From cd36326202bd57467d4c44218e7ed0e9be74a68e Mon Sep 17 00:00:00 2001
From: mytheclipsebotreview <bot@users.noreply.github.com>
Date: Sat, 25 Jul 2026 12:43:40 +0700
Subject: [PATCH] fix: auto-fix code quality [skip ci]

---
 infra/compose/llm-api.yml       | 4 ++++
 infra/docker/llm-api.Dockerfile | 8 ++++++--
 infra/traefik/dynamic/apps.yaml | 5 +++++
 infra/traefik/dynamic/ssl.yaml  | 4 ++++
 4 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/infra/compose/llm-api.yml b/infra/compose/llm-api.yml
index c935c5f..b59a179 100644
--- a/infra/compose/llm-api.yml
+++ b/infra/compose/llm-api.yml
@@ -1,3 +1,7 @@
+# ── llm-api service (Rust GGUF inference) ──
+# Model file is mounted from host; healthcheck tolerates HTTP 404 (exit 22)
+# from curl to confirm the server is alive regardless of endpoint availability.
+
 services:
   llm-api:
     container_name: llm-api
diff --git a/infra/docker/llm-api.Dockerfile b/infra/docker/llm-api.Dockerfile
index 573c142..5eb0d64 100644
--- a/infra/docker/llm-api.Dockerfile
+++ b/infra/docker/llm-api.Dockerfile
@@ -1,7 +1,8 @@
 # ── Build stage: cargo-chef ──
 FROM lukemathwalker/cargo-chef:latest-rust-1.89.0 AS chef
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    libclang-dev cmake \
+    libclang-dev \
+    cmake \
     && rm -rf /var/lib/apt/lists/*
 WORKDIR /app
 
@@ -23,6 +24,8 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
 
 # ── Runtime image ──
 FROM debian:bookworm-slim AS runtime
+# ca-certificates: TLS for API calls  |  curl: healthcheck  |  libssl3: TLS runtime dep
+# libgomp1: OpenMP parallelism for GGUF model inference
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates \
     curl \
@@ -30,13 +33,14 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libgomp1 \
     && rm -rf /var/lib/apt/lists/*
 
+# Non-root user for security
 RUN groupadd -g 1001 appgroup && \
     useradd -u 1001 -g appgroup -s /bin/sh appuser
 
 WORKDIR /app
 COPY --from=builder /app/llm-api /app/llm-api
 
-# Model will be mounted at runtime
+# Model volume mount point (provided at runtime)
 RUN mkdir -p /root/models/gguf && chown -R appuser:appgroup /root/models/gguf
 
 USER appuser
diff --git a/infra/traefik/dynamic/apps.yaml b/infra/traefik/dynamic/apps.yaml
index 9ea3de9..43607bc 100644
--- a/infra/traefik/dynamic/apps.yaml
+++ b/infra/traefik/dynamic/apps.yaml
@@ -1,3 +1,7 @@
+# ── Traefik dynamic configuration (watched at runtime) ──
+# Routers map host rules to backend services; services resolve via Docker
+# internal DNS (container_name:port).
+
 http:
   routers:
     elysia:
@@ -59,6 +63,7 @@ http:
         Host(`scraper.asepharyana.web.id`) || Host(`api.asepharyana.web.id`)
       service: scraper-service
       tls: {}
+      # ── Backend service definitions ──
   services:
     elysia-service:
       loadBalancer:
diff --git a/infra/traefik/dynamic/ssl.yaml b/infra/traefik/dynamic/ssl.yaml
index c91e9e1..770aad5 100644
--- a/infra/traefik/dynamic/ssl.yaml
+++ b/infra/traefik/dynamic/ssl.yaml
@@ -1,3 +1,7 @@
+# ── TLS certificate configuration ──
+# Certificates are auto-renewed by the cert-manager sidecar.
+# asepharyana.my.id is the default certificate for all routes.
+
 tls:
   certificates:
     - certFile: /etc/traefik/certs/asepharyana.my.id.pem