OverCooked-Installer/DEPLOYMENT.md

Customer deployment boundary

The customer deployment is composed from public images and public, schema-only migration assets. It has no source checkout, no build context, and no Auth container. The default image registry is git.leee.xin/overcooked and the default version is latest.

The S control service is exposed on port 18080 and the S WebUI on 18083. E is exposed on 8096. Ports 80 and 443 are not claimed, so an existing edge proxy does not conflict with this deployment.

Generated keys are written only to /opt/overcooked/production.env with mode 600. The installer does not log generated values, activation codes, or Auth configuration. Failure logs are redacted before display.

Turnstile is optional. Empty site and secret keys disable only that abuse prevention challenge; Auth, license validation, and login policy remain on.

E production control-plane traffic uses mTLS. The installer creates a local CA and service/client certificates, then generates a minimal HTTPS proxy in the installation directory and runs it from the approved S WebUI image. The proxy has no public port and only forwards authenticated /internal/v1/ calls to S. The approved Media Node image is exported to the node-image archive used by S node deployment.

The installer must stop on missing prerequisites, invalid public address, occupied ports, failed image verification, failed schema migration, or failed health checks. It must never continue with a partially initialized database.

PostgreSQL initialization and retries use the fixed application roles product_e and product_s. Credentials are generated once and then read back from production.env; a password mismatch is fail-closed. The installer never logs in as postgres, changes a role password, removes volumes by default, or silently continues after a database error. E's failed volume can only be removed with OVERCOOKED_RESET_FAILED_INSTALL=1 plus OVERCOOKED_CONFIRM_NO_BUSINESS_DATA=YES; S database mismatches always require manual recovery.