Production cutover

Release the public services in stages and verify each stage before enabling the next integration.

The app stays on one container and one worker (GRANIAN_WORKERS=1). Back up data/, images/, and maintenance/ before each update, then roll the single app container forward with the reviewed immutable image.

The eight canonical image queue and concurrency settings are restart-required; after changing them, replace the single app container through the sequence below. MAX_SSE_SUBSCRIBERS_GLOBAL, MAX_SSE_SUBSCRIBERS_PER_IP, SSE_CONNECTION_TTL_SECONDS, and GENERATE_SOURCE_ATTEMPTS are hot-reloadable through Overall Config; updated values apply only to subsequent connections or requests and do not require a restart.

Domain and TLS

Create A records for the domains that are actually ready. Configure certificates and the reverse proxy in 1Panel. The app should receive traffic through its configured public origin and should listen only on its private application port, such as 127.0.0.1:19091.

Do not publish the internal Meteroid, database, queue, or secret services.

Documentation

Build the VitePress site and publish docs/.vitepress/dist/ as the static root for docs.jumpcli.com. Verify the homepage, a deep link, search, the new logo, and the language menu.

Workspace

Set the production origin and allowed host to the exact app domain. Enable secure cookies and forwarded-header handling only when the reverse proxy address is explicitly trusted. When the proxy and app run on this host-network 1Panel deployment, set the trusted source to exactly 127.0.0.1/32. A container-network proxy needs a separately reviewed preflight policy before it is supported.

Update sequence:

1. Back up the persistent data volumes first.
2. Build the reviewed release once, store the immutable APP_IMAGE=sha256:... and matching APP_VERSION, and recreate only the single app container with --no-build --pull never.
3. Verify /ready, a real sign-in, and the workspace in a clean browser profile.
4. If health checks or browser smoke tests fail, restore the previous verified image and env values before shifting traffic.

Keep data/, images/, and maintenance/ on persistent, writable mounts. Build the reviewed release once with scripts/production_build_release.sh, store its immutable APP_IMAGE=sha256:... and matching APP_VERSION in .env, then recreate the Compose project with --no-build --pull never. Verify /ready with the correct Host header and run scripts/production_preflight.sh.

In a clean browser profile, anonymous /workspace must render the complete read-only example project and all six bundled images. Its network trace must not include protected jobs, gallery, settings, billing, generation, upload, thumbnail, SSE, or WebSocket requests. After sign-in, the real tenant runtime must replace the fixture completely; example data must never enter tenant storage.

Authentication, billing, and payment

Enable Casdoor OIDC only after the exact callback URL is configured:

https://app.jumpcli.com/api/identity/callback

Create and publish Meteroid plans before exposing paid checkout. Add Alipay only after server-side signature validation, notification replay handling, and fulfillment tests are complete. A browser redirect must never grant credits by itself.

Acceptance flow

Use a controlled test account to verify registration, sign in, password recovery, plan display, trial activation, one generation, job status, gallery persistence, logout, and a clean re-login. Keep formal payment and paid entitlements disabled until the complete notification and fulfillment path has passed.

For the detailed operator checklist, see the Chinese production guide.