Production Boundaries
The checked-in self-hosted Compose file is an evaluation deployment. Do not promote it to production by adding a certificate and assuming the remaining control plane exists.
Why the Evaluation Stack Is Not Production-Ready
- the backend is privileged and directly connected to host libvirt;
- the default listener is HTTP on port 80;
- the topology is one host and two containers;
- no production identity or tenant boundary is established by the Compose file;
- state spans host libvirt resources, host image directories, and a Docker named volume;
- backup, restore, alerting, log export, capacity management, and updates are operator procedures rather than integrated services;
- hosted builds, conversations, scheduling, and policy documents are disabled in self-hosted mode.
Required Production Decisions
Before real users or sensitive data are in scope, an accountable deployment owner must approve and test:
| Area | Required evidence |
|---|---|
| Identity and authorization | Named roles, denied-path tests, administrator recovery, and session policy |
| Network | TLS, trusted proxy chain, firewall rules, guest isolation, and management-plane exposure |
| Secrets | Storage, rotation, revocation, break-glass access, and audit trail |
| Persistence | Complete data inventory, retention, off-host backup, restore test, and deletion procedure |
| Hypervisor safety | Resource limits, image provenance, guest/network isolation, and host recovery |
| Operations | Health checks, alerts, logs, capacity thresholds, incident response, and support ownership |
| Change management | Versioned release, migration, rollback, compatibility test, and maintenance window |
| Licensing and privacy | Rights for images and packages plus documented data flows and retention |
Backups and Restore
A meaningful backup must account for the Docker named volume, uploaded images, promoted source artifacts, relevant libvirt domain/network state, and any external logs. Copying only one of these is not a restore plan. Quiesce mutable state or use a documented consistency mechanism, restore into an isolated host, and repeat an end-to-end VM lifecycle test.
Air-Gapped Claims
The public Compose file is not evidence of air-gapped operation. Offline use requires a complete dependency inventory, approved transfer and signature verification, local image/package sources, license handling, time and identity dependencies, update and revocation paths, log export, and a tested recovery procedure. Describe a deployment as air-gapped only after that exact release and topology have been qualified.
Contact OpenFactory for a private deployment design and release-specific runbook. Until then, keep this Compose path on a disposable, trusted evaluation network.