Add cron schedules and sync docs

docs/index.md

@@ -0,0 +1,16 @@
+# Monlet Docs
+
+This directory contains operator-facing docs that do not fit in the root or component READMEs.
+
+## Start Here
+
+- [First deployment checklist](ops/deployment-checklist.md) - step-by-step production-ish stand-up checklist.
+- [Backup and restore](ops/backup-restore.md) - PostgreSQL backup, retention, and disaster recovery notes.
+- [Token rotation](ops/token-rotation.md) - UI token overlap and agent-key rotation.
+- [Deployment notes](ops/deployment.md) - deployment shape and production boundaries.
+
+## Conventions
+
+- Component setup lives in `agent/README.md`, `server/README.md`, `web/README.md`, and `deploy/README.md`.
+- API contracts live in `api/openapi.yaml`; `api/README.md` only describes contract rules.
+- Keep docs factual and current. Avoid placeholder docs when a real config or script already exists.

docs/operations/deployment.md

@@ -1,68 +0,0 @@
-# Deployment
-
-This is an initial deployment plan, not a production runbook.
-
-## Agent
-
-Agent runs as a systemd service.
-
-Expected paths:
-
-- binary: `/usr/local/bin/monlet-agent`;
-- config: `/etc/monlet/agent.toml`;
-- state: `/var/lib/monlet-agent`;
-- logs: journald.
-
-The agent should support graceful shutdown and avoid overlapping runs for the same check.
-
-## Server
-
-Server runs in Docker.
-
-Production storage:
-
-- PostgreSQL.
-
-Local/demo storage:
-
-- SQLite may be supported later, but must be documented as non-production.
-
-Required deployment features:
-
-- TLS-ready reverse proxy;
-- agent API tokens;
-- request size limits;
-- structured logs;
-- `/health`;
-- `/ready`;
-- `/metrics`.
-
-Docker image rule:
-
-- build server dependencies inside the image;
-- do not require Python packages installed on the host;
-- do not mount host virtualenvs into the container;
-- local non-Docker development uses `server/.venv` only.
-
-## Web
-
-Web is read-only for monitoring state in v1. Agent admission and blacklist controls are the explicit write exception.
-
-Auth plan:
-
-- local web login or equivalent gateway auth through a trusted reverse proxy;
-- no full RBAC in v1.
-
-## Observability
-
-Optional examples:
-
-- Prometheus scrape config;
-- Alertmanager route config;
-- Grafana dashboard stub.
-
-Metrics must avoid high-cardinality labels.
-
-## Backups
-
-PostgreSQL backup/restore docs are required before first production use.

docs/ops/deployment.md

@@ -0,0 +1,66 @@
+# Deployment Notes
+
+These notes describe the intended production shape. Use
+[`docs/ops/deployment-checklist.md`](deployment-checklist.md) for the
+step-by-step first stand-up checklist.
+
+## Agent
+
+The agent runs on monitored hosts as a systemd service.
+
+Expected paths:
+
+- binary: `/usr/local/bin/monlet-agent`
+- config: `/etc/monlet/agent.toml`
+- state: `/var/lib/monlet-agent`
+- logs: journald
+
+The agent reads only local config. It does not accept remote command execution or
+remote config push from the server. Per-check scheduling is local to the agent,
+and overlapping runs for the same check are skipped.
+
+## Server
+
+The server runs as a containerized FastAPI application backed by PostgreSQL 16+.
+It owns inventory, current check state, incidents, notification outbox state,
+retention, and public `/api/v1` contracts.
+
+Required production boundaries:
+
+- TLS and rate limiting at a reverse proxy
+- PostgreSQL as canonical storage
+- `MONLET_AUTH_TOKEN` stored in a secret manager
+- request body limits enabled
+- structured logs with auth material redacted
+- `/api/v1/health`, `/api/v1/ready`, and `/metrics` exposed for operations
+
+Docker images install dependencies inside the image. Do not mount host virtual
+environments into server containers.
+
+## Web
+
+The web app is an operator dashboard. Monitoring pages are read-only; agent
+admission and blacklist controls are the explicit v1 write surface.
+
+Protect the UI with either local web login or a trusted auth proxy. If local
+login is enabled, rate-limit `/login` at the reverse proxy. Monlet v1 does not
+provide full RBAC.
+
+## Observability
+
+The local deploy stack includes optional Prometheus, Alertmanager, and Grafana
+examples under `deploy/`. Production deployments should at minimum scrape:
+
+- Monlet server `/metrics`
+- each agent `/metrics`
+- reverse-proxy and PostgreSQL metrics from the surrounding environment
+
+Metric labels must stay low-cardinality. Do not put timestamps, request IDs, or
+unbounded host-local values into check IDs or labels.
+
+## Backups
+
+PostgreSQL is the canonical state. Follow
+[`docs/ops/backup-restore.md`](backup-restore.md) before first production
+use. Agent spools are best-effort buffers and are not a substitute for database
+backups.