Tracking issue for the U12 capture half (roundup plan U12, R11/R13).
Scope: promote the hand-rolled DEV server state into the repo as committed, placeholder-parameterized IaC:
deploy/compose.dev.yaml — the live DEV stack (verified byte-identical to the running /opt/ontokit/compose.yaml at capture, 2026-08-10)deploy/traefik/ontokit-dev.yaml — proxy file-provider config (post-auth-flip: no basic-auth gate; ClientIP-exempt internal router)deploy/firewall/ — idempotent port-lockdown script + systemd oneshot (replaces rules files that had no restore mechanism)deploy/.env.example — the 12-key env contract, placeholders onlydeploy/RUNBOOK.md — bootstrap/deploy/rollback/gotchas- deletes
railway.json (superseded by the KD4 topology ruling)
The auto-deploy CI workflow half is deferred (blocked on a deploy keypair + CI).
PR: alea-institute/ontokit-api (branch feat/u12-dev-iac, stacked on feat/u7-zitadel-standup).
🤖 Generated with Claude Code
Tracking issue for the U12 capture half (roundup plan U12, R11/R13).
Scope: promote the hand-rolled DEV server state into the repo as committed, placeholder-parameterized IaC:
deploy/compose.dev.yaml— the live DEV stack (verified byte-identical to the running/opt/ontokit/compose.yamlat capture, 2026-08-10)deploy/traefik/ontokit-dev.yaml— proxy file-provider config (post-auth-flip: no basic-auth gate; ClientIP-exempt internal router)deploy/firewall/— idempotent port-lockdown script + systemd oneshot (replaces rules files that had no restore mechanism)deploy/.env.example— the 12-key env contract, placeholders onlydeploy/RUNBOOK.md— bootstrap/deploy/rollback/gotchasrailway.json(superseded by the KD4 topology ruling)The auto-deploy CI workflow half is deferred (blocked on a deploy keypair + CI).
PR: alea-institute/ontokit-api (branch
feat/u12-dev-iac, stacked onfeat/u7-zitadel-standup).🤖 Generated with Claude Code