Deployment and runtime

The recorded production stack runs the web, API, PostgreSQL, Redis, and optional Telegram bot under Compose project raidz. Nginx terminates TLS and proxies the loopback-only web origin.

Runtime topology

Service	Exposure	Health
Web	Host loopback `127.0.0.1:3300` behind Nginx	`/api/health` through Next.js
API	Private Compose network, port `4000`	`/ready` checks PostgreSQL
PostgreSQL	Private Compose network, port `5432`	`pg_isready`
Redis	Private Compose network, port `6379`	`redis-cli ping`
Telegram bot	Optional `integrations` profile	Process/container state; add active update-lag monitoring before scale
ClickHouse	Optional `analytics` profile	Container health is not yet defined in Compose

Secret delivery

Production secrets are mounted read-only from protected host storage and referenced with *_FILE variables. The API secret loader prefers a non-empty direct environment value, then reads the file path. Production Compose overlays direct values with file variables for encryption key, identity pepper, X credentials, Telegram token, and operational wallet.

Do not run docker compose config in a way that exposes direct secret values. Do not inspect, copy, or log wallet or credential files. Wallet material belongs only in the protected vault or an external signer.

Build and start

Validate the exact project and environment file first. The recorded production form is:

docker compose \
  -p raidz \
  --env-file /wallets/raidz/runtime.env \
  -f compose.yaml \
  -f compose.runtime.yaml \
  --profile integrations \
  up -d --build

For a release that uses prebuilt images, use --no-build only after verifying the expected image digests. Never operate the default Compose project implicitly in production.

Verification

docker compose -p raidz -f compose.yaml -f compose.runtime.yaml ps
curl --fail --silent --show-error https://raidz.fun/api/health
curl --fail --silent --show-error https://app.raidz.fun/api/health

Also verify HTTPS redirects, certificate names/expiry, security headers, the application host split, API readiness from inside the project network, bot identity, and expected database schema. A healthy web route does not prove OAuth, wallet, bot, or settlement behavior.

Release sequence

Record scope, commit, image digests, database change, public claims, and rollback target.
Run npm run check, contract tests when relevant, security checks, and Compose validation.
Build reproducibly without embedding secrets.
Apply migrations with a tested backup/recovery path.
Deploy the smallest service set.
Verify from origin, edge, and user-facing host.
Exercise changed behavior with disposable/non-value state.
Record an attributable deployment receipt.

Rollback

Redeploy the recorded prior image digests. To withdraw public ingress, remove/disable only the Raidz Nginx site and reload after syntax validation. Preserve PostgreSQL and Redis named volumes unless an explicit, separately reviewed data recovery plan requires otherwise.

Rollback does not undo a blockchain transaction or external account mutation. Reconcile those systems independently and publish corrections where necessary.