Production

The long-form runbook is docs/PRODUCTION.md in the xorappsec engine repository. Packaging (Helm, Kubernetes, systemd, production Compose) is in xorappsec-deploy. This page is the published summary.

Checklist

• Set XORAPPSEC_MGMT_TOKEN; do not publish :9090
• TLS on xorappsec or on a terminator listed in trusted-proxies
• Persist data-dir
• Start assets in detect-learn
• Choose fail-open deliberately
• Scrape /metrics; load prometheus/alerts.yaml from xorappsec-deploy
• xorappsec doctor --require-mgmt-auth is green

Deploy

# from xorappsec-deploy, after building xorappsec:1.0.0 from the engine repo
helm install xorappsec ./helm/xorappsec \
  --set upstream=http://my-app:80 \
  --set mgmtToken="$XORAPPSEC_MGMT_TOKEN" \
  --set failOpen=false

XORAPPSEC_MGMT_TOKEN=… docker compose -f docker-compose.prod.yml up --build