Deployment Guide

Production Deployment

Deploy the RokuChannel Platform to a production Ubuntu server via WSL2 rsync. This covers the deploy script, Nginx reverse proxy, SSL, systemd service, and monitoring.

Internet HTTPS requests Nginx :443 (SSL) Rate limiting Static files Gunicorn :8065 FastAPI + uvicorn workers PostgreSQL :9433 Redis :6379/10 certbot SSL

Figure 1: Production Architecture

Server Setup & Deploy Script

The deployment uses scripts/deploy.sh which syncs files from Windows to WSL2 Ubuntu, installs dependencies, runs migrations, restarts the service, and performs a health check.

# Full deploy
./scripts/deploy.sh

# Quick code-only deploy (skip deps and migrations)
./scripts/deploy.sh --skip-deps --skip-migrate

The deploy script performs 5 steps: file sync (rsync), dependency install (pip), database migrations (SQL), service restart (systemd), and health check (HTTP).

Nginx Configuration

The Nginx config at scripts/nginx_rokuchannel.conf provides reverse proxy, rate limiting, security headers, gzip compression, and static file serving.

  • Rate Limiting Zones -- General: 10r/s, API: 30r/s, Auth: 5r/s per IP
  • Security Headers -- X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy
  • Gzip Compression -- Level 6 compression for text, CSS, JS, JSON, XML, SVG, and font files
  • Static File Caching -- 30-day cache for static assets, 7-day for uploads, 30-day for shared vendors

SSL with Certbot

# Install certbot and obtain certificate
sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d roku.yourdomain.com

# Auto-renewal is configured by certbot
sudo certbot renew --dry-run
Security Critical
Before deploying to production, change the JWT secret, app secret, and database password from their default placeholder values. The QA report flags these as critical issues (C1, C2, C3).

Systemd Service

The deploy script expects a systemd service named rokuchannel that manages the Gunicorn process.

# Manage the service
sudo systemctl status rokuchannel
sudo systemctl restart rokuchannel
sudo systemctl stop rokuchannel

Monitoring and Logs

# View service logs
sudo journalctl -u rokuchannel -f

# Check health endpoint
curl -s http://localhost:8065/health | python3 -m json.tool

# Nginx access/error logs
sudo tail -f /var/log/nginx/access.log
sudo tail -f /var/log/nginx/error.log
Health Endpoint
The /health endpoint returns database status and response time. The Nginx config allows health checks over HTTP (no SSL) for monitoring tools.