# FlashOps production deployment

- Domain: `flashops.imagebrewing.com`
- App root: `/data/wangzhan/app/storage-labos`
- Backend bind: `127.0.0.1:18080`
- Process manager: `systemd` unit `flashops.service`
- Reverse proxy: Baota Nginx vhost `flashops.imagebrewing.com.conf`
- Persistent data: `/data/wangzhan/app/storage-labos/flashops/var`
- Private environment file: `/etc/flashops/flashops.env`

The service deliberately uses one worker because the current production store is
SQLite. The current preview console is anonymously readable and writable through
Nginx; do not connect real hardware or production data until application RBAC and
approval gates are implemented. The ACME challenge path remains available so
certificate renewal can complete.

Before enabling Agent enrollment, create the environment file without putting
the secret in the repository or unit:

```bash
sudo install -d -o root -g root -m 0755 /etc/flashops
sudo install -o root -g root -m 0600 /dev/null /etc/flashops/flashops.env
sudoedit /etc/flashops/flashops.env
```

Add `FLASHOPS_AGENT_ENROLLMENT_TOKEN=<random secret>`, then restart the service.

Useful checks:

```bash
sudo systemctl status flashops
curl http://127.0.0.1:18080/api/v1/health
sudo nginx -t
sudo certbot renew --dry-run
```