# LotusCloud VNSO Deployment Checklist

Date: 2026-03-07
Target domain: `lotuscloud.vnso.vn`

## Scope delivered in this code update

- VM Multi-NIC foundations in `compute-service` and `network-service`.
- IAM delegation + role inheritance in `iam-service`.
- API gateway routes/RBAC mapping for the new APIs.
- New public landing page at `frontend/lotus-console/app/page.tsx` (Azure-inspired product/solution layout).

## Domain + SSL wiring (host VPS)

Existing cert files on host:

- `/root/dockercompose/ssl/cert.crt`
- `/root/dockercompose/ssl/cert.key`

Nginx runtime file currently used by your containerized nginx:

- `/root/dockercompose/nginx.conf`

Add/update server blocks so that:

- `https://lotuscloud.vnso.vn/` -> `http://host.docker.internal:3100`
- `https://lotuscloud.vnso.vn/api/` -> `http://host.docker.internal:8080/api/`

Recommended verification commands:

```bash
curl -I https://lotuscloud.vnso.vn
curl -I https://lotuscloud.vnso.vn/api/v1/healthz
```

## New backend APIs introduced

### Compute multi-NIC

- `POST /api/v1/instances` supports `network_interfaces` in payload.
- `GET /api/v1/instances/:id/nics`
- `POST /api/v1/instances/:id/nics`
- `DELETE /api/v1/instances/:id/nics/:nicId`

### Network-side interface attachment model

- `POST /api/v1/vpcs/:id/interface-attachments`
- `GET /api/v1/instances/:instanceId/interface-attachments`
- `DELETE /api/v1/instances/:instanceId/interface-attachments/:attachmentId`

### IAM delegation + inheritance

- `POST /api/v1/projects/:id/members/delegate`
- `POST /api/v1/auth/authorize` is now exposed through API gateway.
- Recursive role inheritance now evaluated through `roles.parent_role_id` chain.

## Suggested next execution order

1. Rebuild and restart LotusCloud stack.
2. Apply nginx config update for `lotuscloud.vnso.vn` TLS routing.
3. Smoke test login + VM create + NIC attach + delegation flow.
4. Update `docs/AZURE-FEATURE-GAP.md` status after runtime validation evidence.

## Runtime smoke checklist

- Landing page loads over HTTPS.
- `Sign in` and `Get started` links work.
- VM create returns at least one primary NIC in response.
- Secondary NIC attach succeeds and detach blocks primary NIC removal.
- Delegator with `iam.members.delegate` can assign role to project member.
- Inherited role permissions are honored in `/api/v1/auth/authorize`.
- Viewer role can read instances but is denied write actions (verified smoke test).