# Deployment — Compass / NHS (school.lab.audasmedia.com.au)

Own image, own container, own port **8792**, host `.13` (nixos-desktop). Caddy
on `.35` (sam-ubuntu1) terminates TLS and proxies to `192.168.20.13:8792`.

## Ports

| Port | Service |
|---|---|
| 8792 | Compass / NHS (this project) |

## Host (.13)

1. Project folder: `/home/sam/paseo/projects/compass_teams_nhs`.
2. Data: the named volume `compass-teams-nhs_compass-teams-nhs-data` at `/data`
   (SQLite `school.db`).
3. Create the environment file from the example:

   ```bash
   cd /home/sam/paseo/projects/compass_teams_nhs
   cp environment.d/school-service.env.example environment.d/school-service.env
   chmod 600 environment.d/school-service.env
   # fill SCHOOL_SESSION_SECRET, SCHOOL_ADMIN_PASSWORD_HASH
   ```

4. Build and start:

   ```bash
   docker compose up -d --build
   docker compose ps          # compass-teams-nhs  Up (healthy)  0.0.0.0:8792->8792/tcp
   ```

5. Verify:

   ```bash
   make verify-phase1
   ```

## Caddy (.35)

1. SSH: `ssh sam@192.168.20.35`.
2. Append `deploy/caddy/Caddyfile.snippet` to `/Docker/Containers/caddy/Caddyfile`.
3. Validate and reload (never restart):

   ```bash
   docker exec caddy caddy validate --config /etc/caddy/Caddyfile
   docker exec caddy caddy reload   --config /etc/caddy/Caddyfile
   ```

4. Test: `curl -sS -o /dev/null -w '%{http_code}\n' https://school.lab.audasmedia.com.au/health`

## Notes

- `.13` has every default Docker address pool subnetted out. This single-container
  service therefore uses `network_mode: bridge` and publishes 8792; it does not
  create a project network.
- The env file is gitignored. School credentials and harness session state are
  secrets (AGENTS.md §10 rule 3); they never enter git.