Bounty Submission: Universal One-Click Deployment (Docker + K8s + Tilt) for FinMind

[CelebrityPunks]

Summary

Complete production-grade deployment system for FinMind covering 12+ platforms with Docker as the base packaging standard, full Kubernetes/Helm support, and Tilt for local K8s development.

What's Included

Docker (production-ready)

• Multi-stage Dockerfiles for backend and frontend with non-root users, tini init, health checks
• Production docker-compose.prod.yml with resource limits, health checks, restart policies, and nginx reverse proxy
• Rate limiting, security headers, TLS-ready configuration

Kubernetes (full Helm chart)

• deploy/helm/finmind/ — parameterized Helm chart with values.yaml
• Deployments for backend, frontend, PostgreSQL, Redis with startup/liveness/readiness probes
• Ingress with TLS via cert-manager, HPA autoscaling (2-8 backend pods, 2-6 frontend)
• PodDisruptionBudgets for zero-downtime rolling deployments
• PersistentVolumeClaims, ConfigMaps, Secrets, ServiceAccount
• Security contexts with least-privilege (non-root, read-only where possible, dropped capabilities)

Tilt (local K8s dev)

• deploy/tilt/Tiltfile with live-reload for Python backend and Vite HMR for frontend
• Resource grouping, port forwarding, dependency ordering

Platform Configs

• Railway (railway.toml / railway.json)
• Render (render.yaml blueprint with auto-provisioned DB/Redis)
• Fly.io (fly.toml for backend + frontend)
• Heroku (Procfile)
• DigitalOcean App Platform (.do/app.yaml)
• AWS ECS Fargate (task definition) + App Runner
• GCP Cloud Run (Knative service with Secret Manager refs)
• Azure Container Apps (containerapp.yaml)
• Netlify (netlify.toml — frontend)
• Vercel (vercel.json — frontend)

Scripts

• deploy/scripts/deploy.sh — unified CLI: ./deploy.sh --platform <name>
• deploy/scripts/setup-local.sh — local dev setup (Docker/Tilt/bare-metal)

Documentation

• deploy/DEPLOYMENT.md — architecture diagram, per-platform step-by-step instructions, env var reference, troubleshooting

Quality Highlights

• No secrets hardcoded — all via env vars, Kubernetes Secrets, or cloud secret managers
• Real health check endpoints (/health from Flask, /nginx-health from frontend nginx)
• Resource limits tuned for production workloads
• Zero-downtime deploys via rolling updates + PDBs
• Security headers on all HTTP responses
• Every file thoroughly commented

Test Plan

• docker compose -f deploy/docker/docker-compose.prod.yml up -d --build starts all services
• curl localhost/health returns {"status":"ok"}
• curl localhost/ serves the React SPA
• helm template finmind deploy/helm/finmind --set secrets.POSTGRES_PASSWORD=test --set secrets.JWT_SECRET=test renders valid K8s YAML
• cd deploy/tilt && tilt up starts all services in local K8s
• Auth flows (register/login) work end-to-end
• Expenses, bills, reminders, dashboard, and insights modules are accessible

Closes #144