Operations

Deployment shape

• Single-machine docker compose; the default compose command produces the production build (nginx serving the compiled frontend, a minimal backend binary image).
• PostgreSQL is the database; the schema is fully defined by a single baseline migration, with zero auto-migration at startup — an unrecognized existing schema version refuses to start rather than pressing on.
• The current design assumes a single backend instance; multi-replica / HA deployment is not yet supported.
• TLS terminates at your external ingress (reverse proxy); the application keeps a TLS-ready contract and ships a working example.

Hardened defaults

These floors are built into the deployment flow and cannot be switched off:

• No built-in public bootstrap credential; the initial admin password is set by the deployer and force-changed at first login.
• A production build refuses to start if the JWT secret is still the built-in development default (or too short); quickstart.sh generates a fresh value automatically.
• Sensitive data at rest uses KEK / DEK envelope encryption, with a key inventory, rotation governance, and a KEK switchover state machine.

Backup

Application data (audit records, recordings, database) lives under the single directory root set by DATA_PATH — the backup scope collapses to that directory plus .env (including key configuration). Detailed backup and restore procedures, upgrade steps, and rotation of the platform’s own privileged credentials are documented in the four operational runbooks under docs/ops/ in the main repository.

The operational prerequisite for audit integrity

The evidence chain’s checkpoints anchor off-host via syslog — for that to mean anything, an off-host syslog collector is required: if audit data and its integrity anchors live on the same machine, “the machine’s administrator tampers and smooths it over” returns to the undetectable range. Plan for an independent syslog destination (a SIEM, or a minimal syslog server).

Know the boundary too: external syslog is a supplementary copy, not a replacement for the primary audit store; a dead syslog destination never blocks connections — events flow through a bounded buffer, and overflow raises an audit failure alert.

Observability

GET /metrics exposes operational metrics in Prometheus format (deliberately outside /api, so it is not exposed externally with zero configuration); recording storage usage is visible. Three classes of audit events can also be forwarded to an external SIEM via RFC 5424 syslog.

Retention and deletion

Audit data follows a retention policy; expired data is deleted in batches by checkpoint interval, the deletion itself is audited, and a tombstone remains — distinguishable from malicious deletion.