# TAPM Deployment Access

TAPM Deployment Access is a short-lived authorization broker for protected
deployment packages and installer actions. Technicians authenticate through
the bundled Gitea service, create deployment codes, and authorize a limited
number of hosts for selected capabilities.

The production layout is a self-contained, single-VM Docker deployment:

- Go broker with a persistent embedded SQLite database
- rootless Gitea with SQLite, repositories, and package registry
- Nginx reverse proxy for both public domains
- Certbot and Let's Encrypt HTTP-01 certificate management
- explicit runtime storage under `config/` beside the Compose files

No external database or load balancer is required. The datacenter edge only
needs to forward TCP 80, 443, and 2222 to the Docker VM.

See [docs/deployment.md](docs/deployment.md) for the installation, Gitea setup,
TLS bootstrap, repository move, renewal, backup, and update procedures. The
ProxMenu integration contract is in [docs/client-api.md](docs/client-api.md).

## Local checks

```sh
GOCACHE=/tmp/tapm-go-cache go test ./...
docker compose --env-file .env.example config
docker compose --env-file .env.example -f deploy/gitea/compose.yaml config
docker build -t tai/tapm-deployment-broker:local .
```