38 lines
1.5 KiB
Markdown
38 lines
1.5 KiB
Markdown
# Production deployment
|
|
|
|
This compose project runs the Search API and its private OpenSearch node. It
|
|
binds the API only to `127.0.0.1`; publish it through an authenticated reverse
|
|
proxy or VPN. OpenSearch is not published outside the compose network.
|
|
|
|
The current compose intentionally disables the OpenSearch security plugin to
|
|
match the existing API client. Keep both services on a private host/network
|
|
until authenticated OpenSearch support is implemented.
|
|
|
|
## First deployment
|
|
|
|
1. Copy this directory to the host with the repository source.
|
|
2. Copy `.env.example` to `.env`, set an absolute `DATA_ROOT`, and replace
|
|
`REVIEW_SECRET` with a random value. Do not commit `.env`.
|
|
3. Put the normalized dataset under `$DATA_ROOT/minjust-normalized/`.
|
|
4. Check the rendered configuration:
|
|
|
|
```bash
|
|
docker compose --env-file .env -f compose.yaml config
|
|
```
|
|
|
|
5. Start the services:
|
|
|
|
```bash
|
|
docker compose --env-file .env -f compose.yaml up -d --build
|
|
docker compose --env-file .env -f compose.yaml ps
|
|
curl -fsS http://127.0.0.1:${BACKEND_PORT:-8080}/review >/dev/null
|
|
```
|
|
|
|
6. Load the versioned index and switch its alias only after the import and
|
|
validation succeed. Back up `DATA_ROOT` and the `opensearch-data` volume
|
|
before the first import.
|
|
|
|
This is a deployment baseline, not a public internet exposure recipe. TLS,
|
|
authentication, backups, monitoring, and a production OpenSearch security
|
|
configuration must be provided by the host reverse proxy/operations setup.
|