From 9c2817636780f90735178552aa6fdc06304d48bd Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Tue, 26 May 2026 02:38:58 +0000
Subject: [PATCH 1/9] feat: add deployment & cutover artifacts for Spring Boot
 migration

- Dockerfile: multi-stage build (temurin:21-jdk build, temurin:21-jre-alpine run)
  with non-root user, health check, and layer caching optimization
- .dockerignore: excludes build artifacts, IDE files, docs
- docker-compose.yml: app service with SQL Server dependency
- azure-pipelines.yml: Build & Test, Docker Build & Push,
  Deploy to Staging, Health Check, Deploy to Production stages
- K8s manifests: Deployment (2 replicas, resource limits, health probes),
  Service (ClusterIP 80->8080), Ingress (nginx, TLS),
  ConfigMap, Secret, NetworkPolicy
- CUTOVER.md: pre-cutover checklist, data migration steps,
  canary/DNS cutover procedure, rollback plan, monitoring checklist,
  success criteria

Implements: NM-167, NM-168, NM-169, NM-170
---
 eShopLegacyMVC-SpringBoot/.dockerignore       |  32 +++
 eShopLegacyMVC-SpringBoot/CUTOVER.md          | 192 ++++++++++++++++++
 eShopLegacyMVC-SpringBoot/Dockerfile          |  38 ++++
 eShopLegacyMVC-SpringBoot/azure-pipelines.yml | 159 +++++++++++++++
 eShopLegacyMVC-SpringBoot/docker-compose.yml  |  41 ++++
 eShopLegacyMVC-SpringBoot/k8s/configmap.yml   |  13 ++
 eShopLegacyMVC-SpringBoot/k8s/deployment.yml  |  92 +++++++++
 eShopLegacyMVC-SpringBoot/k8s/ingress.yml     |  28 +++
 .../k8s/networkpolicy.yml                     |  25 +++
 eShopLegacyMVC-SpringBoot/k8s/secret.yml      |  12 ++
 eShopLegacyMVC-SpringBoot/k8s/service.yml     |  17 ++
 11 files changed, 649 insertions(+)
 create mode 100644 eShopLegacyMVC-SpringBoot/.dockerignore
 create mode 100644 eShopLegacyMVC-SpringBoot/CUTOVER.md
 create mode 100644 eShopLegacyMVC-SpringBoot/Dockerfile
 create mode 100644 eShopLegacyMVC-SpringBoot/azure-pipelines.yml
 create mode 100644 eShopLegacyMVC-SpringBoot/docker-compose.yml
 create mode 100644 eShopLegacyMVC-SpringBoot/k8s/configmap.yml
 create mode 100644 eShopLegacyMVC-SpringBoot/k8s/deployment.yml
 create mode 100644 eShopLegacyMVC-SpringBoot/k8s/ingress.yml
 create mode 100644 eShopLegacyMVC-SpringBoot/k8s/networkpolicy.yml
 create mode 100644 eShopLegacyMVC-SpringBoot/k8s/secret.yml
 create mode 100644 eShopLegacyMVC-SpringBoot/k8s/service.yml

diff --git a/eShopLegacyMVC-SpringBoot/.dockerignore b/eShopLegacyMVC-SpringBoot/.dockerignore
new file mode 100644
index 00000000..f3a1d652
--- /dev/null
+++ b/eShopLegacyMVC-SpringBoot/.dockerignore
@@ -0,0 +1,32 @@
+# Build output
+target/
+
+# IDE files
+.idea/
+*.iml
+.vscode/
+*.swp
+*.swo
+
+# Git
+.git/
+.gitignore
+
+# Docker
+Dockerfile
+docker-compose.yml
+.dockerignore
+
+# CI/CD
+azure-pipelines.yml
+
+# Kubernetes
+k8s/
+
+# Documentation
+*.md
+LICENSE
+
+# OS files
+.DS_Store
+Thumbs.db
diff --git a/eShopLegacyMVC-SpringBoot/CUTOVER.md b/eShopLegacyMVC-SpringBoot/CUTOVER.md
new file mode 100644
index 00000000..42c9e84b
--- /dev/null
+++ b/eShopLegacyMVC-SpringBoot/CUTOVER.md
@@ -0,0 +1,192 @@
+# eShop Catalog — Cutover & Rollback Plan
+
+This document describes the procedure for cutting over from the legacy .NET MVC application to the new Spring Boot Java application, and how to roll back if issues arise.
+
+---
+
+## Table of Contents
+
+1. [Pre-Cutover Checklist](#pre-cutover-checklist)
+2. [Data Migration](#data-migration)
+3. [Cutover Procedure](#cutover-procedure)
+4. [Rollback Procedure](#rollback-procedure)
+5. [Post-Cutover Monitoring](#post-cutover-monitoring)
+6. [Success Criteria](#success-criteria)
+
+---
+
+## Pre-Cutover Checklist
+
+- [ ] All CI/CD pipelines pass (build, tests, spotless, JaCoCo coverage)
+- [ ] Docker image built and pushed to container registry
+- [ ] Kubernetes manifests reviewed and applied to staging
+- [ ] Staging environment fully tested (smoke tests, integration tests)
+- [ ] Health endpoints responding: `/actuator/health`, `/actuator/health/readiness`
+- [ ] Prometheus metrics available at `/actuator/prometheus`
+- [ ] Database migration scripts (Flyway) validated against production schema
+- [ ] Secrets (DB credentials) provisioned in Kubernetes and verified
+- [ ] TLS certificates provisioned for the Ingress host
+- [ ] Load testing completed on staging (response times within SLA)
+- [ ] Rollback procedure reviewed and rehearsed
+- [ ] Communication sent to stakeholders with cutover window
+- [ ] On-call team aware of the cutover schedule
+- [ ] Legacy .NET application snapshot/backup taken
+
+---
+
+## Data Migration
+
+### Database Compatibility
+
+The Spring Boot application connects to the same SQL Server database (`CatalogDb`) used by the legacy .NET application. Flyway manages schema migrations.
+
+### Steps
+
+1. **Create a database backup** before any schema changes:
+   ```sql
+   BACKUP DATABASE CatalogDb TO DISK = '/backups/CatalogDb_pre_cutover.bak'
+   ```
+
+2. **Run Flyway migrations** in dry-run mode to preview changes:
+   ```bash
+   ./mvnw flyway:info -Dspring.profiles.active=prod
+   ```
+
+3. **Apply migrations** against the production database:
+   ```bash
+   ./mvnw flyway:migrate -Dspring.profiles.active=prod
+   ```
+
+4. **Verify data integrity** — spot-check row counts and key records:
+   ```sql
+   SELECT COUNT(*) FROM CatalogItems;
+   SELECT COUNT(*) FROM CatalogBrands;
+   SELECT COUNT(*) FROM CatalogTypes;
+   ```
+
+### Compatibility Notes
+
+- Both the .NET and Java applications can read from the same database simultaneously during the transition period.
+- The Java application uses `ddl-auto: validate`, so Hibernate will not alter the schema — only Flyway applies changes.
+
+---
+
+## Cutover Procedure
+
+### Phase 1: Parallel Run (Canary)
+
+1. Deploy the Spring Boot application to production alongside the legacy .NET application.
+2. Route a small percentage of traffic (e.g., 10%) to the new Java service via Ingress weight annotations or a traffic-splitting mechanism:
+   ```yaml
+   nginx.ingress.kubernetes.io/canary: "true"
+   nginx.ingress.kubernetes.io/canary-weight: "10"
+   ```
+3. Monitor error rates, latency, and logs for 30–60 minutes.
+4. Gradually increase the traffic percentage (25% → 50% → 100%) as confidence grows.
+
+### Phase 2: DNS / Load Balancer Switch
+
+1. Once the canary phase is successful (100% traffic on Java), update the DNS or load balancer to point entirely to the new service:
+   ```bash
+   # Update DNS A record or CNAME to point to the new Ingress IP
+   # Example: eshop-catalog.example.com → <new-ingress-external-ip>
+   ```
+2. Set TTL on DNS records to a low value (e.g., 60s) before the cutover to allow fast rollback.
+3. Verify the DNS change has propagated:
+   ```bash
+   dig eshop-catalog.example.com
+   curl -sf https://eshop-catalog.example.com/actuator/health
+   ```
+
+### Phase 3: Decommission Legacy
+
+1. After a soak period (24–48 hours with no issues):
+   - Stop the legacy .NET application containers.
+   - Remove legacy deployment resources.
+   - Archive the legacy application artifacts.
+2. Keep the legacy Docker image and deployment manifests available for at least 30 days in case a late rollback is needed.
+
+---
+
+## Rollback Procedure
+
+### Immediate Rollback (< 5 minutes)
+
+If critical issues are detected during or immediately after cutover:
+
+1. **Revert traffic routing** — remove canary annotations or switch Ingress back:
+   ```bash
+   kubectl apply -f k8s/ingress-legacy.yml
+   ```
+   Or revert DNS to the legacy application's IP/CNAME.
+
+2. **Scale down the Java deployment**:
+   ```bash
+   kubectl scale deployment eshop-catalog --replicas=0
+   ```
+
+3. **Verify** the legacy application is serving traffic:
+   ```bash
+   curl -sf https://eshop-catalog.example.com/
+   ```
+
+### Database Rollback
+
+If Flyway migrations introduced breaking schema changes:
+
+1. Restore the database from the pre-cutover backup:
+   ```sql
+   RESTORE DATABASE CatalogDb FROM DISK = '/backups/CatalogDb_pre_cutover.bak' WITH REPLACE
+   ```
+
+2. Restart the legacy application to reconnect.
+
+### Post-Rollback Actions
+
+- Document the issue that triggered the rollback.
+- Create a fix branch, apply the fix, and re-run the full CI/CD pipeline.
+- Re-test on staging before attempting another cutover.
+- Notify stakeholders of the rollback and revised timeline.
+
+---
+
+## Post-Cutover Monitoring
+
+### Key Metrics to Watch
+
+| Metric                       | Source                         | Threshold               |
+|------------------------------|--------------------------------|--------------------------|
+| HTTP 5xx error rate          | Prometheus / Ingress metrics   | < 0.1%                  |
+| P95 response latency         | Prometheus                     | < 500ms                 |
+| JVM heap usage               | `/actuator/prometheus`         | < 80% of limit          |
+| Database connection pool     | HikariCP metrics               | No pool exhaustion       |
+| Pod restart count            | `kubectl get pods`             | 0 restarts              |
+| Flyway migration status      | `/actuator/flyway`             | All migrations applied   |
+
+### Monitoring Checklist
+
+- [ ] Grafana dashboards configured with Spring Boot and JVM panels
+- [ ] Alerts configured for error rate spikes and high latency
+- [ ] Log aggregation (e.g., Azure Monitor, ELK) collecting application logs
+- [ ] On-call rotation aware of new service and its health endpoints
+- [ ] Periodic health checks verified (`/actuator/health`)
+
+### First 24 Hours
+
+- Check dashboards every 30 minutes for the first 4 hours.
+- Validate end-to-end functionality (catalog browse, search, CRUD operations).
+- Compare response times and error rates against the legacy application baseline.
+
+---
+
+## Success Criteria
+
+The cutover is considered successful when all of the following are met:
+
+1. **Functional parity** — all catalog operations (list, search, create, edit, delete) work identically to the legacy application.
+2. **Performance** — P95 latency is within 10% of the legacy application's baseline.
+3. **Availability** — zero unplanned downtime in the first 48 hours post-cutover.
+4. **Error rate** — HTTP 5xx rate stays below 0.1% for 48 hours.
+5. **Data integrity** — no data loss or corruption; row counts match pre-cutover values.
+6. **Health probes** — liveness and readiness probes pass continuously.
+7. **Stakeholder sign-off** — product owner confirms acceptance after the soak period.
diff --git a/eShopLegacyMVC-SpringBoot/Dockerfile b/eShopLegacyMVC-SpringBoot/Dockerfile
new file mode 100644
index 00000000..55a5ef88
--- /dev/null
+++ b/eShopLegacyMVC-SpringBoot/Dockerfile
@@ -0,0 +1,38 @@
+# ---- Build Stage ----
+FROM eclipse-temurin:21-jdk AS build
+
+WORKDIR /app
+
+# Copy Maven wrapper and POM first for dependency caching
+COPY mvnw mvnw.cmd pom.xml ./
+COPY .mvn .mvn
+
+RUN chmod +x mvnw && \
+    ./mvnw dependency:go-offline -B
+
+# Copy source code
+COPY src src
+
+# Build the application, skipping tests (tests run in CI)
+RUN ./mvnw clean package -DskipTests -B && \
+    mv target/*.jar target/app.jar
+
+# ---- Runtime Stage ----
+FROM eclipse-temurin:21-jre-alpine
+
+RUN addgroup -S appgroup && adduser -S appuser -G appgroup
+
+WORKDIR /app
+
+COPY --from=build /app/target/app.jar app.jar
+
+RUN chown -R appuser:appgroup /app
+
+USER appuser
+
+EXPOSE 8080
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=40s --retries=3 \
+    CMD wget --quiet --tries=1 --spider http://localhost:8080/actuator/health || exit 1
+
+ENTRYPOINT ["java", "-jar", "app.jar"]
diff --git a/eShopLegacyMVC-SpringBoot/azure-pipelines.yml b/eShopLegacyMVC-SpringBoot/azure-pipelines.yml
new file mode 100644
index 00000000..8c4a755b
--- /dev/null
+++ b/eShopLegacyMVC-SpringBoot/azure-pipelines.yml
@@ -0,0 +1,159 @@
+trigger:
+  branches:
+    include:
+      - main
+      - release/*
+
+pr:
+  branches:
+    include:
+      - main
+
+variables:
+  MAVEN_CACHE_FOLDER: $(Pipeline.Workspace)/.m2/repository
+  JAVA_VERSION: '21'
+  SPRING_PROFILES_ACTIVE: 'test'
+  ACR_NAME: '$(acrName)'
+  IMAGE_REPOSITORY: '$(imageRepository)'
+  IMAGE_TAG: '$(Build.BuildId)'
+
+stages:
+  - stage: Build
+    displayName: 'Build & Test'
+    jobs:
+      - job: BuildAndTest
+        pool:
+          vmImage: 'ubuntu-latest'
+        steps:
+          - task: JavaToolInstaller@0
+            inputs:
+              versionSpec: '21'
+              jdkArchitectureOption: 'x64'
+              jdkSourceOption: 'PreInstalled'
+            displayName: 'Set up JDK 21'
+
+          - task: Cache@2
+            inputs:
+              key: 'maven | "$(Agent.OS)" | **/pom.xml'
+              restoreKeys: |
+                maven | "$(Agent.OS)"
+              path: $(MAVEN_CACHE_FOLDER)
+            displayName: 'Cache Maven dependencies'
+
+          - script: |
+              cd eShopLegacyMVC-SpringBoot && \
+              ./mvnw clean verify \
+                -Dmaven.repo.local=$(MAVEN_CACHE_FOLDER) \
+                -Dspring.profiles.active=test
+            displayName: 'Build, test, and verify'
+
+          - script: |
+              cd eShopLegacyMVC-SpringBoot && \
+              ./mvnw spotless:check \
+                -Dmaven.repo.local=$(MAVEN_CACHE_FOLDER)
+            displayName: 'Code format check (Spotless)'
+
+          - task: PublishTestResults@2
+            inputs:
+              testResultsFormat: 'JUnit'
+              testResultsFiles: '**/target/surefire-reports/*.xml'
+              mergeTestResults: true
+            displayName: 'Publish test results'
+            condition: always()
+
+          - task: PublishCodeCoverageResults@2
+            inputs:
+              summaryFileLocation: '**/target/site/jacoco/jacoco.xml'
+            displayName: 'Publish JaCoCo coverage report'
+            condition: always()
+
+  - stage: DockerBuild
+    displayName: 'Docker Build & Push'
+    dependsOn: Build
+    condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
+    jobs:
+      - job: DockerBuildPush
+        pool:
+          vmImage: 'ubuntu-latest'
+        steps:
+          - task: Docker@2
+            inputs:
+              containerRegistry: '$(dockerRegistryServiceConnection)'
+              repository: '$(IMAGE_REPOSITORY)'
+              command: 'buildAndPush'
+              Dockerfile: 'eShopLegacyMVC-SpringBoot/Dockerfile'
+              buildContext: 'eShopLegacyMVC-SpringBoot'
+              tags: |
+                $(IMAGE_TAG)
+                latest
+            displayName: 'Build and push Docker image'
+
+  - stage: DeployStaging
+    displayName: 'Deploy to Staging'
+    dependsOn: DockerBuild
+    condition: succeeded()
+    jobs:
+      - deployment: DeployStaging
+        environment: 'staging'
+        pool:
+          vmImage: 'ubuntu-latest'
+        strategy:
+          runOnce:
+            deploy:
+              steps:
+                - script: |
+                    echo "Deploying $(IMAGE_REPOSITORY):$(IMAGE_TAG) to staging"
+                  displayName: 'Deploy to staging'
+                # Kubernetes deployment:
+                # - task: KubernetesManifest@1
+                #   inputs:
+                #     action: 'deploy'
+                #     connectionType: 'azureResourceManager'
+                #     azureSubscriptionConnection: '$(azureServiceConnection)'
+                #     azureResourceGroup: '$(aksResourceGroup)'
+                #     kubernetesCluster: '$(aksClusterName)'
+                #     namespace: '$(k8sNamespace)'
+                #     manifests: 'eShopLegacyMVC-SpringBoot/k8s/*.yml'
+                #     containers: '$(ACR_NAME).azurecr.io/$(IMAGE_REPOSITORY):$(IMAGE_TAG)'
+
+  - stage: HealthCheck
+    displayName: 'Staging Health Check'
+    dependsOn: DeployStaging
+    condition: succeeded()
+    jobs:
+      - job: VerifyHealth
+        pool:
+          vmImage: 'ubuntu-latest'
+        steps:
+          - script: |
+              echo "Verifying /actuator/health endpoint on staging"
+              # curl -sf https://$(stagingUrl)/actuator/health || exit 1
+            displayName: 'Verify staging health'
+
+  - stage: DeployProduction
+    displayName: 'Deploy to Production'
+    dependsOn: HealthCheck
+    condition: succeeded()
+    jobs:
+      - deployment: DeployProduction
+        environment: 'production'
+        pool:
+          vmImage: 'ubuntu-latest'
+        strategy:
+          runOnce:
+            deploy:
+              steps:
+                - script: |
+                    echo "Deploying $(IMAGE_REPOSITORY):$(IMAGE_TAG) to production"
+                  displayName: 'Deploy to production'
+                # Kubernetes deployment:
+                # - task: KubernetesManifest@1
+                #   inputs:
+                #     action: 'deploy'
+                #     connectionType: 'azureResourceManager'
+                #     azureSubscriptionConnection: '$(azureServiceConnection)'
+                #     azureResourceGroup: '$(aksResourceGroup)'
+                #     kubernetesCluster: '$(aksClusterName)'
+                #     namespace: '$(k8sNamespace)'
+                #     manifests: 'eShopLegacyMVC-SpringBoot/k8s/*.yml'
+                #     containers: '$(ACR_NAME).azurecr.io/$(IMAGE_REPOSITORY):$(IMAGE_TAG)'
diff --git a/eShopLegacyMVC-SpringBoot/docker-compose.yml b/eShopLegacyMVC-SpringBoot/docker-compose.yml
new file mode 100644
index 00000000..4c025dce
--- /dev/null
+++ b/eShopLegacyMVC-SpringBoot/docker-compose.yml
@@ -0,0 +1,41 @@
+services:
+  app:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    ports:
+      - "8080:8080"
+    environment:
+      SPRING_PROFILES_ACTIVE: ${SPRING_PROFILES_ACTIVE:-mock}
+      DB_URL: jdbc:sqlserver://sqlserver:1433;databaseName=CatalogDb;encrypt=true;trustServerCertificate=true
+      DB_USERNAME: ${DB_USERNAME:-sa}
+      DB_PASSWORD: ${DB_PASSWORD:-YourStrong@Passw0rd}
+      USE_MOCK_DATA: ${USE_MOCK_DATA:-true}
+    depends_on:
+      sqlserver:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:8080/actuator/health"]
+      interval: 30s
+      timeout: 3s
+      start_period: 40s
+      retries: 3
+
+  sqlserver:
+    image: mcr.microsoft.com/mssql/server:2022-latest
+    environment:
+      ACCEPT_EULA: "Y"
+      MSSQL_SA_PASSWORD: ${DB_PASSWORD:-YourStrong@Passw0rd}
+    ports:
+      - "1433:1433"
+    volumes:
+      - sqlserver-data:/var/opt/mssql
+    healthcheck:
+      test: /opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P "$$MSSQL_SA_PASSWORD" -C -Q "SELECT 1" -b
+      interval: 10s
+      timeout: 5s
+      start_period: 30s
+      retries: 5
+
+volumes:
+  sqlserver-data:
diff --git a/eShopLegacyMVC-SpringBoot/k8s/configmap.yml b/eShopLegacyMVC-SpringBoot/k8s/configmap.yml
new file mode 100644
index 00000000..365fd64c
--- /dev/null
+++ b/eShopLegacyMVC-SpringBoot/k8s/configmap.yml
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: eshop-catalog-config
+  labels:
+    app.kubernetes.io/name: eshop-catalog
+    app.kubernetes.io/part-of: eshop
+    app.kubernetes.io/managed-by: kubectl
+data:
+  SPRING_PROFILES_ACTIVE: "prod"
+  DB_URL: "jdbc:sqlserver://sqlserver-service:1433;databaseName=CatalogDb;encrypt=true;trustServerCertificate=true"
+  USE_MOCK_DATA: "false"
+  SERVER_PORT: "8080"
diff --git a/eShopLegacyMVC-SpringBoot/k8s/deployment.yml b/eShopLegacyMVC-SpringBoot/k8s/deployment.yml
new file mode 100644
index 00000000..23f6e921
--- /dev/null
+++ b/eShopLegacyMVC-SpringBoot/k8s/deployment.yml
@@ -0,0 +1,92 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: eshop-catalog
+  labels:
+    app.kubernetes.io/name: eshop-catalog
+    app.kubernetes.io/part-of: eshop
+    app.kubernetes.io/managed-by: kubectl
+    platform/environment: production
+    platform/team: migration
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: eshop-catalog
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: eshop-catalog
+        app.kubernetes.io/part-of: eshop
+        platform/environment: production
+        platform/team: migration
+    spec:
+      containers:
+        - name: eshop-catalog
+          image: eshop-catalog:latest
+          ports:
+            - containerPort: 8080
+              protocol: TCP
+          env:
+            - name: SPRING_PROFILES_ACTIVE
+              valueFrom:
+                configMapKeyRef:
+                  name: eshop-catalog-config
+                  key: SPRING_PROFILES_ACTIVE
+            - name: DB_URL
+              valueFrom:
+                configMapKeyRef:
+                  name: eshop-catalog-config
+                  key: DB_URL
+            - name: DB_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: eshop-catalog-secret
+                  key: DB_USERNAME
+            - name: DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: eshop-catalog-secret
+                  key: DB_PASSWORD
+            - name: USE_MOCK_DATA
+              valueFrom:
+                configMapKeyRef:
+                  name: eshop-catalog-config
+                  key: USE_MOCK_DATA
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          livenessProbe:
+            httpGet:
+              path: /actuator/health/liveness
+              port: 8080
+            initialDelaySeconds: 60
+            periodSeconds: 15
+            timeoutSeconds: 3
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /actuator/health/readiness
+              port: 8080
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          startupProbe:
+            httpGet:
+              path: /actuator/health
+              port: 8080
+            initialDelaySeconds: 10
+            periodSeconds: 5
+            failureThreshold: 20
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 30
diff --git a/eShopLegacyMVC-SpringBoot/k8s/ingress.yml b/eShopLegacyMVC-SpringBoot/k8s/ingress.yml
new file mode 100644
index 00000000..2ab86bfb
--- /dev/null
+++ b/eShopLegacyMVC-SpringBoot/k8s/ingress.yml
@@ -0,0 +1,28 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: eshop-catalog
+  labels:
+    app.kubernetes.io/name: eshop-catalog
+    app.kubernetes.io/part-of: eshop
+    app.kubernetes.io/managed-by: kubectl
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: /
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - eshop-catalog.example.com
+      secretName: eshop-catalog-tls
+  rules:
+    - host: eshop-catalog.example.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: eshop-catalog
+                port:
+                  number: 80
diff --git a/eShopLegacyMVC-SpringBoot/k8s/networkpolicy.yml b/eShopLegacyMVC-SpringBoot/k8s/networkpolicy.yml
new file mode 100644
index 00000000..29f24b2b
--- /dev/null
+++ b/eShopLegacyMVC-SpringBoot/k8s/networkpolicy.yml
@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: eshop-catalog
+  labels:
+    app.kubernetes.io/name: eshop-catalog
+    app.kubernetes.io/part-of: eshop
+    app.kubernetes.io/managed-by: kubectl
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: eshop-catalog
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: ingress-nginx
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: monitoring
+      ports:
+        - protocol: TCP
+          port: 8080
diff --git a/eShopLegacyMVC-SpringBoot/k8s/secret.yml b/eShopLegacyMVC-SpringBoot/k8s/secret.yml
new file mode 100644
index 00000000..5ab1284d
--- /dev/null
+++ b/eShopLegacyMVC-SpringBoot/k8s/secret.yml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: eshop-catalog-secret
+  labels:
+    app.kubernetes.io/name: eshop-catalog
+    app.kubernetes.io/part-of: eshop
+    app.kubernetes.io/managed-by: kubectl
+type: Opaque
+stringData:
+  DB_USERNAME: "REPLACE_WITH_ACTUAL_USERNAME"
+  DB_PASSWORD: "REPLACE_WITH_ACTUAL_PASSWORD"
diff --git a/eShopLegacyMVC-SpringBoot/k8s/service.yml b/eShopLegacyMVC-SpringBoot/k8s/service.yml
new file mode 100644
index 00000000..7c17366c
--- /dev/null
+++ b/eShopLegacyMVC-SpringBoot/k8s/service.yml
@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: eshop-catalog
+  labels:
+    app.kubernetes.io/name: eshop-catalog
+    app.kubernetes.io/part-of: eshop
+    app.kubernetes.io/managed-by: kubectl
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 8080
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: eshop-catalog

From 7c6dc8e72b84c8ce900d87d66c5da9b603683b69 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Tue, 26 May 2026 02:43:58 +0000
Subject: [PATCH 2/9] fix: correct table names in CUTOVER.md data integrity
 queries

Use actual schema table names (Catalog, CatalogBrand, CatalogType)
matching V1__create_schema.sql and JPA entity annotations.
---
 eShopLegacyMVC-SpringBoot/CUTOVER.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/eShopLegacyMVC-SpringBoot/CUTOVER.md b/eShopLegacyMVC-SpringBoot/CUTOVER.md
index 42c9e84b..c3cebb1a 100644
--- a/eShopLegacyMVC-SpringBoot/CUTOVER.md
+++ b/eShopLegacyMVC-SpringBoot/CUTOVER.md
@@ -59,9 +59,9 @@ The Spring Boot application connects to the same SQL Server database (`CatalogDb
 
 4. **Verify data integrity** — spot-check row counts and key records:
    ```sql
-   SELECT COUNT(*) FROM CatalogItems;
-   SELECT COUNT(*) FROM CatalogBrands;
-   SELECT COUNT(*) FROM CatalogTypes;
+   SELECT COUNT(*) FROM Catalog;
+   SELECT COUNT(*) FROM CatalogBrand;
+   SELECT COUNT(*) FROM CatalogType;
    ```
 
 ### Compatibility Notes

From 56760eca038f3a101292614d7417acec9b038ce7 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Tue, 26 May 2026 05:48:30 +0000
Subject: [PATCH 3/9] NM-167: Create Dockerfile for Spring Boot application

- Multi-stage Dockerfile: build with eclipse-temurin:21-jdk, runtime with eclipse-temurin:21-jre-alpine
- Build stage runs mvn package -DskipTests with dependency caching
- Runtime stage copies JAR, exposes port 8080, runs as non-root user
- Health check configured with curl against /actuator/health
- Install curl in alpine runtime for health check support
- .dockerignore excludes build output, IDE files, docs, CI/CD configs
---
 eShopLegacyMVC-SpringBoot/.dockerignore | 4 ++++
 eShopLegacyMVC-SpringBoot/Dockerfile    | 9 +++++----
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/eShopLegacyMVC-SpringBoot/.dockerignore b/eShopLegacyMVC-SpringBoot/.dockerignore
index f3a1d652..e10a2c91 100644
--- a/eShopLegacyMVC-SpringBoot/.dockerignore
+++ b/eShopLegacyMVC-SpringBoot/.dockerignore
@@ -19,10 +19,14 @@ docker-compose.yml
 
 # CI/CD
 azure-pipelines.yml
+.github/
 
 # Kubernetes
 k8s/
 
+# Scripts
+scripts/
+
 # Documentation
 *.md
 LICENSE
diff --git a/eShopLegacyMVC-SpringBoot/Dockerfile b/eShopLegacyMVC-SpringBoot/Dockerfile
index 55a5ef88..417c8863 100644
--- a/eShopLegacyMVC-SpringBoot/Dockerfile
+++ b/eShopLegacyMVC-SpringBoot/Dockerfile
@@ -14,13 +14,14 @@ RUN chmod +x mvnw && \
 COPY src src
 
 # Build the application, skipping tests (tests run in CI)
-RUN ./mvnw clean package -DskipTests -B && \
+RUN ./mvnw package -DskipTests -B && \
     mv target/*.jar target/app.jar
 
 # ---- Runtime Stage ----
 FROM eclipse-temurin:21-jre-alpine
 
-RUN addgroup -S appgroup && adduser -S appuser -G appgroup
+RUN apk add --no-cache curl && \
+    addgroup -S appgroup && adduser -S appuser -G appgroup
 
 WORKDIR /app
 
@@ -32,7 +33,7 @@ USER appuser
 
 EXPOSE 8080
 
-HEALTHCHECK --interval=30s --timeout=3s --start-period=40s --retries=3 \
-    CMD wget --quiet --tries=1 --spider http://localhost:8080/actuator/health || exit 1
+HEALTHCHECK --interval=30s --timeout=5s --start-period=40s --retries=3 \
+    CMD curl -f http://localhost:8080/actuator/health || exit 1
 
 ENTRYPOINT ["java", "-jar", "app.jar"]

From aa0ec1ba95ae6c45c773aac7a25b4bd34776185c Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Tue, 26 May 2026 05:49:27 +0000
Subject: [PATCH 4/9] NM-168: Create GitHub Actions CI/CD workflow for Azure VM
 deployment

- Trigger on push to main and migration/complete-java-migration branches
- Build & test job: JDK 21 setup, Maven cache, ./mvnw clean verify, Spotless check
- Test results published via dorny/test-reporter
- Docker build & push job: builds image and pushes to GHCR
- Staging deploy job: SSH into staging VM via appleboy/ssh-action
- Health check job: verifies /actuator/health returns UP on staging
- Production deploy job: SSH-based deployment with GitHub Environment protection
- Required secrets documented: STAGING_VM_HOST, PROD_VM_HOST, VM_USERNAME, VM_SSH_KEY, STAGING_URL, PROD_URL
---
 .github/workflows/deploy.yml | 188 +++++++++++++++++++++++++++++++++++
 1 file changed, 188 insertions(+)
 create mode 100644 .github/workflows/deploy.yml

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 00000000..2860240d
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,188 @@
+name: Build & Deploy to Azure VM
+
+on:
+  push:
+    branches: [main, migration/complete-java-migration]
+  pull_request:
+    branches: [main]
+
+env:
+  JAVA_VERSION: '21'
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}/eshop-catalog
+  WORKING_DIR: eShopLegacyMVC-SpringBoot
+
+jobs:
+  # ──────────────────────────────────────────────
+  # Job 1: Build, Test, and Verify
+  # ──────────────────────────────────────────────
+  build-and-test:
+    name: Build & Test
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ${{ env.WORKING_DIR }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: ${{ env.JAVA_VERSION }}
+          cache: maven
+          cache-dependency-path: ${{ env.WORKING_DIR }}/pom.xml
+
+      - name: Build and run tests
+        run: ./mvnw clean verify -B
+
+      - name: Check code formatting (Spotless)
+        run: ./mvnw spotless:check -B
+
+      - name: Publish test results
+        uses: dorny/test-reporter@v1
+        if: always()
+        with:
+          name: JUnit Test Results
+          path: ${{ env.WORKING_DIR }}/target/surefire-reports/*.xml
+          reporter: java-junit
+
+      - name: Upload JaCoCo coverage report
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: jacoco-report
+          path: ${{ env.WORKING_DIR }}/target/site/jacoco/
+          retention-days: 14
+
+  # ──────────────────────────────────────────────
+  # Job 2: Build Docker Image and Push to GHCR
+  # ──────────────────────────────────────────────
+  docker-build-push:
+    name: Docker Build & Push
+    runs-on: ubuntu-latest
+    needs: build-and-test
+    if: github.event_name == 'push'
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=sha,prefix=
+            type=ref,event=branch
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: ${{ env.WORKING_DIR }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  # ──────────────────────────────────────────────
+  # Job 3: Deploy to Staging (auto-deploy)
+  # ──────────────────────────────────────────────
+  deploy-staging:
+    name: Deploy to Staging
+    runs-on: ubuntu-latest
+    needs: docker-build-push
+    environment: staging
+    steps:
+      - name: Deploy to staging VM via SSH
+        uses: appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.STAGING_VM_HOST }}
+          username: ${{ secrets.VM_USERNAME }}
+          key: ${{ secrets.VM_SSH_KEY }}
+          script: |
+            docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
+            docker stop eshop-catalog || true
+            docker rm eshop-catalog || true
+            docker run -d \
+              --name eshop-catalog \
+              --restart unless-stopped \
+              -p 8080:8080 \
+              --env-file /opt/app/staging.env \
+              ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
+
+  # ──────────────────────────────────────────────
+  # Job 4: Health Check on Staging
+  # ──────────────────────────────────────────────
+  health-check-staging:
+    name: Staging Health Check
+    runs-on: ubuntu-latest
+    needs: deploy-staging
+    steps:
+      - name: Wait for application startup
+        run: sleep 30
+
+      - name: Verify health endpoint
+        run: |
+          for i in $(seq 1 10); do
+            STATUS=$(curl -sf "${{ secrets.STAGING_URL }}/actuator/health" | jq -r '.status') || true
+            if [ "$STATUS" = "UP" ]; then
+              echo "Health check passed: status is UP"
+              exit 0
+            fi
+            echo "Attempt $i: status=$STATUS — retrying in 10s..."
+            sleep 10
+          done
+          echo "Health check failed after 10 attempts"
+          exit 1
+
+  # ──────────────────────────────────────────────
+  # Job 5: Deploy to Production (manual approval)
+  # ──────────────────────────────────────────────
+  deploy-production:
+    name: Deploy to Production
+    runs-on: ubuntu-latest
+    needs: health-check-staging
+    environment:
+      name: production
+      url: ${{ secrets.PROD_URL }}
+    steps:
+      - name: Deploy to production VM via SSH
+        uses: appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.PROD_VM_HOST }}
+          username: ${{ secrets.VM_USERNAME }}
+          key: ${{ secrets.VM_SSH_KEY }}
+          script: |
+            docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
+            docker stop eshop-catalog || true
+            docker rm eshop-catalog || true
+            docker run -d \
+              --name eshop-catalog \
+              --restart unless-stopped \
+              -p 8080:8080 \
+              --env-file /opt/app/production.env \
+              ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
+
+      - name: Verify production health
+        run: |
+          sleep 30
+          for i in $(seq 1 10); do
+            STATUS=$(curl -sf "${{ secrets.PROD_URL }}/actuator/health" | jq -r '.status') || true
+            if [ "$STATUS" = "UP" ]; then
+              echo "Production health check passed: status is UP"
+              exit 0
+            fi
+            echo "Attempt $i: status=$STATUS — retrying in 10s..."
+            sleep 10
+          done
+          echo "Production health check failed after 10 attempts"
+          exit 1

From 049b9622a7faff36ea2e746fbc6ffe880626b7dd Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Tue, 26 May 2026 05:50:32 +0000
Subject: [PATCH 5/9] NM-169: Create Azure VM deployment documentation and
 setup scripts

- DEPLOYMENT.md: full deployment architecture docs (pipeline flow, GitHub
  Environments/Secrets, Azure VM prerequisites, env var config, DNS guidance)
- scripts/setup-vm.sh: idempotent VM setup (Docker install, app dirs, env template)
- docker-compose.yml: updated health check to use curl consistently with Dockerfile
- .dockerignore already updated in NM-167 to exclude scripts/ and .github/
---
 eShopLegacyMVC-SpringBoot/DEPLOYMENT.md       | 221 ++++++++++++++++++
 eShopLegacyMVC-SpringBoot/docker-compose.yml  |   2 +-
 eShopLegacyMVC-SpringBoot/scripts/setup-vm.sh |  88 +++++++
 3 files changed, 310 insertions(+), 1 deletion(-)
 create mode 100644 eShopLegacyMVC-SpringBoot/DEPLOYMENT.md
 create mode 100755 eShopLegacyMVC-SpringBoot/scripts/setup-vm.sh

diff --git a/eShopLegacyMVC-SpringBoot/DEPLOYMENT.md b/eShopLegacyMVC-SpringBoot/DEPLOYMENT.md
new file mode 100644
index 00000000..31e205f4
--- /dev/null
+++ b/eShopLegacyMVC-SpringBoot/DEPLOYMENT.md
@@ -0,0 +1,221 @@
+# eShop Catalog — Deployment Guide
+
+This document describes the deployment architecture and procedures for the Spring Boot eShop Catalog application on Azure VMs using Docker containers.
+
+---
+
+## Table of Contents
+
+1. [Architecture Overview](#architecture-overview)
+2. [Pipeline Flow](#pipeline-flow)
+3. [GitHub Environments and Secrets](#github-environments-and-secrets)
+4. [Azure VM Prerequisites](#azure-vm-prerequisites)
+5. [Environment Variable Configuration](#environment-variable-configuration)
+6. [Local Development with Docker Compose](#local-development-with-docker-compose)
+7. [DNS Configuration](#dns-configuration)
+8. [Monitoring and Health Checks](#monitoring-and-health-checks)
+
+---
+
+## Architecture Overview
+
+```
+┌──────────────┐     ┌──────────────┐     ┌──────────────────────┐
+│  Developer   │────▶│   GitHub     │────▶│  GitHub Container    │
+│  Push/PR     │     │   Actions    │     │  Registry (GHCR)     │
+└──────────────┘     └──────┬───────┘     └──────────┬───────────┘
+                            │                        │
+                    ┌───────▼────────┐       ┌───────▼────────┐
+                    │  Staging VM    │       │ Production VM  │
+                    │  (Docker)      │       │  (Docker)      │
+                    │  Auto-deploy   │       │  Manual gate   │
+                    └───────┬────────┘       └───────┬────────┘
+                            │                        │
+                    ┌───────▼────────┐       ┌───────▼────────┐
+                    │  SQL Server    │       │  SQL Server    │
+                    │  (Staging DB)  │       │ (Production DB)│
+                    └────────────────┘       └────────────────┘
+```
+
+The application is packaged as a Docker image, pushed to GitHub Container Registry (GHCR), and deployed to Azure VMs via SSH using GitHub Actions.
+
+---
+
+## Pipeline Flow
+
+The CI/CD pipeline is defined in `.github/workflows/deploy.yml` and runs on push to `main` or `migration/complete-java-migration`:
+
+| Stage | Description | Trigger |
+|-------|-------------|---------|
+| **Build & Test** | Compiles with JDK 21, runs `./mvnw clean verify`, checks formatting with Spotless, publishes test results via `dorny/test-reporter` | Every push and PR |
+| **Docker Build & Push** | Builds multi-stage Docker image, pushes to GHCR with SHA and branch tags | Push to branch only |
+| **Deploy to Staging** | SSHs into staging VM, pulls new image, stops old container, starts new one | After Docker push |
+| **Health Check** | Polls `/actuator/health` for `{"status":"UP"}` with retry logic | After staging deploy |
+| **Deploy to Production** | Same SSH-based deployment; requires manual approval via GitHub Environment protection rules | After health check passes |
+
+---
+
+## GitHub Environments and Secrets
+
+### Environments
+
+Configure these in **Settings > Environments** in the GitHub repository:
+
+| Environment | Protection Rules |
+|-------------|-----------------|
+| `staging` | Auto-deploy (no approval required) |
+| `production` | Required reviewers (manual approval gate) |
+
+### Required Secrets
+
+Configure these in **Settings > Secrets and variables > Actions**:
+
+| Secret | Description | Example |
+|--------|-------------|---------|
+| `STAGING_VM_HOST` | Staging VM public IP or hostname | `10.0.1.10` |
+| `PROD_VM_HOST` | Production VM public IP or hostname | `10.0.2.10` |
+| `VM_USERNAME` | SSH username for both VMs | `azureuser` |
+| `VM_SSH_KEY` | SSH private key for VM access | PEM-encoded private key |
+| `STAGING_URL` | Staging application base URL | `http://staging.example.com:8080` |
+| `PROD_URL` | Production application base URL | `https://eshop.example.com` |
+
+---
+
+## Azure VM Prerequisites
+
+Each VM (staging and production) must meet the following requirements:
+
+- **OS**: Ubuntu 22.04 LTS
+- **Docker**: Installed and running (see `scripts/setup-vm.sh`)
+- **Network Security Group (NSG)** rules:
+
+| Priority | Direction | Port | Protocol | Source | Purpose |
+|----------|-----------|------|----------|--------|---------|
+| 100 | Inbound | 22 | TCP | GitHub Actions IPs | SSH for deployments |
+| 110 | Inbound | 8080 | TCP | Any (or restricted) | Application HTTP traffic |
+| 120 | Inbound | 443 | TCP | Any | HTTPS (if reverse proxy configured) |
+
+### VM Setup
+
+Run the idempotent setup script on each fresh VM:
+
+```bash
+# Copy and run on the VM
+scp scripts/setup-vm.sh azureuser@<vm-ip>:~/
+ssh azureuser@<vm-ip> 'chmod +x ~/setup-vm.sh && sudo ~/setup-vm.sh'
+```
+
+---
+
+## Environment Variable Configuration
+
+The application reads configuration from environment files on each VM:
+
+### Staging: `/opt/app/staging.env`
+
+```env
+SPRING_PROFILES_ACTIVE=prod
+DB_URL=jdbc:sqlserver://<staging-db-host>:1433;databaseName=CatalogDb;encrypt=true;trustServerCertificate=true
+DB_USERNAME=<staging-db-user>
+DB_PASSWORD=<staging-db-password>
+DB_DRIVER=com.microsoft.sqlserver.jdbc.SQLServerDriver
+USE_MOCK_DATA=false
+```
+
+### Production: `/opt/app/production.env`
+
+```env
+SPRING_PROFILES_ACTIVE=prod
+DB_URL=jdbc:sqlserver://<prod-db-host>:1433;databaseName=CatalogDb;encrypt=true;trustServerCertificate=false
+DB_USERNAME=<prod-db-user>
+DB_PASSWORD=<prod-db-password>
+DB_DRIVER=com.microsoft.sqlserver.jdbc.SQLServerDriver
+USE_MOCK_DATA=false
+```
+
+The setup script (`scripts/setup-vm.sh`) generates a template env file — fill in actual values before the first deployment.
+
+---
+
+## Local Development with Docker Compose
+
+Use `docker-compose.yml` for local development with the application and a SQL Server instance:
+
+```bash
+# Start with mock data (default)
+docker compose up --build
+
+# Start with SQL Server database
+USE_MOCK_DATA=false docker compose up --build
+
+# Stop and clean up
+docker compose down -v
+```
+
+The Compose file starts:
+- **app**: The Spring Boot application on port 8080
+- **sqlserver**: SQL Server 2022 on port 1433
+
+---
+
+## DNS Configuration
+
+For production deployments, configure DNS to point to the VM:
+
+1. **A Record**: Point your domain (e.g., `eshop-catalog.example.com`) to the production VM's public IP.
+2. **TTL**: Set a low TTL (60–300 seconds) before cutover to allow fast rollback via DNS.
+3. **Reverse Proxy** (optional): Use Nginx or Caddy on the VM to terminate TLS and proxy to port 8080.
+
+Example Nginx configuration:
+
+```nginx
+server {
+    listen 443 ssl;
+    server_name eshop-catalog.example.com;
+
+    ssl_certificate /etc/ssl/certs/eshop.crt;
+    ssl_certificate_key /etc/ssl/private/eshop.key;
+
+    location / {
+        proxy_pass http://localhost:8080;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+```
+
+---
+
+## Monitoring and Health Checks
+
+The application exposes Spring Boot Actuator endpoints:
+
+| Endpoint | Purpose |
+|----------|---------|
+| `/actuator/health` | Application health status |
+| `/actuator/info` | Application metadata |
+| `/actuator/metrics` | Micrometer metrics |
+| `/actuator/prometheus` | Prometheus-format metrics export |
+
+### Docker Health Check
+
+The Dockerfile includes a built-in health check:
+
+```dockerfile
+HEALTHCHECK --interval=30s --timeout=5s --start-period=40s --retries=3 \
+    CMD curl -f http://localhost:8080/actuator/health || exit 1
+```
+
+### Prometheus Integration
+
+To scrape metrics, add the VM as a Prometheus target:
+
+```yaml
+scrape_configs:
+  - job_name: 'eshop-catalog'
+    metrics_path: '/actuator/prometheus'
+    static_configs:
+      - targets: ['<vm-ip>:8080']
+```
diff --git a/eShopLegacyMVC-SpringBoot/docker-compose.yml b/eShopLegacyMVC-SpringBoot/docker-compose.yml
index 4c025dce..e9110a48 100644
--- a/eShopLegacyMVC-SpringBoot/docker-compose.yml
+++ b/eShopLegacyMVC-SpringBoot/docker-compose.yml
@@ -15,7 +15,7 @@ services:
       sqlserver:
         condition: service_healthy
     healthcheck:
-      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:8080/actuator/health"]
+      test: ["CMD", "curl", "-f", "http://localhost:8080/actuator/health"]
       interval: 30s
       timeout: 3s
       start_period: 40s
diff --git a/eShopLegacyMVC-SpringBoot/scripts/setup-vm.sh b/eShopLegacyMVC-SpringBoot/scripts/setup-vm.sh
new file mode 100755
index 00000000..bc6cfad8
--- /dev/null
+++ b/eShopLegacyMVC-SpringBoot/scripts/setup-vm.sh
@@ -0,0 +1,88 @@
+#!/bin/bash
+# setup-vm.sh — Idempotent script to prepare a fresh Azure VM for deployments.
+# Run as root: sudo ./setup-vm.sh
+#
+# This script:
+#   1. Installs Docker (if not already installed)
+#   2. Creates application directories
+#   3. Generates an environment file template
+#
+# Tested on Ubuntu 22.04 LTS.
+
+set -euo pipefail
+
+APP_DIR="/opt/app"
+ENV_FILE="$APP_DIR/production.env"
+
+echo "=== eShop Catalog VM Setup ==="
+
+# ── Install Docker ──────────────────────────────────────────────
+if command -v docker &>/dev/null; then
+    echo "[OK] Docker is already installed: $(docker --version)"
+else
+    echo "[*] Installing Docker..."
+    apt-get update -qq
+    apt-get install -y -qq ca-certificates curl gnupg
+
+    install -m 0755 -d /etc/apt/keyrings
+    curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
+        | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+    chmod a+r /etc/apt/keyrings/docker.gpg
+
+    echo \
+        "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
+        https://download.docker.com/linux/ubuntu \
+        $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \
+        | tee /etc/apt/sources.list.d/docker.list > /dev/null
+
+    apt-get update -qq
+    apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-compose-plugin
+
+    systemctl enable docker
+    systemctl start docker
+    echo "[OK] Docker installed: $(docker --version)"
+fi
+
+# Add current sudo user to docker group (if invoked via sudo)
+if [ -n "${SUDO_USER:-}" ]; then
+    if ! groups "$SUDO_USER" | grep -q docker; then
+        usermod -aG docker "$SUDO_USER"
+        echo "[OK] Added $SUDO_USER to docker group (re-login required)"
+    fi
+fi
+
+# ── Create application directories ─────────────────────────────
+mkdir -p "$APP_DIR"
+chmod 755 "$APP_DIR"
+echo "[OK] Application directory: $APP_DIR"
+
+# ── Generate environment file template ──────────────────────────
+if [ ! -f "$ENV_FILE" ]; then
+    cat > "$ENV_FILE" <<'EOF'
+# eShop Catalog — Environment Configuration
+# Fill in actual values before the first deployment.
+
+SPRING_PROFILES_ACTIVE=prod
+
+# Database connection
+DB_URL=jdbc:sqlserver://${DB_HOST}:1433;databaseName=${DB_NAME};encrypt=true;trustServerCertificate=true
+DB_USERNAME=${DB_USER}
+DB_PASSWORD=${DB_PASSWORD}
+DB_DRIVER=com.microsoft.sqlserver.jdbc.SQLServerDriver
+
+# Application settings
+USE_MOCK_DATA=false
+EOF
+    chmod 600 "$ENV_FILE"
+    echo "[OK] Environment template created: $ENV_FILE"
+    echo "     Edit this file with actual database credentials before deploying."
+else
+    echo "[OK] Environment file already exists: $ENV_FILE (not overwritten)"
+fi
+
+echo ""
+echo "=== Setup Complete ==="
+echo "Next steps:"
+echo "  1. Edit $ENV_FILE with actual database credentials"
+echo "  2. Log out and back in for docker group membership to take effect"
+echo "  3. Test with: docker run --rm hello-world"

From 8425bb27045ee0d6c850bb78e7389f49f6f2e101 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Tue, 26 May 2026 05:52:00 +0000
Subject: [PATCH 6/9] NM-170: Document rollback plan and cutover procedure

- Rewrite CUTOVER.md for Azure VM deployment (replaces K8s-focused version)
- Rollback plan: steps to revert to .NET application
- Cutover checklist: DNS switch, database migration verification, smoke tests
- Database rollback strategy: Flyway undo migrations or backup/restore
- Traffic switching: single-VM and blue-green (two VMs) approaches
- Monitoring checklist: Actuator health, Micrometer/Prometheus metrics
- Communication plan: stakeholder notifications before/during/after cutover
- Fix: deploy.yml Docker image tag mismatch (use full SHA for GHCR tags)
---
 .github/workflows/deploy.yml         |   2 +-
 eShopLegacyMVC-SpringBoot/CUTOVER.md | 256 +++++++++++++++++++--------
 2 files changed, 179 insertions(+), 79 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 2860240d..d7bfec83 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -81,7 +81,7 @@ jobs:
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
-            type=sha,prefix=
+            type=raw,value=${{ github.sha }}
             type=ref,event=branch
             type=raw,value=latest,enable={{is_default_branch}}
 
diff --git a/eShopLegacyMVC-SpringBoot/CUTOVER.md b/eShopLegacyMVC-SpringBoot/CUTOVER.md
index c3cebb1a..457d89b7 100644
--- a/eShopLegacyMVC-SpringBoot/CUTOVER.md
+++ b/eShopLegacyMVC-SpringBoot/CUTOVER.md
@@ -1,44 +1,59 @@
 # eShop Catalog — Cutover & Rollback Plan
 
-This document describes the procedure for cutting over from the legacy .NET MVC application to the new Spring Boot Java application, and how to roll back if issues arise.
+This document describes the procedure for cutting over from the legacy .NET MVC application to the new Spring Boot Java application on Azure VMs, and how to roll back if issues arise.
 
 ---
 
 ## Table of Contents
 
 1. [Pre-Cutover Checklist](#pre-cutover-checklist)
-2. [Data Migration](#data-migration)
+2. [Database Migration](#database-migration)
 3. [Cutover Procedure](#cutover-procedure)
-4. [Rollback Procedure](#rollback-procedure)
-5. [Post-Cutover Monitoring](#post-cutover-monitoring)
-6. [Success Criteria](#success-criteria)
+4. [Rollback Plan](#rollback-plan)
+5. [Monitoring Checklist](#monitoring-checklist)
+6. [Communication Plan](#communication-plan)
+7. [Success Criteria](#success-criteria)
 
 ---
 
 ## Pre-Cutover Checklist
 
-- [ ] All CI/CD pipelines pass (build, tests, spotless, JaCoCo coverage)
-- [ ] Docker image built and pushed to container registry
-- [ ] Kubernetes manifests reviewed and applied to staging
-- [ ] Staging environment fully tested (smoke tests, integration tests)
-- [ ] Health endpoints responding: `/actuator/health`, `/actuator/health/readiness`
-- [ ] Prometheus metrics available at `/actuator/prometheus`
-- [ ] Database migration scripts (Flyway) validated against production schema
-- [ ] Secrets (DB credentials) provisioned in Kubernetes and verified
-- [ ] TLS certificates provisioned for the Ingress host
-- [ ] Load testing completed on staging (response times within SLA)
-- [ ] Rollback procedure reviewed and rehearsed
+### CI/CD Pipeline
+
+- [ ] GitHub Actions pipeline passes: build, tests, Spotless formatting, JaCoCo coverage
+- [ ] Docker image built and pushed to GHCR (`ghcr.io`)
+- [ ] Staging deployment completed via GitHub Actions
+- [ ] Health endpoint returns `{"status":"UP"}` on staging
+
+### Infrastructure
+
+- [ ] Production Azure VM provisioned (Ubuntu 22.04, Docker installed via `scripts/setup-vm.sh`)
+- [ ] NSG rules configured: SSH (port 22), HTTP (port 8080)
+- [ ] Environment file populated: `/opt/app/production.env`
+- [ ] SSH key for GitHub Actions stored in repository secrets (`VM_SSH_KEY`)
+- [ ] DNS records prepared with low TTL (60s) for fast rollback
+
+### Application
+
+- [ ] Flyway migrations validated against production database schema
+- [ ] Database backup taken before any schema changes
+- [ ] Smoke tests passed on staging (catalog browse, search, CRUD)
+- [ ] Load testing completed — response times within SLA
+- [ ] Legacy .NET application snapshot/backup taken
+
+### Organizational
+
+- [ ] Rollback procedure reviewed and rehearsed by the team
 - [ ] Communication sent to stakeholders with cutover window
 - [ ] On-call team aware of the cutover schedule
-- [ ] Legacy .NET application snapshot/backup taken
 
 ---
 
-## Data Migration
+## Database Migration
 
-### Database Compatibility
+### Compatibility
 
-The Spring Boot application connects to the same SQL Server database (`CatalogDb`) used by the legacy .NET application. Flyway manages schema migrations.
+Both the .NET and Java applications connect to the same SQL Server database (`CatalogDb`). The Java application uses Flyway for schema migrations and `ddl-auto: validate` — Hibernate will not alter the schema.
 
 ### Steps
 
@@ -47,7 +62,7 @@ The Spring Boot application connects to the same SQL Server database (`CatalogDb
    BACKUP DATABASE CatalogDb TO DISK = '/backups/CatalogDb_pre_cutover.bak'
    ```
 
-2. **Run Flyway migrations** in dry-run mode to preview changes:
+2. **Preview Flyway migrations** in dry-run mode:
    ```bash
    ./mvnw flyway:info -Dspring.profiles.active=prod
    ```
@@ -57,119 +72,168 @@ The Spring Boot application connects to the same SQL Server database (`CatalogDb
    ./mvnw flyway:migrate -Dspring.profiles.active=prod
    ```
 
-4. **Verify data integrity** — spot-check row counts and key records:
+4. **Verify data integrity** — spot-check row counts:
    ```sql
    SELECT COUNT(*) FROM Catalog;
    SELECT COUNT(*) FROM CatalogBrand;
    SELECT COUNT(*) FROM CatalogType;
    ```
 
-### Compatibility Notes
+### Database Rollback Strategy
+
+If Flyway migrations introduced breaking schema changes:
+
+- **Option A — Flyway undo migrations**: If undo migrations (`U1__*.sql`) are available, run:
+  ```bash
+  ./mvnw flyway:undo -Dspring.profiles.active=prod
+  ```
+- **Option B — Backup restore**: Restore from the pre-cutover backup:
+  ```sql
+  RESTORE DATABASE CatalogDb FROM DISK = '/backups/CatalogDb_pre_cutover.bak' WITH REPLACE
+  ```
 
-- Both the .NET and Java applications can read from the same database simultaneously during the transition period.
-- The Java application uses `ddl-auto: validate`, so Hibernate will not alter the schema — only Flyway applies changes.
+Both options require restarting the legacy application afterward.
 
 ---
 
 ## Cutover Procedure
 
-### Phase 1: Parallel Run (Canary)
+### Phase 1: Deploy to Production VM
 
-1. Deploy the Spring Boot application to production alongside the legacy .NET application.
-2. Route a small percentage of traffic (e.g., 10%) to the new Java service via Ingress weight annotations or a traffic-splitting mechanism:
-   ```yaml
-   nginx.ingress.kubernetes.io/canary: "true"
-   nginx.ingress.kubernetes.io/canary-weight: "10"
-   ```
-3. Monitor error rates, latency, and logs for 30–60 minutes.
-4. Gradually increase the traffic percentage (25% → 50% → 100%) as confidence grows.
+1. Trigger the GitHub Actions pipeline by merging to `main` or confirm the production deployment job has the correct image tag.
 
-### Phase 2: DNS / Load Balancer Switch
+2. The pipeline (with manual approval gate on the `production` environment) will:
+   - SSH into the production VM
+   - Pull the Docker image from GHCR
+   - Stop the old container and start the new one
 
-1. Once the canary phase is successful (100% traffic on Java), update the DNS or load balancer to point entirely to the new service:
+   Manual equivalent:
    ```bash
-   # Update DNS A record or CNAME to point to the new Ingress IP
-   # Example: eshop-catalog.example.com → <new-ingress-external-ip>
+   ssh azureuser@<prod-vm-ip>
+   docker pull ghcr.io/<org>/eshop-catalog:<commit-sha>
+   docker stop eshop-catalog || true
+   docker rm eshop-catalog || true
+   docker run -d \
+     --name eshop-catalog \
+     --restart unless-stopped \
+     -p 8080:8080 \
+     --env-file /opt/app/production.env \
+     ghcr.io/<org>/eshop-catalog:<commit-sha>
    ```
-2. Set TTL on DNS records to a low value (e.g., 60s) before the cutover to allow fast rollback.
-3. Verify the DNS change has propagated:
+
+3. Verify the application is healthy:
+   ```bash
+   curl -sf http://<prod-vm-ip>:8080/actuator/health
+   # Expected: {"status":"UP"}
+   ```
+
+### Phase 2: Traffic Switching
+
+**Single-VM approach (stop old, start new):**
+
+1. Stop the legacy .NET application on the production VM (or separate legacy VM).
+2. Update DNS A record to point to the Java application's VM IP.
+3. Verify DNS propagation:
    ```bash
    dig eshop-catalog.example.com
    curl -sf https://eshop-catalog.example.com/actuator/health
    ```
 
+**Blue-green approach (two VMs):**
+
+1. Keep the legacy application running on VM-A.
+2. Deploy the Java application to VM-B.
+3. Switch DNS from VM-A to VM-B.
+4. Monitor for 30–60 minutes.
+5. If stable, decommission VM-A after the soak period.
+
 ### Phase 3: Decommission Legacy
 
-1. After a soak period (24–48 hours with no issues):
-   - Stop the legacy .NET application containers.
-   - Remove legacy deployment resources.
-   - Archive the legacy application artifacts.
-2. Keep the legacy Docker image and deployment manifests available for at least 30 days in case a late rollback is needed.
+After a soak period (24–48 hours with no issues):
+
+1. Stop the legacy .NET application container or service.
+2. Archive the legacy application artifacts.
+3. Keep the legacy Docker image and VM snapshot available for at least 30 days.
 
 ---
 
-## Rollback Procedure
+## Rollback Plan
 
 ### Immediate Rollback (< 5 minutes)
 
 If critical issues are detected during or immediately after cutover:
 
-1. **Revert traffic routing** — remove canary annotations or switch Ingress back:
+1. **Stop the Java application** on the production VM:
+   ```bash
+   ssh azureuser@<prod-vm-ip> 'docker stop eshop-catalog'
+   ```
+
+2. **Restart the legacy .NET application**:
    ```bash
-   kubectl apply -f k8s/ingress-legacy.yml
+   # If legacy runs on the same VM:
+   ssh azureuser@<prod-vm-ip> 'docker start eshop-legacy'
+
+   # If legacy runs on a separate VM (blue-green):
+   # Switch DNS back to the legacy VM IP
    ```
-   Or revert DNS to the legacy application's IP/CNAME.
 
-2. **Scale down the Java deployment**:
+3. **Revert DNS** to point to the legacy application's IP:
    ```bash
-   kubectl scale deployment eshop-catalog --replicas=0
+   # Update DNS A record back to legacy VM IP
+   dig eshop-catalog.example.com  # Verify propagation
    ```
 
-3. **Verify** the legacy application is serving traffic:
+4. **Verify** the legacy application is serving traffic:
    ```bash
    curl -sf https://eshop-catalog.example.com/
    ```
 
 ### Database Rollback
 
-If Flyway migrations introduced breaking schema changes:
-
-1. Restore the database from the pre-cutover backup:
-   ```sql
-   RESTORE DATABASE CatalogDb FROM DISK = '/backups/CatalogDb_pre_cutover.bak' WITH REPLACE
-   ```
-
-2. Restart the legacy application to reconnect.
+See [Database Rollback Strategy](#database-rollback-strategy) above.
 
 ### Post-Rollback Actions
 
 - Document the issue that triggered the rollback.
-- Create a fix branch, apply the fix, and re-run the full CI/CD pipeline.
+- Create a fix branch, apply the fix, re-run the full CI/CD pipeline.
 - Re-test on staging before attempting another cutover.
 - Notify stakeholders of the rollback and revised timeline.
 
 ---
 
-## Post-Cutover Monitoring
+## Monitoring Checklist
+
+### Key Metrics to Watch During Cutover
 
-### Key Metrics to Watch
+| Metric | Source | Threshold |
+|--------|--------|-----------|
+| HTTP 5xx error rate | Application logs / Prometheus | < 0.1% |
+| P95 response latency | Micrometer / Prometheus | < 500ms |
+| JVM heap usage | `/actuator/prometheus` | < 80% of limit |
+| Database connection pool | HikariCP metrics | No pool exhaustion |
+| Container restart count | `docker inspect` | 0 restarts |
+| Flyway migration status | `/actuator/flyway` | All migrations applied |
 
-| Metric                       | Source                         | Threshold               |
-|------------------------------|--------------------------------|--------------------------|
-| HTTP 5xx error rate          | Prometheus / Ingress metrics   | < 0.1%                  |
-| P95 response latency         | Prometheus                     | < 500ms                 |
-| JVM heap usage               | `/actuator/prometheus`         | < 80% of limit          |
-| Database connection pool     | HikariCP metrics               | No pool exhaustion       |
-| Pod restart count            | `kubectl get pods`             | 0 restarts              |
-| Flyway migration status      | `/actuator/flyway`             | All migrations applied   |
+### Actuator Endpoints
 
-### Monitoring Checklist
+| Endpoint | Purpose |
+|----------|---------|
+| `/actuator/health` | Application health status |
+| `/actuator/metrics` | Micrometer metrics |
+| `/actuator/prometheus` | Prometheus-format metrics export |
+| `/actuator/flyway` | Flyway migration status |
 
-- [ ] Grafana dashboards configured with Spring Boot and JVM panels
-- [ ] Alerts configured for error rate spikes and high latency
-- [ ] Log aggregation (e.g., Azure Monitor, ELK) collecting application logs
-- [ ] On-call rotation aware of new service and its health endpoints
-- [ ] Periodic health checks verified (`/actuator/health`)
+### Prometheus Integration
+
+If Prometheus is configured, add the VM as a scrape target:
+
+```yaml
+scrape_configs:
+  - job_name: 'eshop-catalog'
+    metrics_path: '/actuator/prometheus'
+    static_configs:
+      - targets: ['<vm-ip>:8080']
+```
 
 ### First 24 Hours
 
@@ -179,6 +243,42 @@ If Flyway migrations introduced breaking schema changes:
 
 ---
 
+## Communication Plan
+
+### Before Cutover
+
+| When | Who | What |
+|------|-----|------|
+| T-5 days | All stakeholders | Announce cutover window, link to this document |
+| T-1 day | Engineering + Ops | Final go/no-go decision based on staging results |
+| T-1 hour | On-call team | Confirm readiness, verify monitoring dashboards |
+
+### During Cutover
+
+| When | Who | What |
+|------|-----|------|
+| T+0 | Engineering | Begin cutover, post status to team channel |
+| T+15 min | Engineering | Report initial health check results |
+| T+1 hour | Engineering | Report stability metrics, confirm or escalate |
+
+### After Cutover
+
+| When | Who | What |
+|------|-----|------|
+| T+4 hours | Engineering | Summary of first 4 hours to stakeholders |
+| T+24 hours | Engineering | Confirm soak period passed, declare success or plan remediation |
+| T+48 hours | Product Owner | Final sign-off and legacy decommission approval |
+
+### Rollback Communication
+
+If rollback is triggered:
+
+1. Immediately notify the on-call channel: "Rolling back eShop Catalog to legacy .NET — [reason]"
+2. Post a follow-up within 1 hour with root cause analysis.
+3. Schedule a retrospective within 48 hours.
+
+---
+
 ## Success Criteria
 
 The cutover is considered successful when all of the following are met:
@@ -188,5 +288,5 @@ The cutover is considered successful when all of the following are met:
 3. **Availability** — zero unplanned downtime in the first 48 hours post-cutover.
 4. **Error rate** — HTTP 5xx rate stays below 0.1% for 48 hours.
 5. **Data integrity** — no data loss or corruption; row counts match pre-cutover values.
-6. **Health probes** — liveness and readiness probes pass continuously.
+6. **Health probes** — `/actuator/health` returns `UP` continuously.
 7. **Stakeholder sign-off** — product owner confirms acceptance after the soak period.

From 4b51155422568407c002ee2cf8c182b9027107bc Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Tue, 26 May 2026 05:53:54 +0000
Subject: [PATCH 7/9] fix: setup-vm.sh accepts environment argument
 (staging|production)

Addresses Devin Review feedback on PR #91: script was hardcoded to
create production.env but is documented to run on both staging and
production VMs. Now accepts an argument to generate the correct
env file. Updated DEPLOYMENT.md with per-environment usage examples.
---
 eShopLegacyMVC-SpringBoot/DEPLOYMENT.md       | 10 +++++++---
 eShopLegacyMVC-SpringBoot/scripts/setup-vm.sh |  6 ++++--
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/eShopLegacyMVC-SpringBoot/DEPLOYMENT.md b/eShopLegacyMVC-SpringBoot/DEPLOYMENT.md
index 31e205f4..622eefdd 100644
--- a/eShopLegacyMVC-SpringBoot/DEPLOYMENT.md
+++ b/eShopLegacyMVC-SpringBoot/DEPLOYMENT.md
@@ -100,9 +100,13 @@ Each VM (staging and production) must meet the following requirements:
 Run the idempotent setup script on each fresh VM:
 
 ```bash
-# Copy and run on the VM
-scp scripts/setup-vm.sh azureuser@<vm-ip>:~/
-ssh azureuser@<vm-ip> 'chmod +x ~/setup-vm.sh && sudo ~/setup-vm.sh'
+# Copy and run on the staging VM
+scp scripts/setup-vm.sh azureuser@<staging-vm-ip>:~/
+ssh azureuser@<staging-vm-ip> 'chmod +x ~/setup-vm.sh && sudo ~/setup-vm.sh staging'
+
+# Copy and run on the production VM
+scp scripts/setup-vm.sh azureuser@<prod-vm-ip>:~/
+ssh azureuser@<prod-vm-ip> 'chmod +x ~/setup-vm.sh && sudo ~/setup-vm.sh production'
 ```
 
 ---
diff --git a/eShopLegacyMVC-SpringBoot/scripts/setup-vm.sh b/eShopLegacyMVC-SpringBoot/scripts/setup-vm.sh
index bc6cfad8..aa7c2613 100755
--- a/eShopLegacyMVC-SpringBoot/scripts/setup-vm.sh
+++ b/eShopLegacyMVC-SpringBoot/scripts/setup-vm.sh
@@ -1,6 +1,7 @@
 #!/bin/bash
 # setup-vm.sh — Idempotent script to prepare a fresh Azure VM for deployments.
-# Run as root: sudo ./setup-vm.sh
+# Usage: sudo ./setup-vm.sh [staging|production]
+#   Defaults to 'production' if no argument is provided.
 #
 # This script:
 #   1. Installs Docker (if not already installed)
@@ -11,8 +12,9 @@
 
 set -euo pipefail
 
+ENV_NAME="${1:-production}"
 APP_DIR="/opt/app"
-ENV_FILE="$APP_DIR/production.env"
+ENV_FILE="$APP_DIR/${ENV_NAME}.env"
 
 echo "=== eShop Catalog VM Setup ==="
 

From 939042b7a8774b05e4e29d3f7bcaf615f7c859ab Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Tue, 26 May 2026 06:01:37 +0000
Subject: [PATCH 8/9] fix: add GHCR auth to deploy jobs and correct
 docker-compose docs

- Add docker login to GHCR on remote VMs before docker pull (staging
  and production deploy jobs) using GITHUB_TOKEN via appleboy/ssh-action
  envs parameter
- Fix DEPLOYMENT.md: docker compose with SQL Server requires
  SPRING_PROFILES_ACTIVE=prod to override mock profile defaults
---
 .github/workflows/deploy.yml            | 8 ++++++++
 eShopLegacyMVC-SpringBoot/DEPLOYMENT.md | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index d7bfec83..661f595c 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -108,7 +108,9 @@ jobs:
           host: ${{ secrets.STAGING_VM_HOST }}
           username: ${{ secrets.VM_USERNAME }}
           key: ${{ secrets.VM_SSH_KEY }}
+          envs: GHCR_TOKEN
           script: |
+            echo "$GHCR_TOKEN" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
             docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
             docker stop eshop-catalog || true
             docker rm eshop-catalog || true
@@ -118,6 +120,8 @@ jobs:
               -p 8080:8080 \
               --env-file /opt/app/staging.env \
               ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
+        env:
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   # ──────────────────────────────────────────────
   # Job 4: Health Check on Staging
@@ -161,7 +165,9 @@ jobs:
           host: ${{ secrets.PROD_VM_HOST }}
           username: ${{ secrets.VM_USERNAME }}
           key: ${{ secrets.VM_SSH_KEY }}
+          envs: GHCR_TOKEN
           script: |
+            echo "$GHCR_TOKEN" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
             docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
             docker stop eshop-catalog || true
             docker rm eshop-catalog || true
@@ -171,6 +177,8 @@ jobs:
               -p 8080:8080 \
               --env-file /opt/app/production.env \
               ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
+        env:
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Verify production health
         run: |
diff --git a/eShopLegacyMVC-SpringBoot/DEPLOYMENT.md b/eShopLegacyMVC-SpringBoot/DEPLOYMENT.md
index 622eefdd..6ac21f9c 100644
--- a/eShopLegacyMVC-SpringBoot/DEPLOYMENT.md
+++ b/eShopLegacyMVC-SpringBoot/DEPLOYMENT.md
@@ -150,7 +150,7 @@ Use `docker-compose.yml` for local development with the application and a SQL Se
 docker compose up --build
 
 # Start with SQL Server database
-USE_MOCK_DATA=false docker compose up --build
+SPRING_PROFILES_ACTIVE=prod USE_MOCK_DATA=false docker compose up --build
 
 # Stop and clean up
 docker compose down -v

From e3fd68054b87b5989624cdc01cc1abe6eb7026ef Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Tue, 26 May 2026 06:11:26 +0000
Subject: [PATCH 9/9] fix: add environment: staging to health-check job for
 secret access

---
 .github/workflows/deploy.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 661f595c..1f27a1d6 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -130,6 +130,7 @@ jobs:
     name: Staging Health Check
     runs-on: ubuntu-latest
     needs: deploy-staging
+    environment: staging
     steps:
       - name: Wait for application startup
         run: sleep 30