엔터프라이즈 배포

// 마이크로서비스 구조
/*
┌─────────────────────────────────────────┐
│          API Gateway (Kong/NGINX)        │
└─────────────────────────────────────────┘
                    │
        ┌───────────┼───────────┐
        │           │           │
    ┌───▼───┐  ┌───▼───┐  ┌───▼────┐
    │ Auth  │  │ Asset │  │ Process│
    │Service│  │Service│  │Service │
    └───────┘  └───────┘  └────────┘
        │           │           │
    ┌───▼───────────▼───────────▼───┐
    │    Message Queue (RabbitMQ)   │
    └───────────────────────────────┘
                    │
        ┌───────────┼───────────┐
        │           │           │
    ┌───▼────┐ ┌───▼────┐ ┌───▼────┐
    │Finger  │ │Water   │ │Deepfake│
    │print   │ │mark    │ │Detector│
    │Service │ │Service │ │Service │
    └────────┘ └────────┘ └────────┘
*/

// Docker Compose 구성
version: '3.8'

services:
  # API Gateway
  gateway:
    image: kong:latest
    ports:
      - "8000:8000"
      - "8443:8443"
      - "8001:8001"
    environment:
      KONG_DATABASE: postgres
      KONG_PG_HOST: postgres
      KONG_PG_DATABASE: kong
    depends_on:
      - postgres

  # 자산 관리 서비스
  asset-service:
    build: ./services/asset
    environment:
      - DATABASE_URL=postgresql://user:pass@postgres/assets
      - REDIS_URL=redis://redis:6379
      - S3_BUCKET=content-auth-assets
    depends_on:
      - postgres
      - redis

  # 지문 생성 서비스
  fingerprint-service:
    build: ./services/fingerprint
    deploy:
      replicas: 3  // 자동 스케일링
    environment:
      - QUEUE_URL=amqp://rabbitmq
    depends_on:
      - rabbitmq

  # 워터마크 서비스
  watermark-service:
    build: ./services/watermark
    deploy:
      replicas: 2
    environment:
      - QUEUE_URL=amqp://rabbitmq
    depends_on:
      - rabbitmq

  # 딥페이크 탐지 서비스
  deepfake-service:
    build: ./services/deepfake
    deploy:
      replicas: 2
    environment:
      - MODEL_PATH=/models
      - QUEUE_URL=amqp://rabbitmq
    volumes:
      - ./models:/models
    depends_on:
      - rabbitmq

  # PostgreSQL
  postgres:
    image: postgres:15
    environment:
      POSTGRES_DB: content_auth
      POSTGRES_USER: admin
      POSTGRES_PASSWORD: secure_password
    volumes:
      - postgres_data:/var/lib/postgresql/data

  # Redis (캐싱)
  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"

  # RabbitMQ (메시지 큐)
  rabbitmq:
    image: rabbitmq:3-management
    ports:
      - "5672:5672"
      - "15672:15672"
    environment:
      RABBITMQ_DEFAULT_USER: admin
      RABBITMQ_DEFAULT_PASS: admin

  # Prometheus (모니터링)
  prometheus:
    image: prom/prometheus
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml
    ports:
      - "9090:9090"

  # Grafana (대시보드)
  grafana:
    image: grafana/grafana
    ports:
      - "3000:3000"
    environment:
      GF_SECURITY_ADMIN_PASSWORD: admin

volumes:
  postgres_data:

# Kubernetes 배포 매니페스트
# fingerprint-service-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: fingerprint-service
  labels:
    app: fingerprint
spec:
  replicas: 3
  selector:
    matchLabels:
      app: fingerprint
  template:
    metadata:
      labels:
        app: fingerprint
    spec:
      containers:
      - name: fingerprint
        image: wia/fingerprint-service:1.0
        ports:
        - containerPort: 3000
        env:
        - name: NODE_ENV
          value: "production"
        - name: REDIS_URL
          valueFrom:
            secretKeyRef:
              name: redis-secret
              key: url
        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
            cpu: "500m"
        livenessProbe:
          httpGet:
            path: /health
            port: 3000
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /ready
            port: 3000
          initialDelaySeconds: 5
          periodSeconds: 5

---
# Service
apiVersion: v1
kind: Service
metadata:
  name: fingerprint-service
spec:
  selector:
    app: fingerprint
  ports:
  - protocol: TCP
    port: 80
    targetPort: 3000
  type: ClusterIP

---
# Horizontal Pod Autoscaler
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: fingerprint-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: fingerprint-service
  minReplicas: 3
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80

// Redis 캐싱 전략
import { createClient } from 'redis';

class ContentAuthCache {
    private redis: any;

    async connect(): Promise {
        this.redis = createClient({
            url: process.env.REDIS_URL
        });
        await this.redis.connect();
        console.log('✅ Redis 연결 완료');
    }

    // 지문 캐싱
    async cacheFingerprint(
        assetId: string,
        fingerprint: any,
        ttl: number = 3600  // 1시간
    ): Promise {
        const key = `fingerprint:${assetId}`;
        await this.redis.setEx(
            key,
            ttl,
            JSON.stringify(fingerprint)
        );
    }

    // 캐시 조회
    async getFingerprint(assetId: string): Promise {
        const key = `fingerprint:${assetId}`;
        const cached = await this.redis.get(key);

        if (cached) {
            console.log('✅ 캐시 히트');
            return JSON.parse(cached);
        }

        console.log('⚠️ 캐시 미스');
        return null;
    }

    // 캐시 무효화
    async invalidate(pattern: string): Promise {
        const keys = await this.redis.keys(pattern);
        if (keys.length > 0) {
            await this.redis.del(keys);
        }
    }
}

// 사용 예제
const cache = new ContentAuthCache();
await cache.connect();

// 조회 시 캐시 먼저 확인
let fingerprint = await cache.getFingerprint('asset-123');
if (!fingerprint) {
    // 캐시 미스 - 계산 수행
    fingerprint = await computeFingerprint('asset-123');
    await cache.cacheFingerprint('asset-123', fingerprint);
}

// OAuth 2.0 + JWT 인증
import { sign, verify } from 'jsonwebtoken';
import { hash, compare } from 'bcrypt';

class AuthenticationService {
    private jwtSecret: string;

    constructor(jwtSecret: string) {
        this.jwtSecret = jwtSecret;
    }

    // 사용자 인증
    async authenticate(
        username: string,
        password: string
    ): Promise {
        // 데이터베이스에서 사용자 조회
        const user = await this.getUserByUsername(username);
        if (!user) {
            return null;
        }

        // 비밀번호 검증
        const valid = await compare(password, user.passwordHash);
        if (!valid) {
            return null;
        }

        // JWT 토큰 생성
        const token = sign(
            {
                userId: user.id,
                username: user.username,
                roles: user.roles
            },
            this.jwtSecret,
            {
                expiresIn: '1h',
                issuer: 'WIA-AI-017'
            }
        );

        return token;
    }

    // 토큰 검증
    async verifyToken(token: string): Promise {
        try {
            const decoded = verify(token, this.jwtSecret);
            return decoded;
        } catch (error) {
            return null;
        }
    }

    // 역할 기반 접근 제어 (RBAC)
    hasPermission(
        userRoles: string[],
        requiredPermission: string
    ): boolean {
        const permissions: Record = {
            'admin': ['read', 'write', 'delete', 'admin'],
            'editor': ['read', 'write'],
            'viewer': ['read']
        };

        for (const role of userRoles) {
            if (permissions[role]?.includes(requiredPermission)) {
                return true;
            }
        }

        return false;
    }

    private async getUserByUsername(username: string): Promise {
        // 데이터베이스 조회 (구현 생략)
        return {
            id: '123',
            username,
            passwordHash: 'hashed_password',
            roles: ['editor']
        };
    }
}

// Express 미들웨어
import { Request, Response, NextFunction } from 'express';

function authMiddleware(requiredPermission: string) {
    return async (req: Request, res: Response, next: NextFunction) => {
        // Authorization 헤더에서 토큰 추출
        const authHeader = req.headers.authorization;
        if (!authHeader?.startsWith('Bearer ')) {
            return res.status(401).json({ error: '인증 필요' });
        }

        const token = authHeader.substring(7);
        const auth = new AuthenticationService(process.env.JWT_SECRET!);

        // 토큰 검증
        const decoded = await auth.verifyToken(token);
        if (!decoded) {
            return res.status(401).json({ error: '유효하지 않은 토큰' });
        }

        // 권한 확인
        if (!auth.hasPermission(decoded.roles, requiredPermission)) {
            return res.status(403).json({ error: '권한 없음' });
        }

        // 요청 객체에 사용자 정보 추가
        (req as any).user = decoded;
        next();
    };
}

// 사용 예제
import express from 'express';
const app = express();

app.post('/api/assets',
    authMiddleware('write'),
    async (req, res) => {
        // 자산 생성 로직
        res.json({ success: true });
    }
);

// Prometheus 메트릭 수집
import { Counter, Histogram, Registry } from 'prom-client';

class MetricsCollector {
    private registry: Registry;
    private httpRequestCounter: Counter;
    private httpRequestDuration: Histogram;
    private fingerprintCounter: Counter;

    constructor() {
        this.registry = new Registry();

        // HTTP 요청 카운터
        this.httpRequestCounter = new Counter({
            name: 'http_requests_total',
            help: '총 HTTP 요청 수',
            labelNames: ['method', 'route', 'status'],
            registers: [this.registry]
        });

        // HTTP 요청 지속 시간
        this.httpRequestDuration = new Histogram({
            name: 'http_request_duration_seconds',
            help: 'HTTP 요청 지속 시간',
            labelNames: ['method', 'route'],
            buckets: [0.01, 0.05, 0.1, 0.5, 1, 2, 5],
            registers: [this.registry]
        });

        // 지문 생성 카운터
        this.fingerprintCounter = new Counter({
            name: 'fingerprints_generated_total',
            help: '생성된 지문 수',
            labelNames: ['algorithm', 'status'],
            registers: [this.registry]
        });
    }

    // HTTP 요청 기록
    recordRequest(
        method: string,
        route: string,
        status: number,
        duration: number
    ): void {
        this.httpRequestCounter.inc({
            method,
            route,
            status: status.toString()
        });

        this.httpRequestDuration.observe(
            { method, route },
            duration
        );
    }

    // 지문 생성 기록
    recordFingerprint(
        algorithm: string,
        success: boolean
    ): void {
        this.fingerprintCounter.inc({
            algorithm,
            status: success ? 'success' : 'failure'
        });
    }

    // 메트릭 노출
    async getMetrics(): Promise {
        return await this.registry.metrics();
    }
}

// 구조화된 로깅 (Winston)
import winston from 'winston';

const logger = winston.createLogger({
    level: 'info',
    format: winston.format.combine(
        winston.format.timestamp(),
        winston.format.errors({ stack: true }),
        winston.format.json()
    ),
    defaultMeta: { service: 'content-auth' },
    transports: [
        // 파일에 에러 로그
        new winston.transports.File({
            filename: 'logs/error.log',
            level: 'error'
        }),
        // 파일에 모든 로그
        new winston.transports.File({
            filename: 'logs/combined.log'
        })
    ]
});

// 개발 환경에서는 콘솔에도 출력
if (process.env.NODE_ENV !== 'production') {
    logger.add(new winston.transports.Console({
        format: winston.format.simple()
    }));
}

// 사용 예제
logger.info('지문 생성 시작', {
    assetId: 'asset-123',
    algorithm: 'pHash'
});

logger.error('지문 생성 실패', {
    assetId: 'asset-123',
    error: error.message,
    stack: error.stack
});

# GitHub Actions 워크플로우
# .github/workflows/deploy.yml
name: CI/CD Pipeline

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  test:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v3

    - name: Node.js 설정
      uses: actions/setup-node@v3
      with:
        node-version: '18'
        cache: 'npm'

    - name: 의존성 설치
      run: npm ci

    - name: 린트 실행
      run: npm run lint

    - name: 단위 테스트
      run: npm run test:unit

    - name: 통합 테스트
      run: npm run test:integration

    - name: 코드 커버리지
      run: npm run test:coverage

    - name: 커버리지 업로드
      uses: codecov/codecov-action@v3

  build:
    needs: test
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v3

    - name: Docker 로그인
      uses: docker/login-action@v2
      with:
        username: ${{ secrets.DOCKER_USERNAME }}
        password: ${{ secrets.DOCKER_PASSWORD }}

    - name: Docker 이미지 빌드 및 푸시
      run: |
        docker build -t wia/content-auth:${{ github.sha }} .
        docker tag wia/content-auth:${{ github.sha }} wia/content-auth:latest
        docker push wia/content-auth:${{ github.sha }}
        docker push wia/content-auth:latest

  deploy:
    needs: build
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'

    steps:
    - uses: actions/checkout@v3

    - name: Kubernetes 구성
      uses: azure/k8s-set-context@v3
      with:
        kubeconfig: ${{ secrets.KUBE_CONFIG }}

    - name: Kubernetes 배포
      run: |
        kubectl set image deployment/content-auth \
          content-auth=wia/content-auth:${{ github.sha }}

        kubectl rollout status deployment/content-auth

    - name: 헬스 체크
      run: |
        kubectl wait --for=condition=available --timeout=300s \
          deployment/content-auth

// 자동 백업 시스템
import { S3Client, PutObjectCommand } from '@aws-sdk/client-s3';
import { createGzip } from 'zlib';
import { createReadStream, createWriteStream } from 'fs';
import { pipeline } from 'stream/promises';

class BackupService {
    private s3: S3Client;

    constructor() {
        this.s3 = new S3Client({
            region: process.env.AWS_REGION
        });
    }

    // 데이터베이스 백업
    async backupDatabase(): Promise {
        const timestamp = new Date().toISOString();
        const filename = `backup-${timestamp}.sql.gz`;

        // PostgreSQL 덤프
        const { spawn } = await import('child_process');
        const pg_dump = spawn('pg_dump', [
            '-h', process.env.DB_HOST!,
            '-U', process.env.DB_USER!,
            '-d', process.env.DB_NAME!,
            '-F', 'c'  // 커스텀 형식
        ]);

        // Gzip 압축
        const gzip = createGzip();
        const output = createWriteStream(`/tmp/${filename}`);

        await pipeline(
            pg_dump.stdout,
            gzip,
            output
        );

        // S3에 업로드
        const fileStream = createReadStream(`/tmp/${filename}`);

        await this.s3.send(new PutObjectCommand({
            Bucket: 'content-auth-backups',
            Key: `database/${filename}`,
            Body: fileStream
        }));

        console.log(`✅ 백업 완료: ${filename}`);
    }

    // 자동 백업 스케줄
    scheduleBackups(): void {
        // 매일 오전 2시에 백업
        const cron = require('node-cron');

        cron.schedule('0 2 * * *', async () => {
            console.log('⏰ 자동 백업 시작');
            try {
                await this.backupDatabase();
            } catch (error) {
                console.error('❌ 백업 실패:', error);
                // 알림 전송 (이메일, Slack 등)
            }
        });
    }
}

// 포인트-인-타임 복구 (PITR)
class PointInTimeRecovery {
    async restore(
        targetTimestamp: string
    ): Promise {
        // 1. 가장 가까운 전체 백업 찾기
        // 2. WAL (Write-Ahead Log) 파일 적용
        // 3. 목표 시점까지 리플레이

        console.log(`🔄 ${targetTimestamp}로 복구 중...`);
    }
}

// 감사 로깅 시스템
class AuditLogger {
    async logAction(
        action: {
            userId: string;
            action: string;
            resourceType: string;
            resourceId: string;
            changes?: any;
            ipAddress: string;
            userAgent: string;
        }
    ): Promise {
        // 데이터베이스에 감사 로그 저장
        const auditEntry = {
            ...action,
            timestamp: new Date().toISOString(),
            success: true
        };

        await this.saveToDatabase(auditEntry);

        // 중요 작업은 별도 알림
        if (this.isCriticalAction(action.action)) {
            await this.notifyAdmins(auditEntry);
        }
    }

    private isCriticalAction(action: string): boolean {
        const criticalActions = [
            'delete_asset',
            'modify_permissions',
            'export_data'
        ];
        return criticalActions.includes(action);
    }

    private async saveToDatabase(entry: any): Promise {
        // PostgreSQL에 저장
        // (구현 생략)
    }

    private async notifyAdmins(entry: any): Promise {
        // Slack, 이메일 등으로 알림
        // (구현 생략)
    }
}