Deployment and operations

Production ownership

AWS account 224673665433 owns the Route 53 hosted zone and EC2 instance. Both subdomains resolve to Elastic IP 44.235.134.255. Nginx terminates separate Let's Encrypt ECDSA certificates and HTTP redirects to HTTPS. certbot.timer handles renewal.

Surface	Release path	Runtime
API app	/opt/opensoil-public-api/releases/<UTC stamp> via current symlink	dedicated systemd service/user on 127.0.0.1:8100
API landing pages	/var/www/opensoil-api-site/releases/<UTC stamp> via current symlink	Nginx static
Documentation	/var/www/opensoil-docs/releases/<UTC stamp> via current symlink	Nginx static

The primary and lab service ports, users, source directories, release symlinks, and units are separate. Public API deployment must not restart them.

Release checks

API deployment installs pinned runtime dependencies into a release-local virtual environment, repoints one symlink, restarts only the public API unit, then checks loopback and public health. Documentation is built with MkDocs --strict, placed in a new static release, and selected by symlink. Prior releases remain available for rollback.

Development and production separation

Local development uses .venv and loopback Uvicorn. Production environment settings are read from systemd and contain no provider secrets. No dev subdomains are created yet because the project has one small read-only adapter and versioned release rollback; additional DNS environments will be added only when they create real operational separation.

Useful checks

curl --fail http://127.0.0.1:8100/health
curl --fail https://api.opensoil.net/health
curl --fail https://api.opensoil.net/v1/providers
curl --fail https://docs.opensoil.net/
sudo systemctl status opensoil-public-api.service
sudo journalctl -u opensoil-public-api.service --since '1 hour ago'
sudo nginx -t

The source-controlled Nginx, systemd, Route 53, and operational inventory files are under deploy/ and setup.md.