refactor: reorganize project structure — frontend/, infra/, clean paths

.gitignore

@@ -40,8 +40,9 @@ dist/
 .terraform.lock.hcl
 
 # Private deployment (OKE/K8s — not for public distribution)
-deploy/terraform-oke/
+infra/terraform-oke/
-deploy/k8s/
+infra/k8s/
 
-# Project internal docs
+# Cache
-LESSONS_LEARNED.md
+.pytest_cache/
+**/.pytest_cache/

README.md

@@ -504,26 +504,35 @@ Allow group <group-name> to read buckets in compartment <compartment-name>
 ```
 oci-cis-agent/
 ├── backend/
-│   ├── app.py              # FastAPI application (~10500 lines)
+│   ├── app.py               # FastAPI application (~10500 lines)
-│   ├── cis_reports.py       # Oracle CIS Benchmark checker (6660 lines, report engine)
+│   ├── cis_reports.py        # Oracle CIS Benchmark checker (6660 lines)
-│   ├── mcp_cis_server.py    # MCP server with 12 granular CIS tools (~700 lines)
+│   ├── mcp_cis_server.py     # MCP server with 12 granular CIS tools
-│   ├── gen_tf_reference.py  # OCI Terraform provider resource catalog generator
+│   ├── gen_tf_reference.py   # OCI Terraform provider resource catalog generator
-│   ├── Dockerfile           # Python 3.12 + OCI CLI + Terraform 1.14.7 + Chromium
+│   ├── Dockerfile            # Backend image (Python 3.12 + OCI CLI + Terraform + Chromium)
-│   └── requirements.txt     # Dependencies
+│   ├── requirements.txt
-├── frontend-react/
+│   └── tests/                # 86 baseline tests (pytest)
-│   ├── src/                 # React 19 SPA (TypeScript, 46 source files, ~19500 lines)
+├── frontend/
-│   │   ├── pages/           # 20 page components (Chat, Terraform, Explorer, Terminal, OCI Services, Reports, Config, Admin)
+│   ├── src/                  # React 19 SPA (TypeScript, 46 files, ~19500 lines)
-│   │   ├── api/             # API client + endpoint modules
+│   │   ├── pages/            # 20 page components
-│   │   ├── stores/          # Zustand stores (app, auth, terminal — state persistence across navigation)
+│   │   ├── api/              # API client + endpoint modules
-│   │   ├── hooks/           # Custom hooks (theme, polling)
+│   │   ├── stores/           # Zustand stores (app, auth, terminal)
-│   │   └── i18n/            # Internationalization (pt/en/es, 850+ keys)
+│   │   ├── hooks/            # Custom hooks (theme, polling)
-│   └── dist/                # Built SPA served at /
+│   │   └── i18n/             # Internationalization (pt/en/es, 850+ keys)
+│   └── dist/                 # Built SPA
+├── infra/
+│   ├── docker/
+│   │   ├── Dockerfile.single # Single container (nginx + backend + supervisord)
+│   │   └── Dockerfile.frontend
+│   ├── terraform-vm/         # OCI VM deployment (ARM Free Tier, LB+WAF+SSL)
+│   ├── scripts/
+│   │   ├── push-images.sh    # Build + push to OCIR
+│   │   └── ocir-login.py     # Encrypted OCIR credentials helper
+│   └── ...
+├── distribution/             # Public release package (setup.sh + README + terraform)
 ├── nginx/
-│   └── default.conf         # Reverse proxy (React SPA + API /api/)
+│   └── default.conf
-├── docker-compose.yml       # Orchestration
+├── docker-compose.yml
-├── logo.svg                 # Project logo (Oracle AI Robot)
+├── .env.example
-├── .env.example             # Environment template
-├── .gitignore
 └── README.md
 ```
 
@@ -884,7 +893,7 @@ python -m pytest tests/ -v
 ### Build & Push OCIR Image
 
 ```bash
-OCIR_REGION=us-ashburn-1 OCIR_NAMESPACE=idi1o0a010nx ./deploy/scripts/push-images.sh
+OCIR_REGION=us-ashburn-1 OCIR_NAMESPACE=idi1o0a010nx ./infra/scripts/push-images.sh
 ```
 
 ### Rebuild After Changes

deploy/scripts/push-images.sh

@@ -1,74 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-
-OCIR_REGION="${OCIR_REGION:?Set OCIR_REGION (e.g., us-ashburn-1)}"
-OCIR_NAMESPACE="${OCIR_NAMESPACE:?Set OCIR_NAMESPACE}"
-OCIR_REPO_PREFIX="${OCIR_REPO_PREFIX:-oci-cis-agent}"
-IMAGE_TAG="${IMAGE_TAG:-latest}"
-
-UNIFIED="${OCIR_REGION}.ocir.io/${OCIR_NAMESPACE}/${OCIR_REPO_PREFIX}:${IMAGE_TAG}"
-BACKEND="${OCIR_REGION}.ocir.io/${OCIR_NAMESPACE}/${OCIR_REPO_PREFIX}-backend:${IMAGE_TAG}"
-FRONTEND="${OCIR_REGION}.ocir.io/${OCIR_NAMESPACE}/${OCIR_REPO_PREFIX}-frontend:${IMAGE_TAG}"
-
-echo "========================================"
-echo "OCI CIS Agent — Build & Push to OCIR"
-echo "========================================"
-echo "Unified:  $UNIFIED"
-echo "Backend:  $BACKEND"
-echo "Frontend: $FRONTEND"
-echo ""
-
-# 1. Build frontend React SPA
-echo ">>> Building frontend..."
-cd "$PROJECT_ROOT/frontend-react"
-npm ci --silent
-npm run build
-echo "Frontend build OK."
-
-# 2. Ensure buildx builder exists
-docker buildx inspect multiarch >/dev/null 2>&1 || \
-  docker buildx create --name multiarch --use
-docker buildx use multiarch
-
-# 3. Login to OCIR
-echo ">>> Logging in to OCIR..."
-docker login "${OCIR_REGION}.ocir.io"
-
-# 4. Build + push UNIFIED image (single container — nginx + backend)
-echo ">>> Building & pushing unified image (amd64 + arm64)..."
-cd "$PROJECT_ROOT"
-docker buildx build \
-  --platform linux/amd64,linux/arm64 \
-  -t "$UNIFIED" \
-  --push \
-  -f deploy/Dockerfile .
-echo "Unified image pushed."
-
-# 5. Build + push backend (multi-arch) — for docker-compose deployments
-echo ">>> Building & pushing backend (amd64 + arm64)..."
-docker buildx build \
-  --platform linux/amd64,linux/arm64 \
-  -t "$BACKEND" \
-  --push \
-  -f backend/Dockerfile backend/
-echo "Backend image pushed."
-
-# 6. Build + push frontend (multi-arch) — for docker-compose deployments
-echo ">>> Building & pushing frontend (amd64 + arm64)..."
-docker buildx build \
-  --platform linux/amd64,linux/arm64 \
-  -t "$FRONTEND" \
-  --push \
-  -f deploy/Dockerfile.frontend .
-echo "Frontend image pushed."
-
-echo ""
-echo "========================================"
-echo "All 3 images pushed!"
-echo "Unified:  $UNIFIED  (single container)"
-echo "Backend:  $BACKEND  (docker-compose)"
-echo "Frontend: $FRONTEND (docker-compose)"
-echo "========================================"

docker-compose.yml

@@ -38,7 +38,7 @@ services:
     environment:
       - TZ=${TZ:-America/Sao_Paulo}
     volumes:
-      - ./frontend-react/dist:/usr/share/nginx/html/app:ro
+      - ./frontend/dist:/usr/share/nginx/html/app:ro
       - ./nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
     ports:
       - "${PORT:-8080}:80"

infra/docker/Dockerfile.frontend

@@ -1,6 +1,6 @@
 FROM nginx:alpine
 RUN rm -rf /usr/share/nginx/html/*
-COPY frontend-react/dist /usr/share/nginx/html/app
+COPY frontend/dist /usr/share/nginx/html/app
 COPY nginx/default.conf /etc/nginx/conf.d/default.conf
 EXPOSE 80
 CMD ["nginx", "-g", "daemon off;"]

infra/docker/Dockerfile.single

@@ -26,7 +26,7 @@ COPY backend/gen_tf_reference.py .
 
 # ── Frontend (pre-built React SPA) ─────────────────────────────────────────
 RUN rm -rf /usr/share/nginx/html/*
-COPY frontend-react/dist /usr/share/nginx/html/app
+COPY frontend/dist /usr/share/nginx/html/app
 
 # ── Nginx config (proxy to localhost instead of backend hostname) ───────────
 RUN printf 'map $uri $empty {\n    default "";\n}\n\nserver {\n    listen 8080;\n    server_name _;\n    client_max_body_size 50M;\n    absolute_redirect off;\n\n    location / {\n        root /usr/share/nginx/html/app;\n        try_files $uri $uri/ /index.html;\n        add_header Cache-Control "no-cache, no-store, must-revalidate" always;\n        add_header X-Frame-Options "DENY" always;\n        add_header X-Content-Type-Options "nosniff" always;\n        add_header X-XSS-Protection "1; mode=block" always;\n        add_header Referrer-Policy "strict-origin-when-cross-origin" always;\n        add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;\n    }\n\n    location /api/ {\n        proxy_pass http://127.0.0.1:8000/api/;\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n        proxy_set_header X-Forwarded-Proto $scheme;\n        proxy_read_timeout 900s;\n        proxy_send_timeout 900s;\n        proxy_connect_timeout 60s;\n        add_header X-Frame-Options "SAMEORIGIN" always;\n        add_header X-Content-Type-Options "nosniff" always;\n    }\n}\n' > /etc/nginx/sites-available/default

infra/scripts/push-images.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+
+OCIR_REGION="${OCIR_REGION:?Set OCIR_REGION (e.g., us-ashburn-1)}"
+OCIR_NAMESPACE="${OCIR_NAMESPACE:?Set OCIR_NAMESPACE}"
+OCIR_REPO_PREFIX="${OCIR_REPO_PREFIX:-oci-cis-agent}"
+IMAGE_TAG="${IMAGE_TAG:-latest}"
+
+UNIFIED="${OCIR_REGION}.ocir.io/${OCIR_NAMESPACE}/${OCIR_REPO_PREFIX}:${IMAGE_TAG}"
+
+echo "========================================"
+echo "OCI CIS Agent — Build & Push to OCIR"
+echo "========================================"
+echo "Image: $UNIFIED"
+echo ""
+
+# 1. Build frontend React SPA
+echo ">>> Building frontend..."
+cd "$PROJECT_ROOT/frontend"
+npm ci --silent
+npm run build
+echo "Frontend build OK."
+
+# 2. Ensure buildx builder exists
+docker buildx inspect multiarch >/dev/null 2>&1 || \
+  docker buildx create --name multiarch --use
+docker buildx use multiarch
+
+# 3. Login to OCIR
+echo ">>> Logging in to OCIR..."
+docker login "${OCIR_REGION}.ocir.io"
+
+# 4. Build + push single container image (multi-arch)
+echo ">>> Building & pushing image (amd64 + arm64)..."
+cd "$PROJECT_ROOT"
+docker buildx build \
+  --platform linux/amd64,linux/arm64 \
+  -t "$UNIFIED" \
+  --push \
+  -f infra/docker/Dockerfile.single .
+echo "Image pushed."
+
+echo ""
+echo "========================================"
+echo "Done! $UNIFIED"
+echo "========================================"