# Deployment Architecture

> Architecture topology only. Runbooks → [docs/deployment/](../deployment/)

## Environments

| Layer | Role |
| --- | --- |
| Local Docker Compose | Dev: Postgres, Redis, Keycloak, Core, Identity, Frontend, Celery |
| Production edge | Nginx TLS termination + routing |
| Production app host | Docker Compose services |

## Production Topology (canonical)

| Component | Host / Endpoint |
| --- | --- |
| App / Docker | `192.168.10.162` |
| Nginx edge | `192.168.10.156` |
| Apex / www / tenant FE | `torbatyar.ir`, `*.torbatyar.ir` |
| Core API | `api.torbatyar.ir` → `:8000` |
| Identity API | `identity.torbatyar.ir` → `:8001` |
| Keycloak | `auth.torbatyar.ir` → `:8080` |

## Compose Services

`postgres`, `redis`, `keycloak`, `core-service`, `identity-access-service`, `frontend`, `celery-worker`, `celery-beat`

## Configuration

All runtime settings from environment (`.env` / production env files). No hardcoded secrets or brand values in source ([ADR-008](adr/ADR-008.md)).

## TLS & Tenant SSL

Edge Nginx terminates TLS. Tenant subdomain certificates expand via Celery → SSH → `provision_ssl.py` ([ADR-009](adr/ADR-009.md)).

## Related Documents

- [deployment.md](../deployment/deployment.md)
- [production.md](../deployment/production.md)
- [ssl.md](../deployment/ssl.md)
- [monitoring.md](../deployment/monitoring.md)
- [backup.md](../deployment/backup.md)
- [restore.md](../deployment/restore.md)
- [disaster-recovery.md](../deployment/disaster-recovery.md)