Deploying the platform

The platform runs on one small Linux VPS. Managed projects are not moved onto that machine.

DNS

In Cloudflare, create proxied records after the origin certificate exists:

Name	Type	Value
finluth.com	A	VPS address
www	CNAME	finluth.com
app	A	VPS address
docs	A	VPS address

Start with the records set to DNS only so Caddy can complete the HTTP challenge. After HTTPS works, turn the proxy on and set SSL/TLS to Full (strict).

Postgres is bound to 127.0.0.1:5432 on the VPS for SSH-tunneled administration. Do not bind it to a public interface or open port 5432 in the firewall. The firewall should allow 22 (keys only), 80, and 443.

Server

git clone <this-repo> /opt/finluth
cd /opt/finluth
cp .env.example .env
# Fill AUTH_SECRET, APP_MASTER_KEY, POSTGRES_PASSWORD, BOOTSTRAP_EMAIL, BOOTSTRAP_PASSWORD
# APP_URL=https://app.finluth.com
# APEX_URL=https://finluth.com
# APEX_HOSTS=finluth.com,www.finluth.com
chmod 600 .env
sh deploy/deploy.sh

The deployment script runs Docker Compose and builds the dashboard from the code currently checked out in /opt/finluth. It does not fetch or change Git state.

To deploy newer code, update the checkout and rebuild:

cd /opt/finluth
git pull --ff-only
sh deploy/deploy.sh

The script leaves the Git checkout as it is. Keep server configuration in .env.

This Caddyfile also terminates TLS for sibling hosts on the shared deploy_default network, including git.finluth.com, guild.finluth.com, nightlink.finluth.com, finspot.finluth.com, and docs.finluth.com.

Backups

deploy/backup.sh dumps Postgres, gzip-compresses it, and encrypts it with BACKUP_PASSPHRASE. Set BACKUP_SCP_TARGET or BACKUP_RCLONE_REMOTE so the file leaves the VPS. A disk snapshot of the same machine is not a backup.

Schedule it daily as root or the deploy user, for example:

15 3 * * * cd /opt/finluth && BACKUP_PASSPHRASE=... POSTGRES_PASSWORD=... sh deploy/backup.sh

Prefer reading those values from a root-only env file rather than putting them in the crontab.

Restore is openssl enc -d -aes-256-cbc -pbkdf2 -pass env:BACKUP_PASSPHRASE, then gunzip, then psql into a new database. Practice that once before you need it.

What this host must not do

It should not be the only copy of a managed application's database. Finspot, and anything after it, keep their own servers and databases. This VPS is the control plane.