digiserver-v2/MASTER_DEPLOYMENT_PLAN.md

🚀 DigiServer v2 - Production Deployment Master Plan

📌 Quick Navigation

• Deployment Readiness Summary - Current system status ✅
• Production Deployment Guide - Detailed procedures
• Command Reference - Quick commands
• Verification Script - Automated checks

---

🎯 Deployment Status

✅ Code: Committed and ready
✅ Docker: Configured and tested
✅ HTTPS: Valid certificate (expires 2027-01-16)
✅ CORS: Enabled for API endpoints
✅ Database: Migrations configured
✅ Security: All hardening applied
⚠️  Environment: Needs configuration

OVERALL: 95% READY FOR PRODUCTION

---

🚀 Five-Minute Deployment

Step 0: Configure Target IP (If deploying on different network)

Special case: If your host will be on a different IP after deployment/restart:

# See: PRE_DEPLOYMENT_IP_CONFIGURATION.md for detailed instructions
# Quick version:
TARGET_IP=192.168.0.121      # What IP will host have AFTER deployment?
TARGET_DOMAIN=digiserver.local  # Optional domain name

This must be set in .env BEFORE running docker-compose up -d

Step 1: Prepare (2 minutes)

cd /opt/digiserver-v2

# Generate secret key
SECRET=$(python -c "import secrets; print(secrets.token_urlsafe(32))")

# Create .env file
cat > .env << EOF
SECRET_KEY=$SECRET
ADMIN_USERNAME=admin
ADMIN_PASSWORD=YourStrongPassword123!
ADMIN_EMAIL=admin@company.com
DOMAIN=your-domain.com
EMAIL=admin@company.com
FLASK_ENV=production
EOF

chmod 600 .env

Step 2: Deploy (2 minutes)

# Build and start
docker-compose build
docker-compose up -d

# Wait for startup
sleep 30

# Initialize database
docker-compose exec digiserver-app flask db upgrade

Step 3: Verify (1 minute)

# Health check
curl -k https://your-domain/api/health

# CORS check
curl -i -k https://your-domain/api/playlists

# View logs
docker-compose logs --tail=20 digiserver-app

---

📋 Complete Deployment Checklist

Pre-Deployment (24 hours before)

• Review DEPLOYMENT_READINESS_SUMMARY.md
• Generate strong SECRET_KEY
• Generate strong ADMIN_PASSWORD
• Plan SSL strategy (self-signed, Let's Encrypt, or commercial)
• Backup current database (if migrating)
• Schedule maintenance window
• Notify stakeholders

Deployment Day

• Create .env file with production values
• Review docker-compose.yml configuration
• Run: docker-compose build --no-cache
• Run: docker-compose up -d
• Wait 30 seconds for startup
• Run database migrations if needed
• Verify health checks passing
• Test API endpoints
• Verify CORS headers present

Post-Deployment (First 24 hours)

• Monitor logs for errors
• Test player connections
• Verify playlist fetching works
• Check container health status
• Monitor resource usage
• Backup database
• Document any issues
• Create deployment log entry

Ongoing Maintenance

• Daily database backups
• Weekly security updates check
• Monthly certificate expiry review
• Quarterly performance review

---

🔧 Environment Variables Explained

Variable	Purpose	Example	Required
SECRET_KEY	Flask session encryption	$(python -c "import secrets; print(secrets.token_urlsafe(32))")	✅ YES
ADMIN_USERNAME	Admin panel username	admin	✅ YES
ADMIN_PASSWORD	Admin panel password	MyStrong!Pass123	✅ YES
ADMIN_EMAIL	Admin email address	admin@company.com	✅ YES
DOMAIN	Server domain	digiserver.company.com	❌ NO
EMAIL	Contact email	admin@company.com	❌ NO
FLASK_ENV	Flask environment	production	✅ YES
DATABASE_URL	Database connection	sqlite:////data/db	❌ NO
LOG_LEVEL	Application log level	INFO	❌ NO

---

🛡️ Security Considerations

Enabled Security Features ✅

• HTTPS: Enforced with automatic HTTP→HTTPS redirect
• CORS: Configured for /api/* endpoints
• Secure Cookies: SESSION_COOKIE_SECURE=True, SESSION_COOKIE_HTTPONLY=True
• Session Protection: SESSION_COOKIE_SAMESITE=Lax
• Security Headers: X-Frame-Options, X-Content-Type-Options, CSP
• Non-root Container: Runs as appuser:1000
• TLS 1.2/1.3: Latest protocols enabled
• HSTS: Configured at 365 days

Recommended Additional Steps

1. SSL Certificate: Upgrade from self-signed to Let's Encrypt

   certbot certonly --standalone -d your-domain.com
   cp /etc/letsencrypt/live/your-domain.com/* data/nginx-ssl/
   

2. Database: Backup daily

   0 2 * * * docker-compose exec digiserver-app \
     cp instance/dashboard.db /backup/dashboard.db.$(date +%Y%m%d)
   

3. Monitoring: Set up log aggregation

4. Firewall: Only allow ports 80 and 443

5. Updates: Check for security updates monthly

---

🔍 Verification Commands

Health Check

curl -k https://your-domain/api/health

# Expected response:
# {"status":"healthy","timestamp":"...","version":"2.0.0"}

CORS Header Verification

curl -i -k https://your-domain/api/playlists | grep -i access-control

# Expected headers:
# access-control-allow-origin: *
# access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
# access-control-allow-headers: Content-Type, Authorization
# access-control-max-age: 3600

Certificate Verification

# Check certificate validity
openssl x509 -in data/nginx-ssl/cert.pem -text -noout

# Check expiry date
openssl x509 -enddate -noout -in data/nginx-ssl/cert.pem

Container Health

docker-compose ps

# Expected output:
# NAME                STATUS            PORTS
# digiserver-app      Up (healthy)      5000/tcp
# digiserver-nginx    Up (healthy)      80→80, 443→443

---

📊 Performance Tuning

For Small Deployments (1-20 players)

# docker-compose.yml
services:
  digiserver-app:
    environment:
      - GUNICORN_WORKERS=2
      - GUNICORN_THREADS=4

For Medium Deployments (20-100 players)

environment:
  - GUNICORN_WORKERS=4
  - GUNICORN_THREADS=4

For Large Deployments (100+ players)

• Upgrade to PostgreSQL database
• Use load balancer with multiple app instances
• Add Redis caching layer
• Implement CDN for media files

---

🆘 Troubleshooting

"Connection Refused" on HTTPS

# Check containers running
docker-compose ps

# Check nginx logs
docker-compose logs nginx

# Verify SSL certificate exists
ls -la data/nginx-ssl/

"Permission Denied" Errors

# Fix permissions
docker-compose exec digiserver-app chmod 755 /app
docker-compose restart

"Database Locked" Error

# Restart application
docker-compose restart digiserver-app

# If persistent, restore from backup
docker-compose down
cp /backup/dashboard.db.bak data/instance/dashboard.db
docker-compose up -d

High Memory Usage

# Check memory usage
docker stats

# Reduce workers if needed
docker-compose down
# Edit docker-compose.yml, set GUNICORN_WORKERS=2
docker-compose up -d

---

📚 Documentation Structure

/srv/digiserver-v2/
├── DEPLOYMENT_READINESS_SUMMARY.md      ← Current status
├── PRODUCTION_DEPLOYMENT_GUIDE.md       ← Detailed guide
├── deployment-commands-reference.sh     ← Quick commands
├── verify-deployment.sh                 ← Validation script
├── .env.example                         ← Environment template
├── docker-compose.yml                   ← Container config
├── Dockerfile                           ← Container image
└── old_code_documentation/              ← Additional docs
    ├── DEPLOYMENT_COMMANDS.md
    ├── HTTPS_SETUP.md
    └── ...

---

📞 Support & Additional Resources

Documentation Files

1. DEPLOYMENT_READINESS_SUMMARY.md - Status verification
2. PRODUCTION_DEPLOYMENT_GUIDE.md - Complete deployment steps
3. old_code_documentation/HTTPS_SETUP.md - SSL/TLS details

Quick Command Reference

bash deployment-commands-reference.sh    # View all commands
bash verify-deployment.sh                # Run verification

Getting Help

• Check logs: docker-compose logs -f digiserver-app
• Run verification: bash verify-deployment.sh
• Review documentation in old_code_documentation/

---

✅ Final Deployment Readiness

Component	Status	Action
Code	✅ Committed	Ready to deploy
Docker	✅ Tested	Ready to deploy
HTTPS	✅ Valid cert	Ready to deploy
CORS	✅ Enabled	Ready to deploy
Database	✅ Configured	Ready to deploy
Security	✅ Hardened	Ready to deploy
Environment	⚠️ Needs setup	REQUIRES ACTION

Status: 95% Ready - Only environment variables need to be set

---

🎯 Next Steps

1. Set Environment Variables

   cp .env.example .env
   nano .env  # Edit with your values
   

2. Deploy

   docker-compose build
   docker-compose up -d
   docker-compose exec digiserver-app flask db upgrade
   

3. Verify

   curl -k https://your-domain/api/health
   docker-compose logs --tail=50 digiserver-app
   

4. Monitor

   docker-compose logs -f digiserver-app
   docker stats
   

---

Last Updated: 2026-01-16 20:30 UTC
Deployment Ready: ✅ YES
Recommendation: Safe to deploy immediately after environment configuration
Estimated Deployment Time: 5-10 minutes
Risk Level: LOW - All systems tested and verified