Deployment

Deployment is Kubernetes-only for the platform.

Environment	Cluster	Images	Reverse proxy
Local	k3d	nerdctl → k3d import	Traefik
Production	k3s	nerdctl → registry	Traefik

Docker Compose and nginx are not used for the platform stack.
Docker Engine is only required on developer machines to run k3d.

Guides

• Local development — bun --bun run k8s:up (default profile: core)
• Production — push, secrets, bun --bun run k8s:deploy -- k3s
• Version skew — cumulative auth/web image builds during deploy
• Tooling — k3d, k3s, nerdctl, Lima, mkcert, Traefik
• Infrastructure overview

Build before deploy

# Libraries / apps (TypeScript), when needed outside container build:
bun install
# Images (always for cluster deploys):
K8S_PROFILE=core bun --bun run k8s:build-images             # local default
K8S_PROFILE=minimal bun --bun run k8s:build-images          # backend only
K8S_PROFILE=full bun --bun run k8s:build-images             # all app images
REGISTRY=… IMAGE_TAG=… bun --bun run k8s:push-images        # prod

Local deploy also supports K8S_PROFILE / K8S_SERVICES — see Local development.

Health checks

App	/live	/ready
api, ingest	Bun route → Yoga	DB + Redis (checkHealth)
worker	Bun route	Postgres only
auth, web	(healthcheck)/{live,ready}/+server.ts	Process up (200 OK)
device-detector	live.php (Apache)	Composer autoload (ready.php)
tools	Bun route (local dev only, not in k8s)	200 OK

API and ingest must register /live and /ready on Bun.serve({ routes }) (see apps/api/src/server.ts). Yoga config alone returns 404 via Bun’s fallback fetch.

Auth and web expose /live and /ready via the (healthcheck) route group (+server.ts, same pattern as sso/*). Hooks only skip paraglide/rate-limit for those paths.

curl -sk https://api.plus261.local/live
curl -sk https://api.plus261.local/ready
curl -sk https://plus261.local/ready
curl -sk https://device-detector.plus261.local/live

Rollback

Prefer redeploying a previous image tag via the k3s overlay, or:

kubectl -n plus261-app rollout undo deploy/<name>