Deployment¶

The repository provides a hackathon prototype, not a turnkey production environment. A production deployment needs managed secrets, HTTPS, durable storage, database migrations, monitoring, rate limits, and security review.

Build the Flutter web client¶

cd frontend
flutter pub get
flutter build web --release \
  --dart-define=API_BASE_URL=https://api.example.gov.ph/api/v1

Publish frontend/build/web through a static host or CDN. Configure SPA route fallback to index.html, HTTPS, cache rules for hashed assets, and restrictive security headers. API_BASE_URL is public configuration; no secret belongs in the Flutter build.

Run the FastAPI service¶

Install locked dependencies, configure the environment, and run an ASGI server behind a TLS-terminating reverse proxy. For example:

uvicorn app.main:app --host 0.0.0.0 --port 8000

Use multiple workers only after confirming that background state, startup seeding, and provider clients are safe across processes.

Required infrastructure¶

• HTTPS endpoint and DNS for the API;
• exact CORS origins for the deployed web client;
• managed relational database with backups;
• private Supabase Storage bucket or equivalent object storage;
• secret manager for provider and database credentials;
• centralized redacted logs, metrics, alerting, and audit events;
• provider callback URLs registered for the deployed environment.

Release order¶

1. Apply compatible database migrations.
2. Deploy the backend and verify /api/v1/health.
3. Run smoke tests against non-sensitive test data.
4. Deploy the Flutter client with the final API URL.
5. Verify authentication, identity assurance, journey save/resume, and document upload.
6. Monitor error rate and provider failures during rollout.

Prefer backward-compatible API changes so the previous frontend can continue working during deployment.

Documentation deployment¶

python -m mkdocs build --strict

Publish the generated site/ directory as static content. Do not copy .env files, source maps containing secrets, test fixtures with personal data, or restricted provider documentation into the published artifact.

Production readiness gate¶

Before public use, resolve the agent-route authorization gap, define data retention, add rate limiting and upload malware scanning, validate workflow requirements with agencies, complete accessibility and privacy reviews, and exercise backup restoration.