Deployment

Compose topology

The default stack contains server. The docs service is an opt-in profile. Compose bind-mounts the complete workspace/ read-only, overlays a writable volume at /app/workspace/memory, and stores runtime databases and driver caches in a second volume at /app/data.

docker compose up --build
docker compose --profile docs up --build docs

Service	Host port	Container port
Server	3000	3000
Docs profile	8081	8080

The current Compose workflow bind mount uses a Windows host path and should be changed to the repository/workflow path on the deployment host.

Volume	Container path	Contents
run-data	/app/data	Run, authorization, schedule, event, and channel SQLite data
memory-data	/app/workspace/memory	Writable files used by deployment-specific workflows or drivers

The Compose server currently runs as root so it can initialize the writable volume overlays. Choose an explicit UID/GID and pre-create writable paths with matching ownership for a hardened deployment.

Documentation image

Build the standalone site from the repository root:

docker build -f projects/docs/Dockerfile -t faimulus-docs .

To host under a path prefix, include both leading and trailing slashes:

docker build --build-arg DOCS_BASE=/faimulus/ \
  -f projects/docs/Dockerfile -t faimulus-docs .

The image serves as the unprivileged nginx user on port 8080 and exposes /healthz. It contains no server credentials or runtime application dependency.

Production checklist

1. Replace every placeholder secret and keep .env out of images and source control.
2. Put TLS and access control at the ingress layer. Do not directly expose unauthenticated management APIs.
3. Use persistent volumes and back them up with the matching encryption keys.
4. Restrict server-to-dependency networks.
5. Set explicit callback allowlists and use HTTPS callbacks.
6. Monitor health endpoints, structured logs, disk usage, callback failures, and queue age.

Use GET /health for process liveness and GET /ready for workspace readiness. Degraded discovery returns 503 with sanitized workflow or driver issue summaries.