# The deployment manual

<!-- module: s19-deployment · deck: How a release reaches the server and the database stays safe: one script for every release, a backup before it and every night that only the password manager's key opens, a restore asked twice, and a new app made from a release by one command. -->

**Table of contents · 25 October 2026 · S19 of plan CORE. Releases, backups and restoring, the dev agents, and a new
app from a release.**

This module has no page: it is the server's operator's, at a shell. A release runs one script, which backs the database
up first and stops at the first step that fails. Every night the database and the private files are backed up into one
file that only the backup key's private half opens, and that half is never on the server. Restoring asks twice. A new
app starts from a release of the starter pack and is renamed by one command, which leaves no trace of the old name.

The one sentence to carry through it: **the server can make a backup but never read one; the password manager holds
what opens them.**

**Who meets what**

| Seat | Who | What they do here |
|---|---|---|
| The server's operator | Whoever deploys | Runs releases, sets up backups, restores, drills |
| The Service | The platform's owner | Sees **Backups** on the operations page; holds the backup key's private half |
| A developer | Whoever starts a new app | Makes it from a release, renames it, checks it |
| Owner, Admin, Member | A workspace's people | Never meet it |

**As shipped**

| | Shipped |
|---|---|
| A release | `deploy/server/release.sh`: build, a backup, `app:deploy` |
| Backups | nightly at 02:00, pruned at 02:50, and before each release; off until `BACKUP_PATH` and `BACKUP_PUBLIC_KEY` are set |
| Kept | every backup 14 days; the newest of each week 8 weeks, of each month 12 months |
| Off the server | to `BACKUP_REMOTE` (rclone) when named; pruned there too unless `BACKUP_REMOTE_PRUNE=false` |
| Backups readiness | passing under 26 hours old and copied off; a look with one copy only; failing in production while not set up |
| The dev ports | the app 8020, the mockups 8021, the docs 8022 (no agent for the starter pack) |

---

## Part 1 · Deployment

- [1.1 Deploying a release](p01-deployment.md#11-deploying-a-release)
- [1.2 Setting up backups](p01-deployment.md#12-setting-up-backups)
- [1.3 The monthly drill](p01-deployment.md#13-the-monthly-drill)
- [1.4 Restoring a backup](p01-deployment.md#14-restoring-a-backup)
- [1.5 Running an app's dev agents on a Mac](p01-deployment.md#15-running-an-apps-dev-agents-on-a-mac)
- [1.6 Starting a new app from a release](p01-deployment.md#16-starting-a-new-app-from-a-release)
- [1.7 Checking an app for drift](p01-deployment.md#17-checking-an-app-for-drift)