Add deployment files

VigilCareRecordsAPI/Dockerfile

@@ -0,0 +1,58 @@
+# Build context MUST be the repo root:
+#   docker build -f VigilCareRecordsAPI/Dockerfile -t vigilcare-records-api .
+# Single-project solution today, but keeping the repo-root context matches the
+# CI/CD guide's convention and avoids a context change if a shared library is
+# ever extracted alongside VigilCareRecordsAPI.Tests.
+
+FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
+WORKDIR /src
+
+# Restore first with only the project file so the NuGet layer caches
+# independently of source changes.
+COPY VigilCareRecordsAPI/VigilCareRecordsAPI.csproj VigilCareRecordsAPI/
+RUN dotnet restore VigilCareRecordsAPI/VigilCareRecordsAPI.csproj
+
+COPY VigilCareRecordsAPI/ VigilCareRecordsAPI/
+RUN dotnet publish VigilCareRecordsAPI/VigilCareRecordsAPI.csproj \
+      -c Release -o /app/publish --no-restore
+
+# Dev appsettings.json ships with placeholder secrets (Jwt:Secret, Minio:SecretKey).
+# Blank them so a misconfigured production deploy fails fast instead of running
+# with a known, publicly-committed secret.
+RUN sed -i \
+      -e 's/"Secret": "[^"]*"/"Secret": ""/' \
+      -e 's/"SecretKey": "[^"]*"/"SecretKey": ""/' \
+      /app/publish/appsettings.json
+
+# ---- optional target: EF migration bundle, built and extracted by the CD
+# migrate job (docker build --target migrate + docker cp). Never shipped in the
+# runtime image below. ----
+FROM build AS migrate
+RUN dotnet tool install --global dotnet-ef --version 8.*
+ENV PATH="$PATH:/root/.dotnet/tools"
+RUN dotnet ef migrations bundle \
+      --project VigilCareRecordsAPI/VigilCareRecordsAPI.csproj \
+      --self-contained -r linux-x64 \
+      --output /out/migrate-api
+
+# ---- runtime ----
+FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS runtime
+WORKDIR /app
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends curl \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=build /app/publish .
+
+RUN useradd --uid 1654 --user-group --no-create-home appuser \
+    && chown -R appuser:appuser /app
+USER appuser
+
+ENV ASPNETCORE_URLS=http://+:8080
+EXPOSE 8080
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+    CMD curl -fsS http://localhost:8080/health/live || exit 1
+
+ENTRYPOINT ["dotnet", "VigilCareRecordsAPI.dll"]

VigilCareRecordsAPI/appsettings.Production.json

@@ -0,0 +1,27 @@
+{
+  "Serilog": {
+    "Using": [ "Serilog.Sinks.Console", "Serilog.Sinks.Seq" ],
+    "MinimumLevel": {
+      "Default": "Information",
+      "Override": {
+        "Microsoft.AspNetCore": "Warning",
+        "Microsoft.EntityFrameworkCore.Database.Command": "Warning"
+      }
+    },
+    "WriteTo": [
+      { "Name": "Console" },
+      { "Name": "Seq", "Args": { "serverUrl": "http://localhost:5341" } }
+    ],
+    "Enrich": [ "FromLogContext", "WithMachineName", "WithThreadId" ],
+    "Properties": {
+      "Application": "VigilCareRecordsAPI"
+    }
+  },
+  "Logging": {
+    "LogLevel": {
+      "Default": "Information",
+      "Microsoft.AspNetCore": "Warning",
+      "Microsoft.EntityFrameworkCore.Database.Command": "Warning"
+    }
+  }
+}

VigilCareRecordsAPI/appsettings.Production_example.json

@@ -0,0 +1,57 @@
+{
+    "Serilog": {
+      "Using": [ "Serilog.Sinks.Console", "Serilog.Sinks.Seq" ],
+      "MinimumLevel": {
+        "Default": "Information",
+        "Override": {
+          "Microsoft.AspNetCore": "Warning",
+          "Microsoft.EntityFrameworkCore.Database.Command": "Warning"
+        }
+      },
+      "WriteTo": [
+        { "Name": "Console", "Args": { "formatter": "Serilog.Formatting.Compact.CompactJsonFormatter, Serilog.Formatting.Compact" } },
+        { "Name": "Seq", "Args": { "serverUrl": "http://localhost:5341" } }
+      ],
+      "Enrich": [ "FromLogContext", "WithMachineName", "WithThreadId" ],
+      "Properties": {
+        "Application": "VigilCareClinicalAPI"
+      }
+    },
+    "Logging": {
+      "LogLevel": {
+        "Default": "Information",
+        "Microsoft.AspNetCore": "Warning",
+        "Microsoft.EntityFrameworkCore.Database.Command": "Warning"
+      }
+    },
+    "Kafka": {
+      "ReplicationFactor": 3,
+      "NumPartitions": 6,
+      "SecurityProtocol": "SaslSsl"
+    },
+    "Minio": {
+      "UseSSL": true
+    },
+    "RabbitMq": {
+      "UseSsl": true
+    },
+    "PhiEncryption": {
+      "LogListAccess": true
+    },
+    "Swagger": { "Enabled": false },
+    "Seeding": { "EnableDemoData": false },
+    "Simulation": {
+      // UAT / clinical evaluation: in-app scenario replay is on so testers can
+      // exercise the ward without a terminal. Patients created here are marked
+      // IsSimulated; Reset ward only deletes those rows. Do not enable against a
+      // database that also holds real care data — use a dedicated UAT DB.
+      "Enabled": true,
+      "ScenarioDirectory": "Scenarios/List",
+      "LoopbackBaseUrl": "http://localhost:8080",
+      "RunnerUsername": "simulation.runner",
+      "MaxConcurrentRuns": 8,
+      "MaxSpeed": 600,
+      "RunHistoryLimit": 50
+    }
+  }
+