Production deployment

Devopsify runs as a private Docker network with a single public HTTPS gateway. PostgreSQL, Redis, API, worker, web, and documentation services do not publish host ports. The gateway is the only service reachable from the internet.

Public surface

Route	Purpose
https://www.devopsify.net	Product and workspace interface
https://www.devopsify.net/docs/	Documentation
https://www.devopsify.net/api/	Authenticated API boundary

devopsify.net permanently redirects to the canonical www.devopsify.net host. Caddy obtains and renews the Let's Encrypt certificate automatically.

Required configuration

Production deployment uses docker-compose.production.yml with a root-only environment file. Required secrets include the PostgreSQL and Redis passwords, JWT_SECRET, ENCRYPTION_KEYS, initial platform-admin credentials, and GEMINI_API_KEY.

docker compose --env-file /opt/devopsify/secrets/production.env -f docker-compose.production.yml up -d --build

The Gemini key is available only to backend services. The AI scope gate rejects unrelated questions before the provider is called. Gemini is never an authorization boundary; tenant authorization, policy checks, and approval gates remain server-side.

Operations

The public health endpoint is available under the API route. healthz reports process liveness and readyz verifies PostgreSQL readiness. A healthy API does not itself prove that the worker is processing jobs; inspect the worker container and BackgroundJobRecord during operations.

Back up the PostgreSQL volume off-host, test restoration regularly, and keep the server firewall limited to SSH, HTTP, and HTTPS. Secrets are injected through the protected environment file and are never baked into images.