cesnimda
1.3 KiB
deployment
Production runs the frontend/nginx, ASP.NET API, AI sidecar, and configured database through Docker
Compose. The backend is not published directly; nginx proxies /api. deploy/deploy.sh validates
configuration, takes and verifies a provider-appropriate backup before replacement, builds/restarts the
stack, and performs health checks.
Production commands explicitly select docker-compose.yml; it publishes no application ports.
Traefik reaches frontend/nginx over jobtracker_shared, must match the canonical Host exactly, and
must replace X-Forwarded-For and X-Forwarded-Proto. Nginx passes those sanitized values to the
backend over the dedicated WEB_PROXY_SUBNET; nginx also derives its only application server name
from APP_PUBLIC_BASE_URL and rejects unknown Hosts except its liveness endpoint. The backend trusts
only the dedicated CIDR and one forwarded hop. Local development explicitly adds
docker-compose.dev.yml, which publishes ports 3000/5202, uses the localhost origin, and disables
forwarded-header trust.
Each service rotates local Docker logs at 10 MB and retains three files. Add a central sink only if cross-host search or longer retention becomes necessary.
Use deploy/README.md, deploy/first-production-deployment.md, and
docs/deployment/backup-restore.md as the operational runbooks.