Межі production
Checked-in self-hosted Compose file is evaluation deployment. Do not promote to production by adding certificate and assuming remaining control plane exists.
Why evaluation stack is not production-ready
- backend is privileged and directly connected to host libvirt;
- default listener is HTTP on port 80;
- topology is one host and two containers;
- no production identity or tenant boundary established by Compose file;
- state spans host libvirt resources, host image directories, and Docker named volume;
- backup, restore, alerting, log export, capacity management, and updates are operator procedures rather than integrated services;
- hosted builds, conversations, scheduling, and policy documents disabled in self-hosted mode.
Required production decisions
Before real users or sensitive data in scope, accountable deployment owner must approve and test:
| Area | Required evidence |
|---|---|
| Identity and authorization | Named roles, denied-path tests, administrator recovery, and session policy |
| Network | TLS, trusted proxy chain, firewall rules, guest isolation, and management-plane exposure |
| Secrets | Storage, rotation, revocation, break-glass access, and audit trail |
| Persistence | Complete data inventory, retention, off-host backup, restore test, and deletion procedure |
| Hypervisor safety | Resource limits, image provenance, guest/network isolation, and host recovery |
| Operations | Health checks, alerts, logs, capacity thresholds, incident response, and support ownership |
| Change management | Versioned release, migration, rollback, compatibility test, and maintenance window |
| Licensing and privacy | Rights for images and packages plus documented data flows and retention |
Backups and restore
Meaningful backup must account for Docker named volume, uploaded images, promoted source artifacts, relevant libvirt domain/network state, and any external logs. Copying only one is not restore plan. Quiesce mutable state or use documented consistency mechanism, restore into isolated host, and repeat end-to-end VM lifecycle test.
Air-gapped claims
Public Compose file is not evidence of air-gapped operation. Offline use requires complete dependency inventory, approved transfer and signature verification, local image/package sources, license handling, time and identity dependencies, update and revocation paths, log export, and tested recovery procedure. Describe deployment as air-gapped only after that exact release and topology qualified.
Contact OpenFactory for private deployment design and release-specific runbook. Until then keep Compose path on disposable, trusted evaluation network.