Deployment¶

Running Record Store somewhere real.

Container Images — the published images, tags, and digest pinning
Docker Compose — the server on its own, and with the console
Coolify — end-to-end on a Coolify server
Reverse Proxy and TLS — what to expose and what to keep private
Persistent Storage — the data directory and its requirements
Production Checklist — before you take traffic
Upgrading — moving to a new version safely
Verifying a Release — checksums, digests, SBOMs, and what is not signed

The shape of a deployment¶

flowchart TB
    subgraph public [Public]
        S["S3 API :7600<br/>applications, embeds"]
        C["Console :7602<br/>administrators, share links"]
    end
    subgraph private [Private]
        M["Management API :7601<br/>CLI, console backend, metrics"]
    end
    C --> M

The single most important deployment decision: 7600 and 7602 may face the internet; 7601 must not. The management API is unrestricted administrative access. See Ports.

Before you start¶

Have these ready:

A data directory on durable storage, backed up
Root credentials, a credential master key, and a management system token
A plan for TLS in front of the public ports
Somewhere to keep the master key that is not the data directory

The master key cannot be rotated. Losing it means losing every stored credential and, if encryption is enabled, every object. Back it up first, not later.