TAPM Deployment Access is a short-lived authorization broker for protected deployment packages and installer actions. Technicians authenticate through the bundled Gitea service, create deployment codes, and authorize a limited number of hosts for selected capabilities.

The production layout is a self-contained, single-VM Docker deployment:

Go broker with a persistent embedded SQLite database
rootless Gitea with SQLite, repositories, and package registry
Nginx reverse proxy for both public domains
Certbot and Let's Encrypt HTTP-01 certificate management
explicit runtime storage under config/ beside the Compose files

No external database or load balancer is required. The datacenter edge only needs to forward TCP 80, 443, and 2222 to the Docker VM.

See docs/deployment.md for the installation, Gitea setup, TLS bootstrap, repository move, renewal, backup, and update procedures. The ProxMenu integration contract is in docs/client-api.md.

Local checks

GOCACHE=/tmp/tapm-go-cache go test ./...
docker compose --env-file .env.example config
docker compose --env-file .env.example -f deploy/gitea/compose.yaml config
docker build -t tai/tapm-deployment-broker:local .