1.5 KiB
Customer deployment boundary
The customer deployment is composed from public images and public, schema-only
migration assets. It has no source checkout, no build context, and no Auth
container. The default image registry is git.leee.xin/overcooked and the
default version is latest.
The S control service is exposed on port 18080 and the S WebUI on 18083. E is exposed on 8096. Ports 80 and 443 are not claimed, so an existing edge proxy does not conflict with this deployment.
Generated keys are written only to /opt/overcooked/production.env with mode
600. The installer does not log generated values, activation codes, or Auth
configuration. Failure logs are redacted before display.
Turnstile is optional. Empty site and secret keys disable only that abuse prevention challenge; Auth, license validation, and login policy remain on.
E production control-plane traffic uses mTLS. The installer creates a local
CA and service/client certificates, then generates a minimal HTTPS proxy in the
installation directory and runs it from the approved S WebUI image. The proxy
has no public port and only forwards authenticated /internal/v1/ calls to
S. The approved Media Node image is exported to the node-image archive used by
S node deployment.
The installer must stop on missing prerequisites, invalid public address, occupied ports, failed image verification, failed schema migration, or failed health checks. It must never continue with a partially initialized database.