Deployment

Docker

Not supported in-tree. No Dockerfile or Compose file for Central was found. Do not assume sibling service container layouts apply.

Docker Compose

Not supported in-tree.

Systemd

Verified unit: deploy/systemd/central.service (mirrored in ../systemd/central.service and ../systemd/production-current/central.service).

Setting	Value
Binary	/opt/central/central
WorkingDirectory	/opt/central
EnvironmentFile	optional /etc/central.env (- prefix means missing file is OK)
User/Group	www-data
Restart	on-failure / 5s
Hardening	NoNewPrivileges, PrivateTmp, ProtectSystem=strict, ProtectHome=yes
Writable	ReadWritePaths=/opt/central
Logs	journald SyslogIdentifier=central

Install:

sudo cp deploy/systemd/central.service /etc/systemd/system/central.service
sudo cp deploy/systemd/central.env.example /etc/central.env
sudo chmod 600 /etc/central.env
# edit /etc/central.env
sudo systemctl daemon-reload
sudo systemctl enable --now central
sudo systemctl status central

Apache

Parent repository Apache configs proxy Central at 127.0.0.1:8888. Representative HTTPS host: ../apache.conf/000-default-le-ssl.conf.

Typical routes (order matters in Apache):

Public path	Backend
/api/portal/	http://127.0.0.1:8888/api/portal/
/api/admin/portal/	http://127.0.0.1:8888/api/admin/portal/
/api/health	http://127.0.0.1:8888/api/health
/api/catalog	present in root 000-default-le-ssl.conf (verify your enabled site copy)
/api/me	http://127.0.0.1:8888/api/me
/api/maps|/reports|/forms|/datasets	Central stubs
/login, /logout	Central
/ catch-all (after other services)	Central

Also set:

• ProxyPreserveHost On
• TLS certificates (Let’s Encrypt paths referenced in the checked-in config)
• Forwarded HTTPS (X-Forwarded-Proto) so Secure cookies work

An additional same-host Central/Jasper example lives at ../qcarta-jasper-service/deploy/apache-central-jasper.conf.example.

Nginx

No verified Nginx configuration for Central exists in this repository. If you introduce one, preserve Host, forward proto, and avoid stripping paths unexpectedly. Prefer documenting a tested config before production use.

Reverse proxy requirements

Central trusts proxy-provided:

Header	Effect
X-Forwarded-Proto	Secure cookies + request scheme + discovery origin
X-Forwarded-Host	Discovery origin host
X-Forwarded-Prefix	Generated links / relative path interpretation

The process listens with plain http.ListenAndServe (no TLS in-process).

TLS

TLS terminates at Apache in the evidenced deployment (/etc/letsencrypt/live/...). Central itself has no certificate configuration. Ensure browsers hit HTTPS and that the proxy sets X-Forwarded-Proto: https.

Scaling

Dimension	Verified behavior
Horizontal processes	Not established as safe for thumbnails or catalog cache coherence; DB state is shared, but filesystem thumbnails and in-memory cache are per-process
Sticky sessions	Not required for cookie auth (sessions live in PostgreSQL)
Catalog cache	Per process; multi-instance deployments will duplicate discovery traffic
Thumbnails	Local disk under /opt/central; multi-node requires shared storage not provided by Central

Treat Central as primarily a single-node systemd service unless you add external shared storage and accept cache duplication.

Backups

Back up:

1. PostgreSQL database used by CENTRAL_DATABASE_URL
2. /opt/central/web/thumbnails (or CENTRAL_THUMBNAILS_DIR)
3. /etc/central.env
4. Deployed binary and web/ templates

No built-in backup job exists.

Health checks

Check	Command / endpoint
Process liveness	GET /api/health → {"status":"ok"}
systemd	systemctl is-active central
Auth readiness	GET /api/me (anonymous OK); login smoke test
DB readiness	Admin call or portal cards without DB-disabled note

/api/health does not validate PostgreSQL or discovery dependencies. Do not rely on it alone for readiness.

Monitoring

Signal	Location
Service logs	journalctl -u central -e
Apache access/error	${APACHE_LOG_DIR}/access.log, error.log
Metrics/tracing	Not implemented in Central

Alert on systemd restart loops, 5xx rates at the proxy, and login/bootstrap failures in the journal.