31 lines
1.2 KiB
Markdown
31 lines
1.2 KiB
Markdown
# TAPM Deployment Access
|
|
|
|
TAPM Deployment Access is a short-lived authorization broker for protected
|
|
deployment packages and installer actions. Technicians authenticate through
|
|
the bundled Gitea service, create deployment codes, and authorize a limited
|
|
number of hosts for selected capabilities.
|
|
|
|
The production layout is a self-contained, single-VM Docker deployment:
|
|
|
|
- Go broker with a persistent embedded SQLite database
|
|
- rootless Gitea with SQLite, repositories, and package registry
|
|
- Nginx reverse proxy for both public domains
|
|
- Certbot and Let's Encrypt HTTP-01 certificate management
|
|
- explicit runtime storage under `config/` beside the Compose files
|
|
|
|
No external database or load balancer is required. The datacenter edge only
|
|
needs to forward TCP 80, 443, and 2222 to the Docker VM.
|
|
|
|
See [docs/deployment.md](docs/deployment.md) for the installation, Gitea setup,
|
|
TLS bootstrap, repository move, renewal, backup, and update procedures. The
|
|
ProxMenu integration contract is in [docs/client-api.md](docs/client-api.md).
|
|
|
|
## Local checks
|
|
|
|
```sh
|
|
GOCACHE=/tmp/tapm-go-cache go test ./...
|
|
docker compose --env-file .env.example config
|
|
docker compose --env-file .env.example -f deploy/gitea/compose.yaml config
|
|
docker build -t tai/tapm-deployment-broker:local .
|
|
```
|