Skip to main content
Use an authorized checkout and the documented Node/pnpm versions. The supported path here is an operator-managed Node process behind your HTTPS proxy. Container packaging has a known prerequisite described below.

​
Build the application

Build before production startup. Supply configuration through your shell or secret manager: Node startup does not automatically load .env files.

​
Configure the production process

Set these deployment-owned values. The origin and directory below are synthetic examples; replace them with resources you control. Inject fresh secrets rather than putting their literal values into a script or shell history.
BUGSPRAY_ADMIN_PASSWORD must be at least 12 characters and QA_SUITE_TOKEN at least 32. Production requires an explicit HTTPS public origin and access control. Keep the data directory private and writable by the app’s operating-system user. Configure your service manager to use the checkout as its working directory and restart the process deliberately.

​
Put HTTPS in front

Configure an operator-owned reverse proxy for the exact public origin, forwarding to the loopback listener. Preserve the intended Host/origin relationship and support streaming MCP responses and uploads. Test unauthenticated UI access, successful sign-in, authorized API calls and rejected wrong-origin mutations. Do not disable Host/origin validation to make a proxy work. The bootstrap REST token is for internal/legacy bridging. Administrator mutations require a signed-in UI session. Hosted OAuth/service-token semantics should not be assumed for an ordinary Node installation.

​
Add only required capabilities

Leave provider variables unset until you deliberately configure integrations. Install Chromium and recording dependencies before browser use. Enable repro execution only after accepting the trust model.

​
Compose is not ready as a copy-and-run path

The current Dockerfile dependency-install layer omits required vendor/*.tgz inputs. Fix and validate that packaging before building an image. Then use the existing .env.production.example, a private populated environment file and the repository’s Compose definition behind your HTTPS proxy. Preserve its data volume; down -v destroys persistent data and is not an upgrade procedure. Read the existing deployment runbook for container commands once that prerequisite is resolved. This guide does not certify a Linux container build or publish an image.