# Deployment

This is an initial deployment plan, not a production runbook.

## Agent

Agent runs as a systemd service.

Expected paths:

- binary: `/usr/local/bin/monlet-agent`;
- config: `/etc/monlet/agent.toml`;
- state: `/var/lib/monlet-agent`;
- logs: journald.

The agent should support graceful shutdown and avoid overlapping runs for the same check.

## Server

Server runs in Docker.

Production storage:

- PostgreSQL.

Local/demo storage:

- SQLite may be supported later, but must be documented as non-production.

Required deployment features:

- TLS-ready reverse proxy;
- agent API tokens;
- request size limits;
- structured logs;
- `/health`;
- `/ready`;
- `/metrics`.

Docker image rule:

- build server dependencies inside the image;
- do not require Python packages installed on the host;
- do not mount host virtualenvs into the container;
- local non-Docker development uses `server/.venv` only.

## Web

Web is read-only for monitoring state in v1. Agent admission and blacklist controls are the explicit write exception.

Auth plan:

- reverse proxy basic auth or equivalent gateway auth;
- no full RBAC in v1.

## Observability

Optional examples:

- Prometheus scrape config;
- Alertmanager route config;
- Grafana dashboard stub.

Metrics must avoid high-cardinality labels.

## Backups

PostgreSQL backup/restore docs are required before first production use.