Deployment

The repository evidence covers a Go binary with parent-repository systemd and Apache assets. Docker, Compose, Nginx, native TLS, horizontal scaling, and dedicated health/ready/metrics endpoints are not provided or verified. Configurations for those mechanisms are operator-supplied and must not be represented as supported GeoVault examples.

systemd

The checked-in parent unit is ../systemd/geovault.service (also copied under ../systemd/production-current/). It runs:

Setting	Checked-in value
User/group	www-data:www-data
Working directory	/opt/geovault
Command	/opt/geovault/geovault
Environment	optional -/etc/geovault.env
Restart	on-failure, after 5 seconds
Writable paths	/opt/geovault, /data/projects, /tmp
Hardening	NoNewPrivileges=yes, ProtectSystem=full, ProtectHome=yes, PrivateTmp=no
Output	systemd journal, identifier geovault

Install from the federation checkout:

sudo install -d -o www-data -g www-data /opt/geovault /opt/geovault/web /opt/geovault/shared/ui /data/projects
sudo install -o root -g root -m 0755 geovault /opt/geovault/geovault
sudo cp -a web/. /opt/geovault/web/
sudo cp -a ../shared/ui/. /opt/geovault/shared/ui/
sudo install -o root -g root -m 0644 ../systemd/geovault.service /etc/systemd/system/geovault.service
sudo systemctl daemon-reload
sudo systemctl enable --now geovault

Create /etc/geovault.env separately with reviewed placeholders and restrictive permissions. Do not copy the credential-like value in deploy/geovault.env; rotate it if it was ever used. Add any GEOVAULT_VERSIONS_JSON, GEOVAULT_DATA_DIR, FEDERATION_SHARED_UI_ROOT, or QGIS_PROJECTS_ROOT outside the existing allowlist to ReadWritePaths as appropriate. The service also needs GDAL executables on its PATH.

Apache

The parent ../apache.conf/000-default-le-ssl.conf verifies a prefix-stripping mapping to 127.0.0.1:8085, excludes /geovault/ from the Central catch-all proxy, and applies:

ProxyPass        /geovault/  http://127.0.0.1:8085/
ProxyPassReverse /geovault/  http://127.0.0.1:8085/
ProxyPass        /geovault   http://127.0.0.1:8085
ProxyPassReverse /geovault   http://127.0.0.1:8085

<Location /geovault>
    RequestHeader set X-Forwarded-Prefix "/geovault"
    RequestHeader set X-Forwarded-Proto "https"
</Location>

For this exact mapping, leave BASE_PATH empty: Apache removes /geovault upstream, while X-Forwarded-Prefix makes generated links external-prefix aware. Setting BASE_PATH=/geovault simultaneously would mount routes at a prefix Apache has already removed. Preserve the host and cookies, route Central /login and /logout, and adapt the parent vhost's environment-specific hostname and certificate paths.

GeoVault has no native TLS and calls http.ListenAndServe(":8085", ...), binding all interfaces rather than loopback only. Terminate TLS at the verified Apache layer, send X-Forwarded-Proto: https, and block direct access to port 8085 with host/network policy.

No GeoVault Nginx asset is checked in. An operator choosing Nginx must independently supply and validate prefix handling, forwarded headers, request-size/time limits, authentication cookies, TLS, and Central routes; this documentation does not claim that configuration is supported.

Storage and external dependencies

Persist and permission:

• /data/projects, including dataset/folder/version trees;
• metadata PostgreSQL, or the selected JSON version catalog;
• CWD-relative data/metadata (/opt/geovault/data/metadata under the checked-in unit);
• /etc/geovault.env and stable encryption keys.

Enabled features may require Central PostgreSQL, metadata PostgreSQL/PostGIS, QGIS Publish Service, TileServer, PostGIS Service, GeoServer, ArcGIS, S3-compatible storage, remote HTTP(S) sources, and browser CDN/basemap access. Validate connectivity from the service account and preserve caller session forwarding where required.

Scaling and jobs

Run a single GeoVault process per catalog. Versions are held in process memory and persisted using full-table or whole-JSON replacement; multiple writers can lose updates. Background GeoServer/ESRI work uses in-process goroutines and has no distributed queue or restart recovery. No horizontal-scaling deployment is provided or verified; scale CPU, memory, temporary space, and disk I/O vertically after workload testing.

Logging, monitoring, and health

Application logs go to stdout/stderr and therefore the journal under the parent unit. Monitor:

• unit restarts and journalctl -u geovault;
• database availability and migration/reconciliation errors;
• failed or long-running rows in geoserver_jobs;
• capacity/inodes for /data/projects, /opt/geovault/data, and /tmp;
• latency/failure of enabled external services.

There is no /health, /ready, or Prometheus endpoint. systemctl is-active geovault is only a process check. An authenticated request such as /api/discovery is an operator-defined functional probe, not a provided health contract, and can depend on auth/database state.

Backups and hardening

Take coordinated, tested backups of Central auth PostgreSQL, metadata PostgreSQL, /data/projects, JSON catalog (when used), data/metadata, configuration, and encryption keys. No built-in backup, restore, retention, or consistency hook is provided. Quiesce writes or use database/filesystem snapshot procedures that produce a consistent set, then test restoration.

For production, keep the environment file secret, require PostgreSQL TLS, restrict outbound destinations and direct port 8085 access, set reverse-proxy body/time limits, patch Go/GDAL dependencies, run as the non-login service user, narrow ReadWritePaths where practical, protect backups, rotate credentials, and monitor disk growth. Review whether the checked-in broad write access to /opt/geovault and PrivateTmp=no is acceptable for the host.