Production Deployment - MQUAD Platform

Production Configuration

For production, use production.compose.yaml with additional security and scaling configurations.

Traefik TLS

Configure Traefik for automatic TLS via Let's Encrypt:

# api-gateway/traefik/traefik.yaml
certificatesResolvers:
  letsencrypt:
    acme:
      email: admin@mquad.org
      storage: /certificates/acme.json
      httpChallenge:
        entryPoint: web

entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
  websecure:
    address: ":443"

Secrets Management

Never store secrets in environment files. Use Docker secrets or a vault:

secrets:
  db_password:
    file: ./secrets/db_password.txt
  stripe_api_key:
    external: true # Managed externally

services:
  backend:
    secrets:
      - db_password
      - stripe_api_key

Database Backups

Automate PostgreSQL backups:

#!/bin/bash
# pg_dump for each service database
SERVICES="appdb survey_db data_db sync_db analytics_db workspace_db webhook_db odk_db mquad_forms_db media_db notification_db audit_db feature_flags_db"

for DB in $SERVICES; do
  pg_dump -h localhost -p 5433 -U appuser -d $DB \
    > /backups/${DB}_$(date +%Y%m%d_%H%M%S).sql
done

Scaling Considerations

Horizontal Scaling

Each service can be scaled independently:

services:
  backend:
    deploy:
      replicas: 3

  survey-service:
    deploy:
      replicas: 2

  webhook-worker:
    deploy:
      replicas: 2

Database Connection Pool

PostgreSQL is configured with up to 500 connections:

services:
  postgres:
    command: ["postgres", "-c", "max_connections=500"]

Celery Worker Scaling

Each service has dedicated Celery workers with queue isolation:

services:
  backend-worker:
    command: celery -A api.infrastructure.messaging.celery_worker worker -Q backend_celery --concurrency=4

  webhook-worker:
    command: celery -A api.infrastructure.messaging.celery_worker worker -Q webhook --concurrency=2

Health Checks

Every service exposes a health endpoint. Configure Docker health checks:

services:
  backend:
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/api/v1/health/"]
      interval: 30s
      timeout: 10s
      retries: 3