# deployment

Production runs the frontend/nginx, ASP.NET API, AI sidecar, and configured database through Docker
Compose. The backend is not published directly; nginx proxies `/api`. `deploy/deploy.sh` validates
configuration, takes and verifies a provider-appropriate backup before replacement, builds/restarts the
stack, and performs health checks. The protected production workflow explicitly rebuilds the AI sidecar
so application and AI contracts always come from the same tested commit.

Production commands explicitly select `docker-compose.yml`. The operator-owned reverse proxy still
targets frontend/nginx through compatibility port 3000; the host firewall blocks direct external access.
Traefik must match the canonical Host exactly and
must replace `X-Forwarded-For` and `X-Forwarded-Proto`. Nginx passes those sanitized values to the
backend over the dedicated `WEB_PROXY_SUBNET`; nginx also derives its only application server name
from `APP_PUBLIC_BASE_URL` and rejects unknown Hosts except its liveness endpoint. The backend trusts
only the dedicated CIDR and one forwarded hop. Local development explicitly adds
`docker-compose.dev.yml`, which publishes ports 3000/5202, uses the localhost origin, and disables
forwarded-header trust.

Each service rotates local Docker logs at 10 MB and retains three files. Add a central sink only if
cross-host search or longer retention becomes necessary.

Use `deploy/README.md`, `deploy/first-production-deployment.md`, and
`docs/deployment/backup-restore.md` as the operational runbooks.
