Enterprise Deployment

# webmcp-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: webmcp-processor
  namespace: webmcp
  labels:
    app: webmcp-processor
    version: v1.0.0
spec:
  replicas: 5
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 2
      maxUnavailable: 1
  selector:
    matchLabels:
      app: webmcp-processor
  template:
    metadata:
      labels:
        app: webmcp-processor
    spec:
      containers:
      - name: webmcp-processor
        image: webmcp/processor:1.0.0
        ports:
        - containerPort: 8080
          name: http
        - containerPort: 9090
          name: metrics
        env:
        - name: NODE_ENV
          value: "production"
        - name: REDIS_URL
          valueFrom:
            secretKeyRef:
              name: webmcp-secrets
              key: redis-url
        - name: API_KEYS
          valueFrom:
            secretKeyRef:
              name: webmcp-secrets
              key: api-keys
        resources:
          requests:
            memory: "1Gi"
            cpu: "500m"
          limits:
            memory: "2Gi"
            cpu: "1000m"
        livenessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /ready
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 5
        volumeMounts:
        - name: config
          mountPath: /app/config
          readOnly: true
      volumes:
      - name: config
        configMap:
          name: webmcp-config

---
apiVersion: v1
kind: Service
metadata:
  name: webmcp-processor-service
  namespace: webmcp
spec:
  selector:
    app: webmcp-processor
  ports:
  - name: http
    port: 80
    targetPort: 8080
  - name: metrics
    port: 9090
    targetPort: 9090
  type: ClusterIP

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: webmcp-config
  namespace: webmcp
data:
  config.json: |
    {
      "optimization": {
        "defaultLevel": "moderate",
        "enableCaching": true,
        "cacheExpiration": 3600,
        "parallelProcessing": true,
        "maxConcurrentJobs": 10
      },
      "monitoring": {
        "enabled": true,
        "metricsPort": 9090,
        "logLevel": "info",
        "tracingEnabled": true
      },
      "security": {
        "enableAuth": true,
        "jwtSecret": "${JWT_SECRET}",
        "apiRateLimit": {
          "windowMs": 900000,
          "max": 1000
        }
      }
    }

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: webmcp-ingress
  namespace: webmcp
  annotations:
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    nginx.ingress.kubernetes.io/rate-limit: "100"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  tls:
  - hosts:
    - api.webmcp.company.com
    secretName: webmcp-tls
  rules:
  - host: api.webmcp.company.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: webmcp-processor-service
            port:
              number: 80

---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: webmcp-hpa
  namespace: webmcp
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: webmcp-processor
  minReplicas: 3
  maxReplicas: 20
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80

# docker-compose.prod.yml
version: '3.8'

services:
  # Load Balancer
  nginx:
    image: nginx:alpine
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/ssl:/etc/nginx/ssl:ro
    depends_on:
      - webmcp-api-1
      - webmcp-api-2
      - webmcp-api-3
    restart: unless-stopped
    networks:
      - webmcp-network

  # webMCP API Services
  webmcp-api-1:
    image: webmcp/api:latest
    environment:
      - NODE_ENV=production
      - REDIS_URL=redis://redis:6379
      - DATABASE_URL=postgresql://user:pass@postgres:5432/webmcp
      - API_KEYS_SECRET=${API_KEYS_SECRET}
      - JWT_SECRET=${JWT_SECRET}
    volumes:
      - ./config:/app/config:ro
    depends_on:
      - redis
      - postgres
    restart: unless-stopped
    networks:
      - webmcp-network
    deploy:
      resources:
        limits:
          memory: 2G
          cpus: '1.0'
        reservations:
          memory: 1G
          cpus: '0.5'

  webmcp-api-2:
    image: webmcp/api:latest
    environment:
      - NODE_ENV=production
      - REDIS_URL=redis://redis:6379
      - DATABASE_URL=postgresql://user:pass@postgres:5432/webmcp
      - API_KEYS_SECRET=${API_KEYS_SECRET}
      - JWT_SECRET=${JWT_SECRET}
    volumes:
      - ./config:/app/config:ro
    depends_on:
      - redis
      - postgres
    restart: unless-stopped
    networks:
      - webmcp-network
    deploy:
      resources:
        limits:
          memory: 2G
          cpus: '1.0'
        reservations:
          memory: 1G
          cpus: '0.5'

  webmcp-api-3:
    image: webmcp/api:latest
    environment:
      - NODE_ENV=production
      - REDIS_URL=redis://redis:6379
      - DATABASE_URL=postgresql://user:pass@postgres:5432/webmcp
      - API_KEYS_SECRET=${API_KEYS_SECRET}
      - JWT_SECRET=${JWT_SECRET}
    volumes:
      - ./config:/app/config:ro
    depends_on:
      - redis
      - postgres
    restart: unless-stopped
    networks:
      - webmcp-network
    deploy:
      resources:
        limits:
          memory: 2G
          cpus: '1.0'
        reservations:
          memory: 1G
          cpus: '0.5'

  # Background Workers
  webmcp-worker-1:
    image: webmcp/worker:latest
    environment:
      - NODE_ENV=production
      - REDIS_URL=redis://redis:6379
      - DATABASE_URL=postgresql://user:pass@postgres:5432/webmcp
      - WORKER_CONCURRENCY=5
    depends_on:
      - redis
      - postgres
    restart: unless-stopped
    networks:
      - webmcp-network

  webmcp-worker-2:
    image: webmcp/worker:latest
    environment:
      - NODE_ENV=production
      - REDIS_URL=redis://redis:6379
      - DATABASE_URL=postgresql://user:pass@postgres:5432/webmcp
      - WORKER_CONCURRENCY=5
    depends_on:
      - redis
      - postgres
    restart: unless-stopped
    networks:
      - webmcp-network

  # Redis Cache
  redis:
    image: redis:7-alpine
    command: redis-server --appendonly yes --replica-read-only no
    volumes:
      - redis-data:/data
    restart: unless-stopped
    networks:
      - webmcp-network
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: '0.5'

  # PostgreSQL Database
  postgres:
    image: postgres:15-alpine
    environment:
      - POSTGRES_DB=webmcp
      - POSTGRES_USER=webmcp_user
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
    volumes:
      - postgres-data:/var/lib/postgresql/data
      - ./init.sql:/docker-entrypoint-initdb.d/init.sql
    restart: unless-stopped
    networks:
      - webmcp-network
    deploy:
      resources:
        limits:
          memory: 2G
          cpus: '1.0'

  # Monitoring
  prometheus:
    image: prom/prometheus:latest
    ports:
      - "9090:9090"
    volumes:
      - ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus-data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.console.libraries=/etc/prometheus/console_libraries'
      - '--web.console.templates=/etc/prometheus/consoles'
    restart: unless-stopped
    networks:
      - webmcp-network

  grafana:
    image: grafana/grafana:latest
    ports:
      - "3000:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD}
    volumes:
      - grafana-data:/var/lib/grafana
      - ./monitoring/grafana/dashboards:/etc/grafana/provisioning/dashboards:ro
      - ./monitoring/grafana/datasources:/etc/grafana/provisioning/datasources:ro
    restart: unless-stopped
    networks:
      - webmcp-network

volumes:
  redis-data:
  postgres-data:
  prometheus-data:
  grafana-data:

networks:
  webmcp-network:
    driver: bridge

// enterprise-config.js
const EnterpriseWebMCPConfig = {
  // Multi-tenant configuration
  tenancy: {
    enabled: true,
    isolation: 'strict', // 'strict' | 'shared' | 'hybrid'
    defaultTenant: 'default',
    
    // Tenant-specific settings
    tenants: {
      'enterprise-client-1': {
        optimizationLevel: 'aggressive',
        allowedModels: ['gpt-4o', 'claude-3.5-sonnet'],
        rateLimit: {
          requests: 10000,
          windowMs: 3600000 // 1 hour
        },
        dataRetention: 90, // days
        complianceMode: 'hipaa'
      },
      'enterprise-client-2': {
        optimizationLevel: 'moderate',
        allowedModels: ['gpt-4', 'gemini-pro'],
        rateLimit: {
          requests: 5000,
          windowMs: 3600000
        },
        dataRetention: 30,
        complianceMode: 'gdpr'
      }
    }
  },
  
  // High availability configuration
  highAvailability: {
    enabled: true,
    replicationFactor: 3,
    
    // Failover settings
    failover: {
      enabled: true,
      healthCheckInterval: 30000, // 30 seconds
      failureThreshold: 3,
      recoveryThreshold: 2
    },
    
    // Load balancing
    loadBalancing: {
      strategy: 'round_robin', // 'round_robin' | 'least_connections' | 'weighted'
      healthChecks: true,
      stickySession: false
    }
  },
  
  // Security configuration
  security: {
    // Authentication
    authentication: {
      providers: {
        saml: {
          enabled: true,
          entityId: 'webmcp-enterprise',
          ssoUrl: 'https://sso.company.com/saml/sso',
          certificatePath: '/etc/ssl/saml/cert.pem'
        },
        oidc: {
          enabled: true,
          issuer: 'https://auth.company.com',
          clientId: 'webmcp-enterprise',
          clientSecret: process.env.OIDC_CLIENT_SECRET
        },
        apiKey: {
          enabled: true,
          requireRotation: true,
          rotationInterval: 90 // days
        }
      }
    },
    
    // Authorization
    authorization: {
      rbac: {
        enabled: true,
        roles: {
          'admin': {
            permissions: ['*']
          },
          'power-user': {
            permissions: [
              'optimize:*',
              'analytics:read',
              'settings:read'
            ]
          },
          'user': {
            permissions: [
              'optimize:read',
              'optimize:create'
            ]
          }
        }
      }
    },
    
    // Data encryption
    encryption: {
      atRest: {
        enabled: true,
        algorithm: 'AES-256-GCM',
        keyRotation: true,
        keyRotationInterval: 365 // days
      },
      inTransit: {
        enabled: true,
        tlsVersion: '1.3',
        certificateValidation: true
      }
    },
    
    // Audit logging
    audit: {
      enabled: true,
      logLevel: 'detailed',
      retention: 2555, // 7 years in days
      destinations: [
        {
          type: 'file',
          path: '/var/log/webmcp/audit.log',
          rotation: 'daily'
        },
        {
          type: 'siem',
          endpoint: 'https://siem.company.com/api/events',
          format: 'cef'
        }
      ]
    }
  },
  
  // Performance optimization
  performance: {
    // Caching
    caching: {
      enabled: true,
      layers: {
        redis: {
          cluster: true,
          nodes: [
            'redis-1.internal:6379',
            'redis-2.internal:6379',
            'redis-3.internal:6379'
          ],
          ttl: 3600, // 1 hour
          maxMemory: '2GB'
        },
        cdn: {
          enabled: true,
          provider: 'cloudflare',
          ttl: 86400 // 24 hours
        }
      }
    },
    
    // Scaling
    autoScaling: {
      enabled: true,
      minInstances: 3,
      maxInstances: 20,
      
      metrics: {
        cpu: {
          targetUtilization: 70,
          scaleUpThreshold: 80,
          scaleDownThreshold: 30
        },
        memory: {
          targetUtilization: 75,
          scaleUpThreshold: 85,
          scaleDownThreshold: 40
        },
        queueLength: {
          scaleUpThreshold: 100,
          scaleDownThreshold: 10
        }
      }
    },
    
    // Resource management
    resources: {
      limits: {
        maxConcurrentOptimizations: 100,
        maxFileSize: '50MB',
        processingTimeout: 300000, // 5 minutes
        memoryLimit: '4GB'
      },
      
      prioritization: {
        enabled: true,
        queues: {
          'high': { weight: 3, maxWait: 10000 },
          'normal': { weight: 2, maxWait: 30000 },
          'low': { weight: 1, maxWait: 60000 }
        }
      }
    }
  },
  
  // Monitoring and observability
  monitoring: {
    metrics: {
      enabled: true,
      provider: 'prometheus',
      exportInterval: 15000, // 15 seconds
      
      custom: {
        businessMetrics: true,
        tenantMetrics: true,
        costMetrics: true
      }
    },
    
    logging: {
      level: 'info',
      structured: true,
      format: 'json',
      
      destinations: [
        {
          type: 'console',
          level: 'error'
        },
        {
          type: 'file',
          path: '/var/log/webmcp/app.log',
          level: 'info',
          rotation: 'daily'
        },
        {
          type: 'elasticsearch',
          endpoint: 'https://elasticsearch.company.com',
          index: 'webmcp-logs',
          level: 'debug'
        }
      ]
    },
    
    tracing: {
      enabled: true,
      provider: 'jaeger',
      samplingRate: 0.1, // 10% sampling
      endpoint: 'http://jaeger-collector:14268/api/traces'
    },
    
    alerts: {
      enabled: true,
      channels: [
        {
          type: 'slack',
          webhook: process.env.SLACK_WEBHOOK_URL,
          channel: '#webmcp-alerts'
        },
        {
          type: 'pagerduty',
          integrationKey: process.env.PAGERDUTY_INTEGRATION_KEY
        }
      ],
      
      rules: [
        {
          name: 'high_error_rate',
          condition: 'error_rate > 0.05',
          severity: 'critical',
          cooldown: 300 // 5 minutes
        },
        {
          name: 'high_latency',
          condition: 'avg_response_time > 10000',
          severity: 'warning',
          cooldown: 600 // 10 minutes
        }
      ]
    }
  },
  
  // Compliance and governance
  compliance: {
    dataGovernance: {
      enabled: true,
      
      // Data classification
      classification: {
        enabled: true,
        levels: ['public', 'internal', 'confidential', 'restricted'],
        defaultLevel: 'internal'
      },
      
      // Data retention
      retention: {
        policies: {
          'optimization_results': 90, // days
          'analytics_data': 365,
          'audit_logs': 2555, // 7 years
          'user_data': 1095 // 3 years
        },
        autoDelete: true
      },
      
      // Privacy protection
      privacy: {
        piiDetection: true,
        dataAnonymization: true,
        rightToErasure: true, // GDPR compliance
        dataPortability: true
      }
    },
    
    // Regulatory compliance
    regulatory: {
      frameworks: ['SOC2', 'GDPR', 'CCPA', 'HIPAA'],
      
      controls: {
        accessControl: true,
        dataEncryption: true,
        auditLogging: true,
        vulnerabilityScanning: true,
        penetrationTesting: true
      }
    }
  }
};

module.exports = EnterpriseWebMCPConfig;

# monitoring/prometheus.yml
global:
  scrape_interval: 15s
  evaluation_interval: 15s

rule_files:
  - "alert_rules.yml"

alerting:
  alertmanagers:
    - static_configs:
        - targets:
          - alertmanager:9093

scrape_configs:
  # webMCP API metrics
  - job_name: 'webmcp-api'
    static_configs:
      - targets:
        - 'webmcp-api-1:9090'
        - 'webmcp-api-2:9090'
        - 'webmcp-api-3:9090'
    metrics_path: /metrics
    scrape_interval: 15s

  # webMCP Worker metrics
  - job_name: 'webmcp-workers'
    static_configs:
      - targets:
        - 'webmcp-worker-1:9090'
        - 'webmcp-worker-2:9090'
    metrics_path: /metrics
    scrape_interval: 30s

  # Redis metrics
  - job_name: 'redis'
    static_configs:
      - targets:
        - 'redis:6379'
    metrics_path: /metrics

  # PostgreSQL metrics
  - job_name: 'postgres'
    static_configs:
      - targets:
        - 'postgres:5432'

  # Node exporter for system metrics
  - job_name: 'node-exporter'
    static_configs:
      - targets:
        - 'node-exporter:9100'

---
# monitoring/alert_rules.yml
groups:
  - name: webmcp_alerts
    rules:
      # High error rate alert
      - alert: WebMCPHighErrorRate
        expr: rate(webmcp_http_requests_total{status=~"5.."}[5m]) / rate(webmcp_http_requests_total[5m]) > 0.05
        for: 2m
        labels:
          severity: critical
        annotations:
          summary: "webMCP error rate is above 5%"
          description: "Error rate is {{ $value | humanizePercentage }} for instance {{ $labels.instance }}"

      # High response time alert
      - alert: WebMCPHighLatency
        expr: histogram_quantile(0.95, rate(webmcp_http_request_duration_seconds_bucket[5m])) > 10
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "webMCP response time is high"
          description: "95th percentile latency is {{ $value }}s for instance {{ $labels.instance }}"

      # Low optimization success rate
      - alert: WebMCPLowOptimizationSuccess
        expr: rate(webmcp_optimizations_total{status="success"}[10m]) / rate(webmcp_optimizations_total[10m]) < 0.9
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "webMCP optimization success rate is low"
          description: "Success rate is {{ $value | humanizePercentage }} for instance {{ $labels.instance }}"

      # Queue length alert
      - alert: WebMCPQueueTooLong
        expr: webmcp_queue_length > 100
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "webMCP processing queue is too long"
          description: "Queue length is {{ $value }} items for instance {{ $labels.instance }}"

      # Memory usage alert
      - alert: WebMCPHighMemoryUsage
        expr: (process_resident_memory_bytes / process_virtual_memory_max_bytes) > 0.8
        for: 10m
        labels:
          severity: warning
        annotations:
          summary: "webMCP memory usage is high"
          description: "Memory usage is {{ $value | humanizePercentage }} for instance {{ $labels.instance }}"

      # Database connection alert
      - alert: WebMCPDatabaseConnectionIssues
        expr: webmcp_database_connections_active / webmcp_database_connections_max > 0.8
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "webMCP database connection pool is nearly exhausted"
          description: "{{ $value | humanizePercentage }} of database connections are in use"

      # Redis connection alert
      - alert: WebMCPRedisConnectionIssues
        expr: webmcp_redis_connected_clients == 0
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "webMCP cannot connect to Redis"
          description: "No Redis connections detected for instance {{ $labels.instance }}"

---
# monitoring/alertmanager.yml
global:
  smtp_smarthost: 'localhost:587'
  smtp_from: 'alerts@webmcp.company.com'

route:
  group_by: ['alertname']
  group_wait: 10s
  group_interval: 10s
  repeat_interval: 1h
  receiver: 'web.hook'
  routes:
    - match:
        severity: critical
      receiver: 'critical-alerts'
    - match:
        severity: warning
      receiver: 'warning-alerts'

receivers:
  - name: 'web.hook'
    webhook_configs:
      - url: 'http://alertmanager-webhook:5001/'

  - name: 'critical-alerts'
    email_configs:
      - to: 'oncall@company.com'
        subject: 'Critical Alert: {{ .GroupLabels.alertname }}'
        body: |
          {{ range .Alerts }}
          Alert: {{ .Annotations.summary }}
          Description: {{ .Annotations.description }}
          {{ end }}
    slack_configs:
      - api_url: '${SLACK_WEBHOOK_URL}'
        channel: '#critical-alerts'
        title: 'Critical webMCP Alert'
        text: '{{ range .Alerts }}{{ .Annotations.summary }}{{ end }}'

  - name: 'warning-alerts'
    email_configs:
      - to: 'team@company.com'
        subject: 'Warning Alert: {{ .GroupLabels.alertname }}'
    slack_configs:
      - api_url: '${SLACK_WEBHOOK_URL}'
        channel: '#webmcp-alerts'
        title: 'webMCP Warning'
        text: '{{ range .Alerts }}{{ .Annotations.summary }}{{ end }}'