akyldash/deploy/production

Production deployment

This compose project runs the Search API and its private OpenSearch node. It binds the API only to 127.0.0.1; publish it through an authenticated reverse proxy or VPN. OpenSearch is not published outside the compose network.

The current compose intentionally disables the OpenSearch security plugin to match the existing API client. Keep both services on a private host/network. The application provides cookie-based accounts for its search API and review workspace; it does not replace host-level network controls or TLS.

First deployment

1. Copy this directory to the host with the repository source.

2. Copy .env.example to .env, set an absolute DATA_ROOT, and replace REVIEW_SECRET with a random value. Do not commit .env.

3. Put the normalized dataset under $DATA_ROOT/minjust-normalized/.

4. Check the rendered configuration:

   docker compose --env-file .env -f compose.yaml config
   

5. Start the services:

   docker compose --env-file .env -f compose.yaml up -d --build
   docker compose --env-file .env -f compose.yaml ps
   curl -fsS http://127.0.0.1:${BACKEND_PORT:-8080}/review >/dev/null
   

6. Load the versioned index and switch its alias only after the import and validation succeed. Back up DATA_ROOT and the opensearch-data volume before the first import.

Initial administrator and accounts

After starting the backend for the first time, create the initial admin account with an interactive password prompt:

docker compose --env-file .env -f compose.yaml exec backend python -m search.api --create-admin

The account database is stored at DATA_ROOT/search-users.sqlite3. Back it up alongside the review database. Sign in at /review; admin can create accounts with temporary passwords. Each new account must replace its temporary password at first sign-in. Only the admin login can create, reset, or delete accounts.

If the admin password is lost, reset it in an interactive terminal with:

docker compose --env-file .env -f compose.yaml exec backend python -m search.api --reset-admin-password

The next sign-in requires another password change. Serve the backend behind HTTPS, rate-limit login requests at the reverse proxy, and keep COOKIE_SECURE=true in production.

This is a deployment baseline, not a public internet exposure recipe. TLS, backups, monitoring, and a production OpenSearch security configuration must be provided by the host reverse proxy/operations setup.