# TAPM Deployment Access

TAPM Deployment Access is a short-lived authorization broker for protected
deployment packages and installer actions. Technicians authenticate through
the bundled Gitea service, create deployment codes, and authorize a limited
number of hosts for selected capabilities.

The production layout is a self-contained, single-VM Docker deployment:

- Go broker with a persistent embedded SQLite database
- rootless Gitea with SQLite, repositories, and package registry
- Nginx reverse proxy for both public domains
- Certbot and Let's Encrypt HTTP-01 certificate management
- explicit runtime storage under `config/` beside the Compose files

No external database or load balancer is required. The datacenter edge only
needs to forward public TCP 80 and 443 to the configured Docker VM ports.

See [docs/deployment.md](docs/deployment.md) for the installation, Gitea setup,
TLS bootstrap, repository move, renewal, backup, and update procedures. The
ProxMenu integration contract is in [docs/client-api.md](docs/client-api.md).

## Local checks

```sh
GOCACHE=/tmp/tapm-go-cache go test ./...
docker compose --env-file .env.example config
docker compose --env-file .env.example -f deploy/gitea/compose.yaml config
docker build -t tai/tapm-deployment-broker:local .
```