akyldash/docs/operations/INFRASTRUCTURE.md

Infrastructure

Intended layout

Production is planned for the dedicated Ubuntu VPS at 206.223.249.118. deploy/production/compose.yaml defines Caddy, a Python Search API, and private OpenSearch 3.7. Caddy terminates HTTPS for akyldash.kg and proxies to the API. The API is reachable only on private Compose networks; OpenSearch is reachable only by the backend. Cloudflare should use Full (strict) only after the origin certificate and DNS path are verified.

The API stores its account and review SQLite files beside the normalized corpus under the persistent data directory. OpenSearch and Caddy use named volumes. The API's review signing key is mounted from a host file; it is not passed in process arguments or committed to Git. Docker logs are bounded to 10 MiB per file and three files per service.

Actual state

The 2026-10-11 read-only audit found a fresh Ubuntu 24.04.5 host with SSH only. Docker, Git, a reverse proxy, application directories, Compose services, TLS, and backups are not installed/configured. The codex account has no non-interactive sudo. See CURRENT_STATE.md and the production inventory.

The Compose file is a repository target, not proof of deployment. The Caddy image is pinned by digest, while backend and OpenSearch still build locally; immutable registry images and automated deploy are not configured. No migration framework exists. The application uses SQLite and OpenSearch; SMTP registration/recovery is not implemented.

Repository paths and target host paths

• Compose and Dockerfiles: deploy/production/.
• Host checkout target: /opt/akyldash/current.
• Environment configuration: /etc/akyldash/production.env.
• Secret file: /etc/akyldash/review_secret, mode 0600.
• Application data: /var/lib/akyldash/data.
• Intended backups: /var/backups/akyldash.

All host paths above are targets; none existed at audit time. Root bootstrap is prepared at bootstrap-ubuntu-24.04.sh. It does not edit SSH or firewall configuration, create credentials, deploy the application, or grant codex Docker/root access.

Network and operations

Target public TCP listeners are SSH 22 and Caddy 80/443. Backend 8080 and OpenSearch 9200 must remain private to Compose. The firewall state could not be independently verified because the SSH account has no sudo; do not change it without owner approval. The domain resolves to Cloudflare edge addresses, but HTTP and HTTPS return 521, so the origin is unreachable. Cloudflare origin mode, certificate validity, and production health have not been verified.

Use DEPLOYMENT.md, BACKUP.md, ROLLBACK.md, and RECOVERY.md for operational limits and procedures. Configuration changes must go through Git and review; do not reconcile a Git/server difference by overwriting the VPS automatically.