Production Installation

The supported single-host deployment places stateful services on private networks and exposes only a loopback HTTP gateway to the host TLS proxy.

Deployment sequence

1. Provision a Linux host with Docker Compose, adequate render capacity, persistent storage, and monitored free space.
2. Place the frontend and backend repositories as siblings.
3. Configure deployment-owned production secrets and never commit them.
4. Configure the public HTTPS APP_PUBLIC_URL, SMTP, database, Redis, object storage, Stripe, and only the providers you intend to enable.
5. Configure the host Nginx or equivalent TLS proxy to forward to the loopback gateway.
6. Create a pre-migration PostgreSQL backup.
7. Build the current API, worker, and frontend images.
8. Apply pending migrations.
9. Recreate the services.
10. Verify loopback and public health checks before recording the deployed revisions.

Security requirements

Use independent high-entropy values for MFA/provider encryption, storage-credential encryption, and the token-ledger signature secret. Restrict database, Redis, and object storage from public ingress. Back up both PostgreSQL and private objects.

IMAGE PLACEHOLDER - Production deployment Replace with the actual sanitized production topology, including TLS termination, loopback gateway, private services, persistent volumes, and backup destination. Recommended size: 2000 x 1200 px.

The temporary signed push webhook is an operational bridge, not the intended long-term immutable-release mechanism.