# Production

## Hosts

| Role | Address |
| --- | --- |
| Application (Docker) | `192.168.10.162` |
| Nginx edge | `192.168.10.156` |

## Public Hostnames

| Host | Upstream |
| --- | --- |
| `torbatyar.ir` / `www` / `*.torbatyar.ir` | Frontend `:3000` |
| `api.torbatyar.ir` | Core `:8000` |
| `identity.torbatyar.ir` | Identity `:8001` |
| `auth.torbatyar.ir` | Keycloak `:8080` |
| `accounting.torbatyar.ir` | Accounting `:8002` |

## Environment

Copy from `infrastructure/deploy/.env.production.example` to the app host `.env`. Critical groups:

- `PLATFORM_*`, `NEXT_PUBLIC_*`
- `DATABASE_URL*`, `IDENTITY_DATABASE_URL*`
- `KEYCLOAK_*`, `AUTH_REQUIRED`
- `PAYAMAK_*`, `OTP_*`, `PLATFORM_ADMIN_MOBILES`
- `SSL_PROVISION_*`

Never commit real production secrets.

## Deploy Shape

1. Pull release on app host
2. `docker compose up -d --build`
3. Run/verify Alembic per service (note: some production practices may `upgrade` then `stamp` — document the exact chosen procedure in the release notes)
4. Reload Nginx config on edge if routing changed
5. Smoke: `/health`, login, tenant subdomain

## Related Documents

- [SSL](ssl.md)
- [Deployment Architecture](../architecture/deployment-architecture.md)
- [Release Strategy](../development/release-strategy.md)