Production hosting

The production stack uses infrastructure/compose.production.yaml and apps/dashboard/Dockerfile.production. The dashboard runs a compiled Next.js production build as the unprivileged Node user. The API and worker use their existing unprivileged runtime images. PostgreSQL and Redis have separate persistent volumes and no host ports. Only the dashboard (127.0.0.1:3000) and API ingress (127.0.0.1:8081) bind on the host. All services restart unless explicitly stopped.

Installed layout

The initial OwnServa installation at ownserva.com uses /opt/ownserva/current, a symlink to its release directory. Root-only /opt/ownserva/.env contains independently generated database passwords, session secret and the two encryption keys. Keep these keys with encrypted off-server backups. Never commit the environment or bootstrap administrator credentials.

Run Compose from the release directory:

docker compose --env-file /opt/ownserva/.env -f infrastructure/compose.production.yaml ps
docker compose --env-file /opt/ownserva/.env -f infrastructure/compose.production.yaml logs --tail=100

Fresh PostgreSQL initialization applies all migrations through 017. Initialization does not upgrade existing databases: take a backup, review and apply outstanding migrations before upgrading an existing volume. Do not remove volumes to upgrade.

Nginx uses infrastructure/nginx-ownserva.conf as a separate virtual host. It proxies the website and account endpoints to Next.js and signed agent, edge and provider webhook paths to Go. Other virtual hosts and services are independent. The account ingress limiter uses the immediate peer IP; behind Cloudflare, configure trusted Cloudflare real-IP ranges before treating it as an individual-client limit. Application-level account limits also remain enabled.

The origin certificate uses Certbot's webroot /var/www/ownserva-acme. Keep the HTTP challenge location reachable. The installed renewal deploy hook tests and reloads Nginx. Set Cloudflare encryption to Full (strict), and keep HTTPS enabled. Add a separate DNS record and certificate before enabling www.ownserva.com.

Administrator and acceptance

Initial setup creates one verified [email protected] identity with super_admin platform role, a generated password and an owner membership in the administration workspace. It refuses to overwrite an existing user database. Bootstrap credentials are stored only in root-readable /opt/ownserva/admin-credentials.json on the VPS and delivered privately to the owner. Administrator login uses the normal /login page; settings contain the legal/policy editor and request queue.

Verify HTTPS, administrator sign-in, /api/backend/me, workspace loading, private admin endpoints, production session cookie flags and rejection of unauthenticated admin requests. Check existing virtual hosts after activation. This is a control-plane deployment; no customer agent or gateway is provisioned automatically.

Initial VPS acceptance passed on 21 October 2026: all five containers started, PostgreSQL initialized through migration 016, the origin certificate validated, public HTTPS returned 200 for home/login/privacy/logo/favicon, administrator and workspace endpoints worked, unauthenticated administrator access returned 401, the session cookie used Secure/HttpOnly/SameSite=Lax and the __Host- prefix, and logout revoked access. Existing Optinet and mail web hosts each still returned 200.

Remaining configuration

SMTP is initially unconfigured. Set SMTP_HOST, SMTP_PORT, SMTP_SECURE, SMTP_USER, SMTP_PASSWORD and EMAIL_FROM in the root-only environment, then recreate the dashboard. Test actual delivery before enabling email-dependent operations. Existing unrelated mail services are not reconfigured by deployment.

Public registration and live checkout require reviewed policies published by the administrator. Merchant checkout, registrar purchases, paid-plan enforcement, external DNS/gateway services and OAuth providers remain disabled or unconfigured. Do not publish invented operational policies to bypass these gates. Follow the compliance review, configure monitored off-server backups and complete live provider acceptance before a public commercial launch.