TAPM Deployment Access

TAPM Deployment Access is a short-lived authorization broker for protected deployment packages and installer actions. Technicians authenticate through the bundled Gitea service, create deployment codes, and authorize a limited number of hosts for selected capabilities.

The production layout is a self-contained, single-VM Docker deployment:

• Go broker with a persistent embedded SQLite database
• rootless Gitea with SQLite, repositories, and package registry
• Nginx reverse proxy for both public domains
• Certbot and Let's Encrypt HTTP-01 certificate management
• explicit runtime storage under config/ beside the Compose files
• privacy-minimized ProxMenu installation and run-status registry

No external database or load balancer is required. The datacenter edge only needs to forward public TCP 80 and 443 to the configured Docker VM ports. All services are managed by one Compose project while remaining separate containers for independent health checks and upgrades.

See docs/deployment.md for the installation, Gitea setup, TLS bootstrap, repository move, renewal, backup, and update procedures. The ProxMenu integration contract is in docs/client-api.md.

Guided installation

After cloning the repository, run:

./install.sh

The installer defaults to SSL_MODE=none, writes a mode-0600 .env, creates the runtime directories and Docker network, and starts Gitea behind the HTTP-only Nginx test configuration. It does not invent Gitea OAuth or package credentials. After creating those resources in Gitea, run ./manage.sh configure-broker and ./manage.sh start.

Once public DNS and TCP 80/443 forwarding are ready, switch the same persistent deployment to Let's Encrypt:

./manage.sh set-ssl letsencrypt
./manage.sh bootstrap
./manage.sh start

Local checks

GOCACHE=/tmp/tapm-go-cache go test ./...
docker compose --env-file .env.example config
docker compose --env-file .env.example \
  -f compose.yaml -f compose.http.yaml config
docker compose --env-file .env.example \
  -f compose.yaml -f compose.tls.yaml -f compose.direct.yaml config
docker build -t tai/tapm-deployment-broker:local .