Compact production topology
The current Milan release runs the Go control plane, Next.js application, Envoy, ClamAV, and a dedicated Cloudflare tunnel using non-root/read-only containers and internal networks.
Controlled promotion
Immutable images carry SBOM and provenance attestations, receive vulnerability gates and keyless signatures, and deploy into revision directories through a pinned SSH identity.
Recovery boundary
Compose health, previous-release rollback, checksum-verified data backup, and restore scripts exist. Scheduled encrypted off-host retention and automated restore drills remain operator work.
Frequently asked questions
Does production expose Docker or database ports?
No. Application origins are loopback-only in the Milan shared-ingress topology, and the control/tenant databases remain inside the data volume.