Production deployment

This page describes the product's production shape. Exact infrastructure values depend on the deployment environment and the controlled release artifacts available to your Tenvyr program.

Required boundaries

Publish distinct HTTPS origins:

app.tenvyr.com       browser, CLI, and user-facing APIs
agents.tenvyr.com    agent enrollment and mTLS traffic
scim.tenvyr.com      SCIM provisioning
docs.tenvyr.com      documentation

Route each origin only to its intended service. Do not expose internal database, queue, or key-management endpoints.

Security dependencies

Production requires governed:

• TLS certificates and renewal;
• database backup, restore, and migration;
• encryption keys for stored provider credentials;
• signing keys for SSH and desired-state trust;
• webhook signing secrets;
• OIDC and SCIM credentials;
• audit retention and export;
• time synchronization; and
• monitoring and incident response.

Separate key custodianship and infrastructure administration where practical.

Deployment order

1. Establish DNS, TLS, network boundaries, and secret storage.
2. Deploy the data layer and apply controlled migrations.
3. Deploy application, agent, and SCIM services to their intended origins.
4. Bootstrap the first tenant owner through the approved secure procedure.
5. Configure audit export and alerting.
6. Add identity integrations with a pilot assignment.
7. Enroll lab and canary hosts.
8. Run the production readiness checks.
9. Expand in bounded waves.

Availability and recovery

Define recovery objectives for:

• interactive login and access approval;
• agent desired-state polling and heartbeat;
• SCIM lifecycle updates;
• audit export; and
• signing or encryption key services.

Test a database restore and a signing-key recovery procedure before onboarding production hosts. A backup that has not been restored is not a verified recovery path.

Change control

Treat schema migrations, signing-key changes, host-group CA rotation, identity provider changes, and SSH desired-state changes as security-sensitive releases. Use canaries, observable halt criteria, and a documented rollback owner.