38 lines
2.0 KiB
Markdown
38 lines
2.0 KiB
Markdown
# Customer deployment boundary
|
|
|
|
The customer deployment is composed from public images and public, schema-only
|
|
migration assets. It has no source checkout, no build context, and no Auth
|
|
container. The default image registry is `git.leee.xin/overcooked` and the
|
|
default version is `latest`.
|
|
|
|
The S control service is exposed on port 18080 and the S WebUI on 18083. E is
|
|
exposed on 8096. Ports 80 and 443 are not claimed, so an existing edge proxy
|
|
does not conflict with this deployment.
|
|
|
|
Generated keys are written only to `/opt/overcooked/production.env` with mode
|
|
600. The installer does not log generated values, activation codes, or Auth
|
|
configuration. Failure logs are redacted before display.
|
|
|
|
Turnstile is optional. Empty site and secret keys disable only that abuse
|
|
prevention challenge; Auth, license validation, and login policy remain on.
|
|
|
|
E production control-plane traffic uses mTLS. The installer creates a local
|
|
CA and service/client certificates, then generates a minimal HTTPS proxy in the
|
|
installation directory and runs it from the approved S WebUI image. The proxy
|
|
has no public port and only forwards authenticated `/internal/v1/` calls to
|
|
S. The approved Media Node image is exported to the node-image archive used by
|
|
S node deployment.
|
|
|
|
The installer must stop on missing prerequisites, invalid public address,
|
|
occupied ports, failed image verification, failed schema migration, or failed
|
|
health checks. It must never continue with a partially initialized database.
|
|
|
|
PostgreSQL initialization and retries use the fixed application roles
|
|
`product_e` and `product_s`. Credentials are generated once and then read back
|
|
from `production.env`; a password mismatch is fail-closed. The installer never
|
|
logs in as `postgres`, changes a role password, removes volumes by default, or
|
|
silently continues after a database error. E's failed volume can only be
|
|
removed with `OVERCOOKED_RESET_FAILED_INSTALL=1` plus
|
|
`OVERCOOKED_CONFIRM_NO_BUSINESS_DATA=YES`; S database mismatches always require
|
|
manual recovery.
|