{"id":38818,"date":"2026-07-08T15:49:45","date_gmt":"2026-07-08T18:49:45","guid":{"rendered":"https:\/\/www.locaweb.com.br\/ajuda\/?post_type=ht_kb&#038;p=38818"},"modified":"2026-07-08T15:49:45","modified_gmt":"2026-07-08T18:49:45","slug":"deploy-de-api-fastapi-com-postgresql-no-locaweb-cloud","status":"publish","type":"ht_kb","link":"https:\/\/www.locaweb.com.br\/ajuda\/wiki\/deploy-de-api-fastapi-com-postgresql-no-locaweb-cloud\/","title":{"rendered":"Deploy de API FastAPI com PostgreSQL no Locaweb Cloud"},"content":{"rendered":"    \t\t<div class=\"hts-messages hts-messages--info  hts-messages--withtitle hts-messages--withicon \"   >\r\n    \t\t\t<span class=\"hts-messages__title\">Informa\u00e7\u00e3o!<\/span>    \t\t\t    \t\t\t\t<p>\r\n    \t\t\t\t\tNeste tutorial, voc\u00ea aprender\u00e1 a realizar o deploy de uma API robusta desenvolvida em FastAPI com banco de dados relacional PostgreSQL utilizando a infraestrutura de alto desempenho do Locaweb Cloud, com isolamento de rede via VPC e containers Docker.    \t\t\t\t<\/p>\r\n    \t\t\t    \t\t\t\r\n    \t\t<\/div><!-- \/.ht-shortcodes-messages -->\r\n    \t\t\n<p><span style=\"font-weight: 400;\">Apresentamos a seguir o detalhamento da arquitetura de rede que ser\u00e1 implementada ao longo deste guia. A estrutura foi desenhada para que a API opere em uma sub-rede p\u00fablica, com acesso restrito \u00e0 porta da aplica\u00e7\u00e3o, enquanto o banco de dados PostgreSQL permanece protegido e invis\u00edvel em uma sub-rede privada:<\/span><\/p>\n<p>&nbsp;<\/p>\n<pre><span style=\"font-weight: 400;\">\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 [ Internet ]<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u2502<\/span>\r\n\r\n<span style=\"font-weight: 400;\"> \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0        \u25bc (IP P\u00fablico Fixo)<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0[ Roteador Virtual \/ Firewall ]<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u2502<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u25bc (Porta 8000)\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u25bc (Bloqueado)<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\u00a0 \u00a0 \u00a0 \u00a0 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u2502 Tier-Publica-Web \u2502\u00a0 \u00a0 \u00a0 \u00a0 \u2502 Tier-DB\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u2502<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u2502 10.0.1.0\/24\u00a0 \u00a0 \u00a0 \u2502\u00a0 \u00a0 \u00a0 \u00a0 \u2502 10.0.2.0\/24\u00a0 \u00a0 \u00a0 \u2502<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\u00a0 \u00a0 \u00a0 \u00a0 \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u2502\u00a0 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\u00a0 \u2502\u00a0 \u00a0 \u00a0 \u00a0 \u2502\u00a0 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\u00a0 \u2502<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u2502\u00a0 \u2502 VM API \u00a0 \u00a0 \u2502\u00a0 \u2502\u2500\u2500\u2500\u2500\u2500\u2500\u25ba \u2502\u00a0 \u2502 VM Postgres\u2502\u00a0 \u2502<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u2502\u00a0 \u2502 (FastAPI)\u00a0 \u2502\u00a0 \u2502 (5432) \u2502\u00a0 \u2502 (Database) \u2502\u00a0 \u2502<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u2502\u00a0 \u2502\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u2502\u00a0 \u2502\u00a0 \u00a0 \u00a0 \u00a0 \u2502\u00a0 \u2502\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u2502\u00a0 \u2502<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u2502\u00a0 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\u00a0 \u2502\u00a0 \u00a0 \u00a0 \u00a0 \u2502\u00a0 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\u00a0 \u2502<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\u00a0 \u00a0 \u00a0 \u00a0 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518<\/span><\/pre>\n<p>&nbsp;<\/p>\n<h2><b>1. Pr\u00e9-requisitos<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Para garantir que o c\u00f3digo vira neg\u00f3cio sem fric\u00e7\u00e3o, valide os seguintes pr\u00e9-requisitos antes de iniciar os comandos:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Conta Locaweb Cloud ativa com acesso administrativo ao <\/span><a href=\"https:\/\/painel-cloud.locaweb.com.br\"><span style=\"font-weight: 400;\">painel<\/span><\/a><span style=\"font-weight: 400;\"> CloudStack.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Par de chaves SSH cadastrado na plataforma para autentica\u00e7\u00e3o segura.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">M\u00e1quina local com um cliente SSH ativo no terminal.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Um <\/span><b>dom\u00ednio<\/b><span style=\"font-weight: 400;\"> de site registrado (opcional para o deploy inicial, mas mandat\u00f3rio para ativar o HTTPS posteriormente).<\/span><\/li>\n<\/ul>\n    \t\t<div class=\"hts-messages hts-messages--alert  hts-messages--withtitle hts-messages--withicon \"   >\r\n    \t\t\t<span class=\"hts-messages__title\">Importante!<\/span>    \t\t\t    \t\t\t\t<p>\r\n    \t\t\t\t\t<span style=\"font-weight: 400;\">Est\u00e1 com d\u00favidas sobre como come\u00e7ar no Locaweb Cloud? Acesse nosso <\/span><a href=\"https:\/\/www.locaweb.com.br\/ajuda\/wiki\/por-onde-comecar-no-locaweb-cloud\/\"><span style=\"font-weight: 400;\">tutorial de apoio<\/span><\/a><span style=\"font-weight: 400;\">.<\/span>    \t\t\t\t<\/p>\r\n    \t\t\t    \t\t\t\r\n    \t\t<\/div><!-- \/.ht-shortcodes-messages -->\r\n    \t\t\n<h2><b>2. Configura\u00e7\u00e3o de infraestrutura (painel CloudStack)<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Toda a infraestrutura de rede e as m\u00e1quinas virtuais devem ser provisionadas diretamente no painel administrativo antes de qualquer comando no terminal. Utilizaremos uma VPC (Virtual Private Cloud) para garantir o isolamento total do ambiente.<\/span><\/p>\n<h3><b>Passo 1: Criar a VPC<\/b><\/h3>\n<ol>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Acesse o painel do Locaweb Cloud e navegue at\u00e9 <\/span><b>Rede<\/b><span style=\"font-weight: 400;\"> &gt; <\/span><b>VPC<\/b><span style=\"font-weight: 400;\"> &gt; <\/span><b>Adicionar VPC<\/b><span style=\"font-weight: 400;\">.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Configure os par\u00e2metros da nova rede:<\/span>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"2\"><b>Nome:<\/b> <span style=\"font-weight: 400;\">VPC-Producao-API<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"2\"><b>Zona:<\/b><span style=\"font-weight: 400;\"> Selecione a zona de disponibilidade principal (ex: <\/span><span style=\"font-weight: 400;\">ZP01<\/span><span style=\"font-weight: 400;\">).<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"2\"><b>CIDR:<\/b> <span style=\"font-weight: 400;\">10.0.0.0\/16<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"2\"><b>DNS 1 e 2:<\/b> <span style=\"font-weight: 400;\">8.8.8.8<\/span><span style=\"font-weight: 400;\"> e <\/span><span style=\"font-weight: 400;\">8.8.4.4<\/span><span style=\"font-weight: 400;\"> (Google DNS).<\/span><\/li>\n<\/ul>\n<\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Salve as altera\u00e7\u00f5es e aguarde a cria\u00e7\u00e3o do seu roteador virtual dedicado.<\/span><\/li>\n<\/ol>\n<h3><b>Passo 2: Criar as Sub-redes (Tiers)<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Dentro da VPC estruturada, criaremos duas Tiers para separar as responsabilidades do ecossistema:<\/span><\/p>\n<ol>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Tier da API (P\u00fablica):<\/b>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"2\"><b>Nome:<\/b> <span style=\"font-weight: 400;\">Tier-Publica-Web<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"2\"><b>Oferta de rede:<\/b><span style=\"font-weight: 400;\"> Padr\u00e3o com conectividade externa.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"2\"><b>Gateway \/ CIDR:<\/b><span style=\"font-weight: 400;\"> Gateway <\/span><span style=\"font-weight: 400;\">10.0.1.1<\/span><span style=\"font-weight: 400;\"> e CIDR <\/span><span style=\"font-weight: 400;\">10.0.1.0\/24<\/span><span style=\"font-weight: 400;\">.<\/span><\/li>\n<\/ul>\n<\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Tier do Banco de Dados (Privada):<\/b>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"2\"><b>Nome:<\/b> <span style=\"font-weight: 400;\">Tier-DB<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"2\"><b>Oferta de rede:<\/b><span style=\"font-weight: 400;\"> Rede privada (sem conectividade externa).<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"2\"><b>Gateway \/ CIDR:<\/b><span style=\"font-weight: 400;\"> Gateway <\/span><span style=\"font-weight: 400;\">10.0.2.1<\/span><span style=\"font-weight: 400;\"> e CIDR <\/span><span style=\"font-weight: 400;\">10.0.2.0\/24<\/span><span style=\"font-weight: 400;\">.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"2\"><b>ACL:<\/b><span style=\"font-weight: 400;\"> Selecione <\/span><span style=\"font-weight: 400;\">default_deny<\/span><span style=\"font-weight: 400;\"> para bloquear acessos por padr\u00e3o.<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<h3><b>Passo 3: Configurar as ACLs da Tier do banco de dados<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">A sub-rede do banco s\u00f3 deve aceitar tr\u00e1fego originado da sub-rede da aplica\u00e7\u00e3o. Na lista de ACLs da VPC, edite as regras de entrada (<\/span><i><span style=\"font-weight: 400;\">Ingress<\/span><\/i><span style=\"font-weight: 400;\">) da <\/span><span style=\"font-weight: 400;\">Tier-DB<\/span><span style=\"font-weight: 400;\">:<\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td><b>N\u00famero<\/b><\/td>\n<td><b>CIDR de Origem<\/b><\/td>\n<td><b>Protocolo<\/b><\/td>\n<td><b>Porta Inicial<\/b><\/td>\n<td><b>Porta Final<\/b><\/td>\n<td><b>A\u00e7\u00e3o<\/b><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">10<\/span><\/td>\n<td><span style=\"font-weight: 400;\">10.0.1.0\/24<\/span><\/td>\n<td><span style=\"font-weight: 400;\">TCP<\/span><\/td>\n<td><span style=\"font-weight: 400;\">5432<\/span><\/td>\n<td><span style=\"font-weight: 400;\">5432<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Allow<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">20<\/span><\/td>\n<td><span style=\"font-weight: 400;\">10.0.1.0\/24<\/span><\/td>\n<td><span style=\"font-weight: 400;\">TCP<\/span><\/td>\n<td><span style=\"font-weight: 400;\">22<\/span><\/td>\n<td><span style=\"font-weight: 400;\">22<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Allow<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">100<\/span><\/td>\n<td><span style=\"font-weight: 400;\">0.0.0.0\/0<\/span><\/td>\n<td><span style=\"font-weight: 400;\">TCP<\/span><\/td>\n<td><span style=\"font-weight: 400;\">1<\/span><\/td>\n<td><span style=\"font-weight: 400;\">65535<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Deny<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>&nbsp;<\/p>\n    \t\t<div class=\"hts-messages hts-messages--alert  hts-messages--withtitle hts-messages--withicon \"   >\r\n    \t\t\t<span class=\"hts-messages__title\">Importante!<\/span>    \t\t\t    \t\t\t\t<p>\r\n    \t\t\t\t\t<span style=\"font-weight: 400;\">A regra 100 garante que requisi\u00e7\u00f5es vindas de fora da VPC sejam sumariamente descartadas, blindando o seu <\/span><b>banco de dados<\/b><span style=\"font-weight: 400;\"> contra varreduras maliciosas.<\/span>    \t\t\t\t<\/p>\r\n    \t\t\t    \t\t\t\r\n    \t\t<\/div><!-- \/.ht-shortcodes-messages -->\r\n    \t\t\n<h3><b>Passo 4: Provisionar as m\u00e1quinas virtuais<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">No menu <\/span><b>Computa\u00e7\u00e3o<\/b><span style=\"font-weight: 400;\"> &gt; <\/span><b>Inst\u00e2ncias<\/b><span style=\"font-weight: 400;\">, adicione duas VMs utilizando a imagem oficial do Ubuntu 22.04 LTS:<\/span><\/p>\n<ol>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>VM-FastAPI-Prod:<\/b><span style=\"font-weight: 400;\"> Vincule \u00e0 rede <\/span><span style=\"font-weight: 400;\">VPC-Producao-API<\/span><span style=\"font-weight: 400;\"> e associe \u00e0 sub-rede p\u00fablica <\/span><span style=\"font-weight: 400;\">Tier-Publica-Web<\/span><span style=\"font-weight: 400;\"> (M\u00ednimo recomendado: 2 vCPUs e 4 GB de RAM).<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>VM-Postgres-Prod:<\/b><span style=\"font-weight: 400;\"> Vincule \u00e0 rede <\/span><span style=\"font-weight: 400;\">VPC-Producao-API<\/span><span style=\"font-weight: 400;\"> e associe \u00e0 sub-rede privada <\/span><span style=\"font-weight: 400;\">Tier-DB<\/span><span style=\"font-weight: 400;\"> (M\u00ednimo recomendado: 2 vCPUs, 4 GB de RAM e armazenamento SSD).<\/span><\/li>\n<\/ol>\n<p><span style=\"font-weight: 400;\">Aguarde at\u00e9 que ambas fiquem com o status <\/span><i><span style=\"font-weight: 400;\">Running<\/span><\/i><span style=\"font-weight: 400;\"> (Em execu\u00e7\u00e3o) e anote seus IPs privados (ex: <\/span><span style=\"font-weight: 400;\">10.0.1.15<\/span><span style=\"font-weight: 400;\"> para a API e <\/span><span style=\"font-weight: 400;\">10.0.2.15<\/span><span style=\"font-weight: 400;\"> para o banco).<\/span><\/p>\n<h3><b>Passo 5: Alocar o IP P\u00fablico e configurar Port Forwarding<\/b><\/h3>\n<ol>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Em <\/span><b>Rede<\/b><span style=\"font-weight: 400;\"> &gt; <\/span><b>VPC<\/b><span style=\"font-weight: 400;\">, selecione a sua VPC e mude para a aba <\/span><b>IPs P\u00fablicos<\/b><span style=\"font-weight: 400;\"> para obter um novo endere\u00e7o IPv4 fixo.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Acesse a aba <\/span><b>Encaminhamento de porta<\/b><span style=\"font-weight: 400;\"> (<\/span><i><span style=\"font-weight: 400;\">Port Forwarding<\/span><\/i><span style=\"font-weight: 400;\">) desse IP e configure o redirecionamento para expor apenas a aplica\u00e7\u00e3o:<\/span><\/li>\n<\/ol>\n<table>\n<tbody>\n<tr>\n<td><b>Protocolo<\/b><\/td>\n<td><b>Porta P\u00fablica<\/b><\/td>\n<td><b>Porta Privada<\/b><\/td>\n<td><b>VM de Destino<\/b><\/td>\n<td><b>Finalidade<\/b><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">TCP<\/span><\/td>\n<td><span style=\"font-weight: 400;\">8000<\/span><\/td>\n<td><span style=\"font-weight: 400;\">8000<\/span><\/td>\n<td><span style=\"font-weight: 400;\">VM-FastAPI-Prod<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Tr\u00e1fego da API FastAPI<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">TCP<\/span><\/td>\n<td><span style=\"font-weight: 400;\">22<\/span><\/td>\n<td><span style=\"font-weight: 400;\">22<\/span><\/td>\n<td><span style=\"font-weight: 400;\">VM-FastAPI-Prod<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Acesso SSH Administrativo<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>&nbsp;<\/p>\n    \t\t<div class=\"hts-messages hts-messages--danger  hts-messages--withtitle hts-messages--withicon \"   >\r\n    \t\t\t<span class=\"hts-messages__title\">Aviso!<\/span>    \t\t\t    \t\t\t\t<p>\r\n    \t\t\t\t\t<span style=\"font-weight: 400;\">Nunca crie regras de <\/span><i><span style=\"font-weight: 400;\">Port Forwarding<\/span><\/i><span style=\"font-weight: 400;\"> ou exposi\u00e7\u00e3o p\u00fablica para a porta 5432. O PostgreSQL deve permanecer isolado na rede interna privada para mitigar riscos de invas\u00e3o.<\/span>    \t\t\t\t<\/p>\r\n    \t\t\t    \t\t\t\r\n    \t\t<\/div><!-- \/.ht-shortcodes-messages -->\r\n    \t\t\n<h3><b>Passo 6: Liberar as portas no Firewall<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Na aba <\/span><b>Firewall<\/b><span style=\"font-weight: 400;\"> do seu IP p\u00fablico, autorize a entrada de pacotes correspondente ao mapeamento anterior:<\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td><b>CIDR de Origem<\/b><\/td>\n<td><b>Protocolo<\/b><\/td>\n<td><b>Porta Inicial<\/b><\/td>\n<td><b>Porta Final<\/b><\/td>\n<td><b>Finalidade<\/b><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">0.0.0.0\/0<\/span><\/td>\n<td><span style=\"font-weight: 400;\">TCP<\/span><\/td>\n<td><span style=\"font-weight: 400;\">8000<\/span><\/td>\n<td><span style=\"font-weight: 400;\">8000<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Acesso p\u00fablico \u00e0 API<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">&lt;SEU_IP_FIXO&gt;\/32<\/span><\/td>\n<td><span style=\"font-weight: 400;\">TCP<\/span><\/td>\n<td><span style=\"font-weight: 400;\">22<\/span><\/td>\n<td><span style=\"font-weight: 400;\">22<\/span><\/td>\n<td><span style=\"font-weight: 400;\">SSH restrito \u00e0 sua rede de TI<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2><b>3. Configura\u00e7\u00e3o de sistema (Terminal)<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Com a infraestrutura provisionada no painel administrativo, acesse o terminal do servidor para preparar o ecossistema.<\/span><\/p>\n<h3><b>3.1. Conectar via SSH \u00e0 VM da API<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Utilize o terminal do seu computador local para configurar as permiss\u00f5es de seguran\u00e7a da sua chave privada e, em seguida, realize o acesso \u00e0 inst\u00e2ncia p\u00fablica:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Bash<\/span><\/p>\n<pre><span style=\"font-weight: 400;\">chmod 400 ~\/.ssh\/sua-chave.key<\/span>\r\n\r\n<span style=\"font-weight: 400;\">ssh -i ~\/.ssh\/sua-chave.key ubuntu@&lt;SEU_IP_PUBLICO_VPC&gt;<\/span><\/pre>\n<p><span style=\"font-weight: 400;\">Atualize os reposit\u00f3rios do sistema operacional e instale a engine oficial do Docker para garantir a velocidade de entrada no mercado:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Bash<\/span><\/p>\n<pre><span style=\"font-weight: 400;\"># Atualiza pacotes e depend\u00eancias de seguran\u00e7a<\/span>\r\n\r\n<span style=\"font-weight: 400;\">sudo apt-get update -y &amp;&amp; sudo apt-get upgrade -y<\/span>\r\n\r\n<span style=\"font-weight: 400;\">sudo apt-get install -y ca-certificates curl gnupg<\/span>\r\n\r\n\r\n\r\n\r\n<span style=\"font-weight: 400;\"># Configura a chave de criptografia est\u00e1vel do reposit\u00f3rio Docker<\/span>\r\n\r\n<span style=\"font-weight: 400;\">sudo install -m 0755 -d \/etc\/apt\/keyrings<\/span>\r\n\r\n<span style=\"font-weight: 400;\">curl -fsSL https:\/\/download.docker.com\/linux\/ubuntu\/gpg | sudo gpg --dearmor -o \/etc\/apt\/keyrings\/docker.gpg<\/span>\r\n\r\n<span style=\"font-weight: 400;\">sudo chmod a+r \/etc\/apt\/keyrings\/docker.gpg<\/span>\r\n\r\n\r\n\r\n\r\n<span style=\"font-weight: 400;\"># Registra a fonte de pacotes oficial do Docker no gerenciador apt<\/span>\r\n\r\n<span style=\"font-weight: 400;\">echo \\<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\"deb [arch=$(dpkg --print-architecture) signed-by=\/etc\/apt\/keyrings\/docker.gpg] https:\/\/download.docker.com\/linux\/ubuntu \\<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0$(. \/etc\/os-release &amp;&amp; echo \"$VERSION_CODENAME\") stable\" | \\<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0sudo tee \/etc\/apt\/sources.list.d\/docker.list &gt; \/dev\/null<\/span>\r\n\r\n\r\n\r\n\r\n<span style=\"font-weight: 400;\"># Instala o Docker Engine e o plugin do Docker Compose<\/span>\r\n\r\n<span style=\"font-weight: 400;\">sudo apt-get update -y<\/span>\r\n\r\n<span style=\"font-weight: 400;\">sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin<\/span>\r\n\r\n\r\n\r\n\r\n<span style=\"font-weight: 400;\"># Habilita o servi\u00e7o em segundo plano e adiciona permiss\u00f5es ao usu\u00e1rio 'ubuntu'<\/span>\r\n\r\n<span style=\"font-weight: 400;\">sudo systemctl enable --now docker<\/span>\r\n\r\n<span style=\"font-weight: 400;\">sudo usermod -aG docker ubuntu<\/span><\/pre>\n    \t\t<div class=\"hts-messages hts-messages--alert  hts-messages--withtitle hts-messages--withicon \"   >\r\n    \t\t\t<span class=\"hts-messages__title\">Importante!<\/span>    \t\t\t    \t\t\t\t<p>\r\n    \t\t\t\t\t<span style=\"font-weight: 400;\">Encerre a sess\u00e3o do terminal digitando <\/span><span style=\"font-weight: 400;\">exit<\/span><span style=\"font-weight: 400;\"> e conecte-se novamente via SSH para que o sistema valide as novas permiss\u00f5es do seu grupo Docker sem a necessidade de usar <\/span><span style=\"font-weight: 400;\">sudo<\/span><span style=\"font-weight: 400;\">.<\/span>    \t\t\t\t<\/p>\r\n    \t\t\t    \t\t\t\r\n    \t\t<\/div><!-- \/.ht-shortcodes-messages -->\r\n    \t\t\n<h3><b>3.2. Configura\u00e7\u00e3o do banco de dados (PostgreSQL)<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">A partir da VM da API, conecte-se \u00e0 VM do banco utilizando a infraestrutura da rede privada interna da VPC:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Bash<\/span><\/p>\n<pre><span style=\"font-weight: 400;\">ssh -i ~\/.ssh\/sua-chave.key ubuntu@10.0.2.15<\/span><\/pre>\n<p><span style=\"font-weight: 400;\">Instale o banco dedicado para obter total autonomia sobre as tabelas e o desempenho de escrita:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Bash<\/span><\/p>\n<pre><span style=\"font-weight: 400;\">sudo apt-get update -y<\/span>\r\n\r\n<span style=\"font-weight: 400;\">sudo apt-get install -y postgresql postgresql-contrib<\/span>\r\n\r\n<span style=\"font-weight: 400;\">sudo systemctl enable --now postgresql<\/span><\/pre>\n<p><span style=\"font-weight: 400;\">Acesse o console administrativo nativo do PostgreSQL para criar as credenciais da API. Lembre-se de substituir a senha de exemplo por uma credencial forte:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Bash<\/span><\/p>\n<pre><span style=\"font-weight: 400;\">sudo -u postgres psql<\/span><\/pre>\n<p><span style=\"font-weight: 400;\">SQL<\/span><\/p>\n<pre><span style=\"font-weight: 400;\">-- Executado dentro do console psql<\/span>\r\n\r\n<span style=\"font-weight: 400;\">CREATE DATABASE fastapi_prod;<\/span>\r\n\r\n<span style=\"font-weight: 400;\">CREATE USER fastapi_user WITH ENCRYPTED PASSWORD 'TroqueEstaSenha_2026!';<\/span>\r\n\r\n<span style=\"font-weight: 400;\">GRANT ALL PRIVILEGES ON DATABASE fastapi_prod TO fastapi_user;<\/span>\r\n\r\n\r\n\r\n\r\n<span style=\"font-weight: 400;\">-- Conecta ao banco para liberar permiss\u00f5es no schema public (PostgreSQL 15+)<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\\c fastapi_prod<\/span>\r\n\r\n<span style=\"font-weight: 400;\">GRANT ALL ON SCHEMA public TO fastapi_user;<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\\q<\/span><\/pre>\n<h3><b>3.3. Configurar o acesso isolado de rede<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Para que o banco de dados receba as conex\u00f5es da sub-rede onde a aplica\u00e7\u00e3o est\u00e1 hospedada, \u00e9 necess\u00e1rio ajustar o arquivo de configura\u00e7\u00e3o principal. Modifique o caminho abaixo substituindo o n\u00famero da vers\u00e3o (como <\/span><span style=\"font-weight: 400;\">\/14\/<\/span><span style=\"font-weight: 400;\"> ou <\/span><span style=\"font-weight: 400;\">\/15\/<\/span><span style=\"font-weight: 400;\">) de acordo com o que foi instalado no seu ambiente:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Bash<\/span><\/p>\n<pre><span style=\"font-weight: 400;\">sudo nano \/etc\/postgresql\/14\/main\/postgresql.conf<\/span><\/pre>\n<p><span style=\"font-weight: 400;\">Altere a diretriz de escuta para monitorar o IP privado local:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Nginx<\/span><\/p>\n<pre><span style=\"font-weight: 400;\">listen_addresses = 'localhost,10.0.2.15'<\/span><\/pre>\n<p><span style=\"font-weight: 400;\">Em seguida, abra o arquivo de pol\u00edticas de hosts para autorizar apenas o tr\u00e1fego originado na sub-rede da API (<\/span><span style=\"font-weight: 400;\">10.0.1.0\/24<\/span><span style=\"font-weight: 400;\">):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Bash<\/span><\/p>\n<pre><span style=\"font-weight: 400;\">sudo nano \/etc\/postgresql\/14\/main\/pg_hba.conf<\/span><\/pre>\n<p><span style=\"font-weight: 400;\">Adicione a regra de conformidade t\u00e9cnica ao final do arquivo:<\/span><\/p>\n<pre><span style=\"font-weight: 400;\"># TYPE\u00a0 DATABASE\u00a0 \u00a0 \u00a0 USER\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ADDRESS\u00a0 \u00a0 \u00a0 \u00a0 METHOD<\/span>\r\n\r\n<span style=\"font-weight: 400;\">host\u00a0 \u00a0 fastapi_prod\u00a0 fastapi_user\u00a0 10.0.1.0\/24\u00a0 \u00a0 scram-sha-256<\/span><\/pre>\n<p><span style=\"font-weight: 400;\">Salve o arquivo e reinicie o servi\u00e7o do PostgreSQL para aplicar as novas chaves de seguran\u00e7a de rede:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Bash<\/span><\/p>\n<pre><span style=\"font-weight: 400;\">sudo systemctl restart postgresql<\/span><\/pre>\n<h2><b>4. Deploy da aplica\u00e7\u00e3o<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Anote a string de conex\u00e3o estruturada abaixo, que ser\u00e1 usada pela engine do FastAPI para alcan\u00e7ar a sub-rede privada:<\/span><\/p>\n<pre><span style=\"font-weight: 400;\">DATABASE_URL=postgresql:\/\/fastapi_user:TroqueEstaSenha_2026!@10.0.2.15:5432\/fastapi_prod<\/span><\/pre>\n<p><span style=\"font-weight: 400;\">Retorne \u00e0 sua inst\u00e2ncia de aplica\u00e7\u00e3o (<\/span><span style=\"font-weight: 400;\">VM-FastAPI-Prod<\/span><span style=\"font-weight: 400;\">) via SSH para estruturar os arquivos do projeto.<\/span><\/p>\n<h3><b>4.1. Estrutura de arquivos<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Crie a pasta do projeto no servidor:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Bash<\/span><\/p>\n<pre><span style=\"font-weight: 400;\">mkdir -p ~\/app-fastapi &amp;&amp; cd ~\/app-fastapi<\/span><\/pre>\n<p><span style=\"font-weight: 400;\">Crie o arquivo b\u00e1sico de rotas <\/span><span style=\"font-weight: 400;\">main.py<\/span><span style=\"font-weight: 400;\"> com valida\u00e7\u00e3o de sa\u00fade do banco:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Python<\/span><\/p>\n<pre><span style=\"font-weight: 400;\"># main.py<\/span>\r\n\r\n<span style=\"font-weight: 400;\">import os<\/span>\r\n\r\n<span style=\"font-weight: 400;\">from fastapi import FastAPI<\/span>\r\n\r\n<span style=\"font-weight: 400;\">from sqlalchemy import create_engine, text<\/span>\r\n\r\n\r\n\r\n\r\n<span style=\"font-weight: 400;\">app = FastAPI(title=\"API FastAPI no Locaweb Cloud\")<\/span>\r\n\r\n<span style=\"font-weight: 400;\">DATABASE_URL = os.getenv(\"DATABASE_URL\")<\/span>\r\n\r\n<span style=\"font-weight: 400;\">engine = create_engine(DATABASE_URL)<\/span>\r\n\r\n\r\n\r\n\r\n\r\n<span style=\"font-weight: 400;\">@app.get(\"\/\")<\/span>\r\n\r\n<span style=\"font-weight: 400;\">def read_root():<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0return {<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"status\": \"ok\",<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"mensagem\": \"API FastAPI em produ\u00e7\u00e3o no Locaweb Cloud\",<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0}<\/span>\r\n\r\n\r\n\r\n\r\n\r\n<span style=\"font-weight: 400;\">@app.get(\"\/health\")<\/span>\r\n\r\n<span style=\"font-weight: 400;\">def health_check():<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0with engine.connect() as conn:<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0conn.execute(text(\"SELECT 1\"))<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0return {\"database\": \"conectado\"}<\/span><\/pre>\n<p><span style=\"font-weight: 400;\">Crie a lista de depend\u00eancias <\/span><span style=\"font-weight: 400;\">requirements.txt<\/span><span style=\"font-weight: 400;\">:<\/span><\/p>\n<pre><span style=\"font-weight: 400;\">fastapi==0.111.0<\/span>\r\n\r\n<span style=\"font-weight: 400;\">uvicorn[standard]==0.30.1<\/span>\r\n\r\n<span style=\"font-weight: 400;\">sqlalchemy==2.0.31<\/span>\r\n\r\n<span style=\"font-weight: 400;\">psycopg2-binary==2.9.9<\/span><\/pre>\n<p><span style=\"font-weight: 400;\">Crie o <\/span><span style=\"font-weight: 400;\">Dockerfile<\/span><span style=\"font-weight: 400;\"> respons\u00e1vel por empacotar a aplica\u00e7\u00e3o de forma enxuta:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Dockerfile<\/span><\/p>\n<pre><span style=\"font-weight: 400;\">FROM python:3.12-slim<\/span>\r\n\r\n<span style=\"font-weight: 400;\">WORKDIR \/app<\/span>\r\n\r\n<span style=\"font-weight: 400;\">COPY requirements.txt .<\/span>\r\n\r\n<span style=\"font-weight: 400;\">RUN pip install --no-cache-dir -r requirements.txt<\/span>\r\n\r\n<span style=\"font-weight: 400;\">COPY . .<\/span>\r\n\r\n<span style=\"font-weight: 400;\">EXPOSE 8000<\/span>\r\n\r\n<span style=\"font-weight: 400;\">CMD [\"uvicorn\", \"main:app\", \"--host\", \"0.0.0.0\", \"--port\", \"8000\"]<\/span>\r\n\r\n\r\n<\/pre>\n<p><span style=\"font-weight: 400;\">Crie o arquivo de orquestra\u00e7\u00e3o <\/span><span style=\"font-weight: 400;\">docker-compose.yml<\/span><span style=\"font-weight: 400;\">:<\/span><\/p>\n<pre><span style=\"font-weight: 400;\">YAML<\/span>\r\n\r\n<span style=\"font-weight: 400;\">services:<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0api:<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0build: .<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0container_name: fastapi-prod<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0restart: always<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0ports:<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0- \"8000:8000\"<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0environment:<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0- DATABASE_URL=postgresql:\/\/fastapi_user:TroqueEstaSenha_2026!@10.0.2.15:5432\/fastapi_prod<\/span><\/pre>\n<p>&nbsp;<\/p>\n<h3><b>M\u00e9todo 1: Deploy manual<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Com os arquivos salvos no diret\u00f3rio, inicialize a sua aplica\u00e7\u00e3o em formato autosservi\u00e7o:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Bash<\/span><\/p>\n<pre><span style=\"font-weight: 400;\"># Constr\u00f3i as camadas de imagem e roda o container em segundo plano<\/span>\r\n\r\n<span style=\"font-weight: 400;\">docker compose up -d --build<\/span>\r\n\r\n<span style=\"font-weight: 400;\">docker compose ps<\/span><\/pre>\n<p>&nbsp;<\/p>\n<h3><b>M\u00e9todo 2: Deploy automatizado (GitHub Actions)<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Para automatizar seu fluxo via Git e acelerar suas entregas, configure uma esteira de CI\/CD cadastrando os seguintes Secrets no seu reposit\u00f3rio do GitHub: <\/span><span style=\"font-weight: 400;\">SSH_HOST<\/span><span style=\"font-weight: 400;\"> (IP p\u00fablico), <\/span><span style=\"font-weight: 400;\">SSH_USER<\/span><span style=\"font-weight: 400;\"> (<\/span><span style=\"font-weight: 400;\">ubuntu<\/span><span style=\"font-weight: 400;\">), <\/span><span style=\"font-weight: 400;\">SSH_PRIVATE_KEY<\/span><span style=\"font-weight: 400;\"> (Chave privada) e <\/span><span style=\"font-weight: 400;\">SSH_PORT<\/span><span style=\"font-weight: 400;\"> (<\/span><span style=\"font-weight: 400;\">22<\/span><span style=\"font-weight: 400;\">).<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Salve o arquivo <\/span><span style=\"font-weight: 400;\">.github\/workflows\/deploy.yml<\/span><span style=\"font-weight: 400;\"> no seu reposit\u00f3rio de c\u00f3digo local:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">YAML<\/span><\/p>\n<pre><span style=\"font-weight: 400;\">name: Deploy FastAPI<\/span>\r\n\r\n\r\n\r\n\r\n<span style=\"font-weight: 400;\">on:<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0push:<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0branches: [ main ]<\/span>\r\n\r\n\r\n\r\n\r\n<span style=\"font-weight: 400;\">jobs:<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0deploy:<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0runs-on: ubuntu-latest<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0steps:<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0- name: Conectar via SSH e atualizar a aplica\u00e7\u00e3o<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0uses: appleboy\/ssh-action@v1.0.3<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0with:<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0host: ${{ secrets.SSH_HOST }}<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0username: ${{ secrets.SSH_USER }}<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0key: ${{ secrets.SSH_PRIVATE_KEY }}<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0port: ${{ secrets.SSH_PORT }}<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0script: |<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0cd ~\/app-fastapi<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0git pull origin main<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0docker compose up -d --build<\/span>\r\n\r\n<span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0docker image prune -f<\/span><\/pre>\n<h2><b>5. Valida\u00e7\u00e3o\u00a0<\/b><\/h2>\n<h3><b>Testes internos<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Na inst\u00e2ncia da API, confirme que o container est\u00e1 ativo e respondendo aos testes locais de conectividade:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Bash<\/span><\/p>\n<pre><span style=\"font-weight: 400;\">docker compose ps<\/span>\r\n\r\n<span style=\"font-weight: 400;\">curl http:\/\/localhost:8000\/<\/span>\r\n\r\n<span style=\"font-weight: 400;\">curl http:\/\/localhost:8000\/health<\/span><\/pre>\n    \t\t<div class=\"hts-messages hts-messages--alert  hts-messages--withtitle hts-messages--withicon \"   >\r\n    \t\t\t<span class=\"hts-messages__title\">Importante!<\/span>    \t\t\t    \t\t\t\t<p>\r\n    \t\t\t\t\t<span style=\"font-weight: 400;\">O endpoint <\/span><span style=\"font-weight: 400;\">\/health<\/span><span style=\"font-weight: 400;\"> deve retornar <\/span><span style=\"font-weight: 400;\">{&#8220;database&#8221;: &#8220;conectado&#8221;}<\/span><span style=\"font-weight: 400;\">, validando que a sub-rede p\u00fablica conversa perfeitamente com a sub-rede privada do banco.<\/span>    \t\t\t\t<\/p>\r\n    \t\t\t    \t\t\t\r\n    \t\t<\/div><!-- \/.ht-shortcodes-messages -->\r\n    \t\t\n<h3><b>Teste externo e isolamento<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">A partir da sua m\u00e1quina local fora da nuvem, confirme o acesso p\u00fablico e certifique-se de que a porta de dados (5432) est\u00e1 completamente bloqueada para a internet:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Bash<\/span><\/p>\n<pre><span style=\"font-weight: 400;\"># Deve retornar cabe\u00e7alhos HTTP 200 OK<\/span>\r\n\r\n<span style=\"font-weight: 400;\">curl -I http:\/\/&lt;SEU_IP_PUBLICO_VPC&gt;:8000\/<\/span>\r\n\r\n\r\n\r\n\r\n<span style=\"font-weight: 400;\"># Deve resultar em falha de conex\u00e3o (Timeout), provando o isolamento do banco<\/span>\r\n\r\n<span style=\"font-weight: 400;\">nc -zv &lt;SEU_IP_PUBLICO_VPC&gt; 5432<\/span>\r\n\r\n\r\n<\/pre>\n<h2><b>6. Solu\u00e7\u00e3o de problemas (Troubleshooting)<\/b><\/h2>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>API inacess\u00edvel externamente (Timeout):<\/b><span style=\"font-weight: 400;\"> Revise as abas de <\/span><b>Encaminhamento de porta<\/b><span style=\"font-weight: 400;\"> e <\/span><b>Firewall<\/b><span style=\"font-weight: 400;\"> do seu IP p\u00fablico no painel CloudStack. Certifique-se de liberar a entrada na porta 8000 direcionada \u00e0 sua VM da API.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Erro de conex\u00e3o com o banco no endpoint \/health:<\/b><span style=\"font-weight: 400;\"> Acesse a VM do banco e confirme se o arquivo <\/span><span style=\"font-weight: 400;\">postgresql.conf<\/span><span style=\"font-weight: 400;\"> est\u00e1 configurado para escutar o IP <\/span><span style=\"font-weight: 400;\">10.0.2.15<\/span><span style=\"font-weight: 400;\"> e se o <\/span><span style=\"font-weight: 400;\">pg_hba.conf<\/span><span style=\"font-weight: 400;\"> cont\u00e9m a libera\u00e7\u00e3o para a sub-rede <\/span><span style=\"font-weight: 400;\">10.0.1.0\/24<\/span><span style=\"font-weight: 400;\">.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Containers reiniciando em loop:<\/b><span style=\"font-weight: 400;\"> Erros na inicializa\u00e7\u00e3o do cont\u00eainer geralmente indicam falhas na string <\/span><span style=\"font-weight: 400;\">DATABASE_URL<\/span><span style=\"font-weight: 400;\">. Inspecione a sa\u00edda do terminal executando:<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">Bash<\/span><\/p>\n<pre><span style=\"font-weight: 400;\">docker compose logs --tail=50 api<\/span><\/pre>\n    \t\t<div class=\"hts-messages hts-messages--success  hts-messages--withtitle hts-messages--withicon \"   >\r\n    \t\t\t<span class=\"hts-messages__title\">Pronto!<\/span>    \t\t\t    \t\t\t\t<p>\r\n    \t\t\t\t\tSeu ecossistema FastAPI e PostgreSQL foi publicado com sucesso. Sua estrutura est\u00e1 centralizada e rodando com seguran\u00e7a de dados em camadas no Locaweb Cloud.    \t\t\t\t<\/p>\r\n    \t\t\t    \t\t\t\r\n    \t\t<\/div><!-- \/.ht-shortcodes-messages -->\r\n    \t\t\n    \t\t<div class=\"hts-messages hts-messages--info  hts-messages--withtitle hts-messages--withicon \"   >\r\n    \t\t\t<span class=\"hts-messages__title\">Conhe\u00e7a!<\/span>    \t\t\t    \t\t\t\t<p>\r\n    \t\t\t\t\t<span style=\"font-weight: 400;\">Precisa automatizar transa\u00e7\u00f5es, confirma\u00e7\u00f5es de rotas de sistema ou emitir alertas de logs por <\/span><b>email<\/b><span style=\"font-weight: 400;\"> diretamente da sua nova API? Conhe\u00e7a o <\/span><a href=\"https:\/\/www.locaweb.com.br\/smtp-locaweb\/\"><b>SMTP Locaweb<\/b><\/a><span style=\"font-weight: 400;\">, a nossa infraestrutura dedicada de alta entregabilidade desenvolvida especialmente para disparar mensagens transacionais em tempo real e sem travar a sua opera\u00e7\u00e3o!<\/span>    \t\t\t\t<\/p>\r\n    \t\t\t    \t\t\t\r\n    \t\t<\/div><!-- \/.ht-shortcodes-messages -->\r\n    \t\t\n","protected":false},"excerpt":{"rendered":"<p>Apresentamos a seguir o detalhamento da arquitetura de rede que ser\u00e1 implementada ao longo deste guia. A estrutura foi desenhada para que a API opere em uma sub-rede p\u00fablica, com acesso restrito \u00e0 porta da aplica\u00e7\u00e3o, enquanto o banco de dados PostgreSQL permanece protegido e invis\u00edvel em uma sub-rede privada:&#8230;<\/p>\n","protected":false},"author":29,"comment_status":"closed","ping_status":"closed","template":"","format":"standard","meta":{"footnotes":""},"ht-kb-category":[666],"ht-kb-tag":[],"class_list":["post-38818","ht_kb","type-ht_kb","status-publish","format-standard","hentry","ht_kb_category-locaweb-cloud"],"_links":{"self":[{"href":"https:\/\/www.locaweb.com.br\/ajuda\/wp-json\/wp\/v2\/ht-kb\/38818","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.locaweb.com.br\/ajuda\/wp-json\/wp\/v2\/ht-kb"}],"about":[{"href":"https:\/\/www.locaweb.com.br\/ajuda\/wp-json\/wp\/v2\/types\/ht_kb"}],"author":[{"embeddable":true,"href":"https:\/\/www.locaweb.com.br\/ajuda\/wp-json\/wp\/v2\/users\/29"}],"replies":[{"embeddable":true,"href":"https:\/\/www.locaweb.com.br\/ajuda\/wp-json\/wp\/v2\/comments?post=38818"}],"version-history":[{"count":1,"href":"https:\/\/www.locaweb.com.br\/ajuda\/wp-json\/wp\/v2\/ht-kb\/38818\/revisions"}],"predecessor-version":[{"id":38819,"href":"https:\/\/www.locaweb.com.br\/ajuda\/wp-json\/wp\/v2\/ht-kb\/38818\/revisions\/38819"}],"wp:attachment":[{"href":"https:\/\/www.locaweb.com.br\/ajuda\/wp-json\/wp\/v2\/media?parent=38818"}],"wp:term":[{"taxonomy":"ht_kb_category","embeddable":true,"href":"https:\/\/www.locaweb.com.br\/ajuda\/wp-json\/wp\/v2\/ht-kb-category?post=38818"},{"taxonomy":"ht_kb_tag","embeddable":true,"href":"https:\/\/www.locaweb.com.br\/ajuda\/wp-json\/wp\/v2\/ht-kb-tag?post=38818"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}