# deploy/

Holds the **live secrets** (`deploy/.env`) and one-command scripts to build and run the stack against them. `deploy/.env` is git-ignored — it is never committed.

## deploy/.env

Required keys (see `../.env.example` for the template):

```
POSTGRES_PASSWORD=...
GOOGLE_CLIENT_ID=...
GOOGLE_CLIENT_SECRET=...
AI_MODE=Disabled            # Disabled | LocalOllama | CloudOpenAi
FRONTEND_ORIGIN=http://localhost:8081
```

## Commands

Windows (PowerShell), from the repo root:

```powershell
./deploy/up.ps1               # build + start (detached)
./deploy/up.ps1 -Foreground   # stream logs instead of detaching
./deploy/up.ps1 -Proxy        # also run the top-level nginx (everything on :80)
./deploy/logs.ps1 api         # tail a service's logs
./deploy/down.ps1             # stop
./deploy/down.ps1 -Volumes    # stop and wipe the DB + key volumes
```

Linux / Ubuntu production target:

```bash
./deploy/up.sh                # build + start (detached)
./deploy/up.sh --foreground
./deploy/up.sh --proxy
```

Both scripts validate that `deploy/.env` exists and that the required keys are non-blank before invoking Docker, so a misconfigured env fails fast with a clear message instead of a half-started stack.

## What it runs

`docker compose --env-file deploy/.env up --build` — Postgres, the API (auto-applies EF migrations on boot), and the frontend. The `--env-file` flag feeds the `${...}` variables in `docker-compose.yml`.

After it's up:
- Frontend — http://localhost:8081
- API / Swagger — http://localhost:8080/swagger

Reminder: the Google OAuth redirect URI for this layout is `http://localhost:8081/signin-google` (see `../docs/GOOGLE_OAUTH_SETUP.md`).