# Deployment

## Environments

- development
- test/CI
- production

## Docker Compose

Baseline services:
- frontend
- API
- worker
- PostgreSQL
- Redis
- reverse proxy

Persistent data:
- PostgreSQL data
- Redis data where needed
- image storage

## Production Compose

The repository includes `compose.production.yaml` with separate API, worker,
web, PostgreSQL, and Redis services. It exposes only the Nginx web service and
keeps database and Redis ports internal to the Compose network.

Before starting, create a production `.env` containing real values for
`POSTGRES_DB`, `POSTGRES_USER`, `POSTGRES_PASSWORD`, `DATABASE_URL`,
`REDIS_URL`, `SMTP_URL`, `SMTP_FROM`, and a stable base64-encoded 32-byte
`MFA_ENCRYPTION_KEY`. Do not use the fixture pricing provider in production.

Start the stack and apply migrations with:

```sh
docker compose -f compose.production.yaml up -d --build postgres redis
docker compose -f compose.production.yaml run --rm api npm run db:migrate
docker compose -f compose.production.yaml up -d --build api worker web
```

The default web port is `8080` and can be changed with `WEB_PORT`. The API and
worker images share the same Node workspace image; the web image builds the Vue
application and serves it through Nginx with SPA fallback and internal `/api`
proxying.

## Reverse proxy

Responsible for:
- HTTPS/TLS
- routing
- compression
- security headers
- rate limiting where appropriate

## Configuration

Environment variables/secrets:
- database connection
- Redis connection
- authentication/session secrets
- provider credentials
- email credentials
- storage credentials

Application settings such as pricing strategy and site settings belong in the database.

## Backups

Back up:
- PostgreSQL
- image storage
- required environment/configuration information

Retention policy and restore procedures must be documented for production.

Disaster recovery should allow reconstruction elsewhere from database backup, image backup, and deployment/environment configuration.

## Future hosting

Initial deployment targets a home server/NAS. The architecture should allow later movement to an online server or managed infrastructure without redesigning the domain model.