# Despliegue Cloud — TradingBinance Platform

## AWS (Recomendado)

### Arquitectura de producción

```
Internet → Route 53 → ALB (HTTPS) → ECS Fargate (API + Workers)
                                  → RDS PostgreSQL
                                  → ElastiCache Redis
                                  → Secrets Manager (Binance keys)
                                  → CloudWatch (logs + alarmas)
                                  → SES (email)
```

### Paso 1: Preparar infraestructura

```bash
# Crear VPC, subnets, security groups
aws ec2 create-vpc --cidr-block 10.0.0.0/16

# RDS PostgreSQL
aws rds create-db-instance \
  --db-instance-identifier tradingbinance-db \
  --db-instance-class db.t3.medium \
  --engine postgres \
  --engine-version 15 \
  --master-username trading \
  --master-user-password <SECURE_PASSWORD> \
  --allocated-storage 50

# ElastiCache Redis
aws elasticache create-cache-cluster \
  --cache-cluster-id tradingbinance-redis \
  --engine redis \
  --cache-node-type cache.t3.micro \
  --num-cache-nodes 1
```

### Paso 2: Secretos

```bash
aws secretsmanager create-secret \
  --name tradingbinance/prod \
  --secret-string '{
    "SECRET_KEY":"<random-64-chars>",
    "BINANCE_API_KEY":"<key>",
    "BINANCE_API_SECRET":"<secret>",
    "DATABASE_URL":"postgresql+asyncpg://...",
    "REDIS_URL":"redis://..."
  }'
```

### Paso 3: ECS Task Definitions

Crear 4 servicios ECS:
- `tradingbinance-api` — FastAPI (puerto 8000)
- `tradingbinance-worker-market` — Celery market worker
- `tradingbinance-worker-strategy` — Celery strategy worker
- `tradingbinance-worker-orders` — Celery order worker
- `tradingbinance-celery-beat` — Scheduler

### Paso 4: CI/CD con GitHub Actions

El pipeline en `.github/workflows/ci.yml` ejecuta tests. Para deploy:

```yaml
# Agregar job deploy en ci.yml
deploy:
  needs: [test-backend]
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v4
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        aws-region: us-east-1
    - run: |
        aws ecr get-login-password | docker login --username AWS --password-stdin $ECR_REGISTRY
        docker build -t tradingbinance-api ./backend
        docker tag tradingbinance-api:latest $ECR_REGISTRY/tradingbinance-api:latest
        docker push $ECR_REGISTRY/tradingbinance-api:latest
        aws ecs update-service --cluster tradingbinance --service api --force-new-deployment
```

### Paso 5: Alarmas CloudWatch

| Alarma | Métrica | Umbral |
|--------|---------|--------|
| DailyLossExceeded | custom.daily_loss_pct | > 2.5% |
| BinanceDisconnected | custom.binance_connected | = 0 por 60s |
| HighErrorRate | custom.api_errors | > 10 en 5 min |
| EmergencyStopActive | custom.emergency_stop | = 1 |

## Azure (Alternativa)

- **AKS** para contenedores
- **Azure Database for PostgreSQL**
- **Azure Cache for Redis**
- **Azure Key Vault** para secretos
- **Azure Monitor** para observabilidad

## Google Cloud (Alternativa)

- **GKE** para contenedores
- **Cloud SQL PostgreSQL**
- **Memorystore Redis**
- **Secret Manager**
- **Cloud Monitoring + Alerting**

## Checklist pre-producción

- [ ] Backtesting positivo vs buy-and-hold
- [ ] Paper trading ≥ 30 días
- [ ] API keys con permisos mínimos (sin retiros)
- [ ] Secretos en vault cloud, no en código
- [ ] HTTPS configurado
- [ ] Alarmas activas
- [ ] Kill switch probado
- [ ] Backup automático de PostgreSQL
- [ ] Activación manual de producción por admin

## Escalar

| Carga | Acción |
|-------|--------|
| Más símbolos | Agregar workers Celery |
| Más estrategias | Escalar worker-strategy |
| Alta frecuencia | Redis cluster, particionar candles |
| Multi-región | Read replicas PostgreSQL |