akyldash/deploy/production

Production deployment

This compose project runs the Search API and its private OpenSearch node. It binds the API only to 127.0.0.1; publish it through an authenticated reverse proxy or VPN. OpenSearch is not published outside the compose network.

The current compose intentionally disables the OpenSearch security plugin to match the existing API client. Keep both services on a private host/network until authenticated OpenSearch support is implemented.

First deployment

1. Copy this directory to the host with the repository source.

2. Copy .env.example to .env, set an absolute DATA_ROOT, and replace REVIEW_SECRET with a random value. Do not commit .env.

3. Put the normalized dataset under $DATA_ROOT/minjust-normalized/.

4. Check the rendered configuration:

   docker compose --env-file .env -f compose.yaml config
   

5. Start the services:

   docker compose --env-file .env -f compose.yaml up -d --build
   docker compose --env-file .env -f compose.yaml ps
   curl -fsS http://127.0.0.1:${BACKEND_PORT:-8080}/review >/dev/null
   

6. Load the versioned index and switch its alias only after the import and validation succeed. Back up DATA_ROOT and the opensearch-data volume before the first import.

This is a deployment baseline, not a public internet exposure recipe. TLS, authentication, backups, monitoring, and a production OpenSearch security configuration must be provided by the host reverse proxy/operations setup.