protuberanets
f436b2528c
Two nodes on exch and one on infra-gamma, plain Compose per server, ports on the private addresses only. Nodes unseal through the transit seal on the platform Vault; the transit token reaches only the server process. make prod-images resolves the latest stable Vault release once and pins its digest in ignored .local/prod/images.env, so every node runs the same build. infra/prod/README.md records the layout, the first rollout, node replacement and recovery when the platform Vault is lost (#74).
Infrastructure
Run make build && make up from the repository root. Local tooling needs Make,
POSIX shell and Docker Compose/BuildKit; all other tools run in Docker.
images/: reusable Docker build definitions for product images and tooling.local/compose.yml: isolated local stack and persistent volumes.local/bff/,local/notifications/: application runtime configuration.local/frontend/: Caddy configuration for Flutter files, browser HTTPS and API proxying.local/vault/: server startup/configuration and per-service Agent templates.local/mongo/,local/nats/: infrastructure startup and Mongo provisioning checks.local/scripts/: bootstrap, migration, release resolution and verification.local/tools.sh: host entry point used by Make.
Local generated pins, identities and administrator material remain under ignored
.local/dev/; they are never build inputs. Application source remains under
backend/ and frontend/.
See local development for Vault paths, commands, Caddy trust, persistence and migration details.