storage-labos/flashops/deploy/README.md

FlashOps production deployment

• Domain: flashops.imagebrewing.com
• App root: /data/wangzhan/app/storage-labos
• Backend bind: 127.0.0.1:18080
• Process manager: systemd unit flashops.service
• Reverse proxy: Baota Nginx vhost flashops.imagebrewing.com.conf
• Persistent data: /data/wangzhan/app/storage-labos/flashops/var
• Private environment file: /etc/flashops/flashops.env

The service deliberately uses one worker because the current production store is SQLite. The current preview console is anonymously readable and writable through Nginx; do not connect real hardware or production data until application RBAC and approval gates are implemented. The ACME challenge path remains available so certificate renewal can complete.

Before enabling Agent enrollment, create the environment file without putting the secret in the repository or unit:

sudo install -d -o root -g root -m 0755 /etc/flashops
sudo install -o root -g root -m 0600 /dev/null /etc/flashops/flashops.env
sudoedit /etc/flashops/flashops.env

Add FLASHOPS_AGENT_ENROLLMENT_TOKEN=<random secret>, then restart the service.

Useful checks:

sudo systemctl status flashops
curl http://127.0.0.1:18080/api/v1/health
sudo nginx -t
sudo certbot renew --dry-run