Skip to content

Deployment

Jump to bottom
RealmsNetwork edited this page Oct 20, 2026 · 1 revision

Deployment Guide

Follow the current repository README and deploy/README.md for release-specific commands.

systemd on Linux

Use the included service/sysusers files when present. Recommended practices:

  • Run as a dedicated, unprivileged account.
  • Keep source and virtualenv read-only to the runtime user where practical.
  • Store secrets in a root-owned environment file with restrictive permissions.
  • Enable restart-on-failure and systemd sandboxing where compatible.
  • Bind HTTP to loopback when using a reverse proxy.
  • Check service status and logs after upgrades, without printing secret environment values.

Do not run MAP as root to obtain panel-admin permissions. Panel API privileges are independent from operating-system privileges.

HTTPS reverse proxy

For remote MCP access, use an HTTPS reverse proxy or an equivalent authenticated tunnel. Configure TLS, authentication, access control, size/time limits, streaming support, and safe log redaction. Keep the backend on loopback or a private interface where possible.

Do not expose plaintext MCP HTTP directly to the public internet. Use a strong bearer token when supported and protect it as a secret.

Containers

Use the official files included in the release, if present. Prefer a non-root image user, explicit resource limits, secret injection rather than build-time credentials, and pinned image tags/digests. Avoid mounting the host Docker socket or arbitrary host paths unless deliberately required and reviewed.

Operational checklist

  • Pin a reviewed release/commit.
  • Keep secrets outside source control.
  • Use an unprivileged service account.
  • Restrict outbound access to expected panel and trusted transfer hosts.
  • Require TLS and authentication before remote exposure.
  • Test harmless reads before writes.
  • Test destructive actions on a disposable server.
  • Monitor availability without logging secrets.
  • Keep backups and a rollback plan.

Upgrades

Back up environment configuration securely, review release notes, test in an isolated environment, run tests, restart MAP, and verify operations against a test server. Retain a known-good version for rollback.

Clone this wiki locally