Maoclaw Production Deploy Runbook

# maoclaw Web Production Deploy Runbook

## Target shape

- `app`: Next.js web control plane
- `postgres`: primary relational store for Prisma
- `redis`: cache / queue coordination
- `minio`: S3-compatible artifact storage
- host `nginx`: reverse proxy and TLS termination for `xinxiang.xin`

## First deploy

1. Copy `.env.production.example` to `.env.production`.
2. Set strong values for `POSTGRES_PASSWORD` and `MINIO_ROOT_PASSWORD`.
3. Confirm `APP_URL=https://xinxiang.xin`.
4. Start stateful services and app:
   - `docker compose -f docker-compose.prod.yml up -d postgres redis minio create-bucket`
   - `docker compose -f docker-compose.prod.yml up --build migrate`
   - `docker compose -f docker-compose.prod.yml up --build seed`
   - `docker compose -f docker-compose.prod.yml up -d --build app`

## Day-2 operations

- Check containers: `docker compose -f docker-compose.prod.yml ps`
- App logs: `docker compose -f docker-compose.prod.yml logs -f app`
- Proxy logs: host `nginx` logs
- Restart app only: `docker compose -f docker-compose.prod.yml up -d --build app`

## Notes

- This deploy shape is intentionally single-server and operationally simple.
- `maoclaw` runtime workers should remain separate from the web server.
- MinIO console is internal only on this shape. Do not expose `9001` publicly unless you add access control.
- The app is published only on `127.0.0.1:3000` and should be exposed through `nginx`.