Deployment

The production deployment target is documented in deploy/README.md.

Shape

Caddy for TLS and static files
Node.js backend as a systemd service
MariaDB on localhost
Discord as a separate user service
Static frontend served from /opt/handlelend/frontend/dist

Rules

Secrets live outside the repository.
Backend and Discord tokens are separate.
Discord verification uses a service token file.
Preprod must be noindex when production SEO is launched.
Every deploy runs npm run security:check.