# Customer deployment boundary

The customer deployment is composed from public images and public, schema-only
migration assets. It has no source checkout, no build context, and no Auth
container. The default image registry is `git.leee.xin/overcooked` and the
default version is `latest`.

The S control service is exposed on port 18080 and the S WebUI on 18083. E is
exposed on 8096. Ports 80 and 443 are not claimed, so an existing edge proxy
does not conflict with this deployment.

Generated keys are written only to `/opt/overcooked/production.env` with mode
600. The installer does not log generated values, activation codes, or Auth
configuration. Failure logs are redacted before display.

Turnstile is optional. Empty site and secret keys disable only that abuse
prevention challenge; Auth, license validation, and login policy remain on.

E production control-plane traffic uses mTLS. The installer creates a local
CA and service/client certificates, then generates a minimal HTTPS proxy in the
installation directory and runs it from the approved S WebUI image. The proxy
has no public port and only forwards authenticated `/internal/v1/` calls to
S. The approved Media Node image is exported to the node-image archive used by
S node deployment.

The installer must stop on missing prerequisites, invalid public address,
occupied ports, failed image verification, failed schema migration, or failed
health checks. It must never continue with a partially initialized database.

PostgreSQL initialization and retries use the fixed application roles
`product_e` and `product_s`. Credentials are generated once and then read back
from `production.env`; a password mismatch is fail-closed. The installer never
logs in as `postgres`, changes a role password, removes volumes by default, or
silently continues after a database error. E's failed volume can only be
removed with `OVERCOOKED_RESET_FAILED_INSTALL=1` plus
`OVERCOOKED_CONFIRM_NO_BUSINESS_DATA=YES`; S database mismatches always require
manual recovery.