# Production deploy (Layer 1 — infrastructure)

Single public hostname via **nginx**; unified API on internal port **5012**.

## Firewall

| Port | Dev use | Production |
|------|---------|------------|
| **443** | — | **Public** (HTTPS) |
| 80 | — | Redirect → 443 |
| 5012 | Unified API | **Internal only** (docker `expose`, not `ports`) |
| 3000, 5173–5176 | Vite / CRA dev servers | **Block from WAN** |

## Quick start

```bash
# From repo root — build UIs, copy dist into deploy/*, then:
docker compose -f deploy/docker-compose.yml up -d
```

Set `JWT_SECRET`, database env vars, and TLS certificates before production use.

See `docs/EHS-SSO-ACCESS-AND-ENTRY-POINT-GUIDE.md` for path bases and env alignment.
