Deployment

Overview#

Anar products are deployed across two tiers: dashboards run on Cloudflare Pages (globally distributed edge network), and backends run as Docker containers on your infrastructure (sovereign cloud or on-premises).

Deployment Architecture#

Dashboard Deployment (Cloudflare Pages)#

All product dashboards are deployed to Cloudflare Pages with Git integration. Pushing to main triggers an automatic build and deploy.

Build Configuration#

Environment Variables#

Set these in the Cloudflare Pages dashboard for each project:

Custom Domains#

Each dashboard maps to a subdomain:

Backend Deployment (Docker)#

All 14 backends ship as Docker images with multi-stage builds, non-root users, and health checks.

Building Images#

docker compose build gateway chat-backend guard-backend

Or build individual images:

docker build -t anar-chat-api ./chat/backend
docker build -t anar-guard-api ./guard/backend
docker build -t anar-gateway ./gateway

Production Docker Compose#

The root docker-compose.yml defines all 14 products with health checks, restart policies, and proper dependency ordering:

docker compose up -d

To include the observability stack:

docker compose --profile infra up -d

Health Checks#

Every backend exposes a /health endpoint that returns service status, version, and uptime:

{
  "status": "healthy",
  "version": "0.1.0",
  "product": "anar-chat",
  "uptime_seconds": 3642.5
}

Docker Compose uses these for dependency ordering (condition: service_healthy).

Production Considerations#

Secrets Management#

Never commit secrets to source control. Use environment variables or a secrets manager:

# Generate strong JWT secrets
openssl rand -hex 32

# Generate unique secrets for each product
for product in chat guard voice agents comply eval docs flow insights translate minutes present procure; do
  echo "${product^^}_JWT_SECRET=$(openssl rand -hex 32)"
done

Database#

Products that require PostgreSQL (Chat, Guard, Voice) create their own database containers in Docker Compose. For production, point them to a managed PostgreSQL instance:

DATABASE_URL=postgresql+asyncpg://user:pass@your-managed-db:5432/anar_chat

Resource Limits#

Set memory and CPU limits in your deployment configuration to prevent resource contention:

deploy:
  resources:
    limits:
      memory: 2G
      cpus: "1.0"
    reservations:
      memory: 512M
      cpus: "0.5"

TLS Termination#

In production, terminate TLS at your load balancer or reverse proxy. The backends run on plain HTTP internally. Cloudflare Pages handles TLS automatically for dashboards.

Network Isolation#

Use a dedicated Docker network (the default anar-network in Docker Compose) to isolate product-to-product communication. Only expose the Gateway and dashboard ports externally.

Kubernetes Deployment#

Kubernetes manifests are available in infra/k8s/:

infra/k8s/
├── base/           # LGTM observability stack
└── products/       # 14 product Deployments + Services

Each product has a Deployment and Service manifest. The base directory contains the namespace definition and observability stack components.

Pulumi IaC#

For infrastructure-as-code deployments, Pulumi configurations are in infra/pulumi/:

from anar_product import AnarProduct

chat = AnarProduct(
    "anar-chat",
    image="anar-chat-api:latest",
    port=8001,
    env={
        "GATEWAY_URL": "http://gateway:8080/v1",
        "JWT_SECRET": config.require_secret("chat-jwt-secret"),
    },
)

The AnarProduct component resource handles Deployment, Service, and ConfigMap creation for each product. The OTelStack component deploys the full observability stack.