Deployment

Deploy one edition as one API plus one PostgreSQL database and one static Angular frontend. Use a managed database or a backed-up volume. Start with a single instance; distributed scheduling and horizontal scale are outside this kit's V1.

Build reproducible artifacts from a reviewed commit with locked frontend dependencies. Run tests before pushing images.
Supply a fresh JWT secret and database password through your platform's secret mechanism. Set the exact HTTPS APP_ORIGIN, COOKIE_SECURE=true, and disable bootstrap seed.
Put the UI and /api behind one TLS origin. Keep upstream forwarding controlled; do not trust arbitrary client-supplied proxy headers.
Expose only intended public API routes and minimal health. Restrict or disable Swagger and development database/mail ports as needed for your environment.
Back up the database and test restoring it. Apply Flyway migrations once as part of the rollout; check compatibility before rolling back application code.
Configure logs, availability checks and alerts. Keep sensitive request bodies, tokens and reset links out of logs.
Verify real registration, login, refresh, owner isolation and logout on the deployed origin. Test SMTP delivery separately. Stripe remains test mode.

Before collecting personal data, finalize your privacy disclosures, retention and deletion procedures. Before taking payments, review terms, licensing, refund handling and applicable consumer requirements with a qualified reviewer. This document is an implementation checklist, not legal advice or proof of compliance.

There is no hosted service or production deployment included. See launch readiness for the commercial site's separate activation requirements.