deployment.md

Deployment Guide

Local Compose

The default development path is:

docker compose up --build

Compose brings up:

• PostgreSQL
• Redis
• migrator
• platform-api
• mirror-worker
• admin-dashboard
• Nginx
• Prometheus
• Grafana

Important Environment Variables

• POSTGRES_URL
• REDIS_URL
• JWT_SECRET
• PLATFORM_API_PORT
• MAX_PUBLISHES_PER_MINUTE
• MAX_PAYLOAD_BYTES
• MIRROR_POLL_INTERVAL_MS
• ALLOW_INSECURE_TOKEN_ISSUANCE

Production Defaults

For anything beyond local demo use:

• set ALLOW_INSECURE_TOKEN_ISSUANCE=false
• supply a real JWT_SECRET
• run PostgreSQL and Redis as managed services
• place platform-api behind an ingress or managed API gateway
• restrict /docs if you do not want public OpenAPI exposure

Migration Behavior

The one-shot migrate container applies the SQL bootstrap before platform-api or mirror-worker start. This keeps docker compose up zero-touch.

Recommended Next Hardening Steps

• replace bootstrap token issuance with a real identity provider
• add TLS termination and internal service authentication
• add backups and retention policies for PostgreSQL
• add multi-instance worker coordination if mirror polling becomes horizontally scaled