# Production Deployment {#production-deployment}



## Production Configuration {#production-configuration}


For production, use `production.compose.yaml` with additional security and scaling configurations.


## Traefik TLS {#traefik-tls}


Configure Traefik for automatic TLS via Let's Encrypt:

```yaml
# api-gateway/traefik/traefik.yaml
certificatesResolvers:
  letsencrypt:
    acme:
      email: admin@mquad.org
      storage: /certificates/acme.json
      httpChallenge:
        entryPoint: web

entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
  websecure:
    address: ":443"
```


## Secrets Management {#secrets-management}


Never store secrets in environment files. Use Docker secrets or a vault:

```yaml
secrets:
  db_password:
    file: ./secrets/db_password.txt
  stripe_api_key:
    external: true # Managed externally

services:
  backend:
    secrets:
      - db_password
      - stripe_api_key
```


## Database Backups {#database-backups}


Automate PostgreSQL backups:

```bash
#!/bin/bash
# pg_dump for each service database
SERVICES="appdb survey_db data_db sync_db analytics_db workspace_db webhook_db odk_db mquad_forms_db media_db notification_db audit_db feature_flags_db"

for DB in $SERVICES; do
  pg_dump -h localhost -p 5433 -U appuser -d $DB \
    > /backups/${DB}_$(date +%Y%m%d_%H%M%S).sql
done
```


## Scaling Considerations {#scaling-considerations}



### Horizontal Scaling {#horizontal-scaling}


Each service can be scaled independently:

```yaml
services:
  backend:
    deploy:
      replicas: 3

  survey-service:
    deploy:
      replicas: 2

  webhook-worker:
    deploy:
      replicas: 2
```


### Database Connection Pool {#database-connection-pool}


PostgreSQL is configured with up to 500 connections:

```yaml
services:
  postgres:
    command: ["postgres", "-c", "max_connections=500"]
```


### Celery Worker Scaling {#celery-worker-scaling}


Each service has dedicated Celery workers with queue isolation:

```yaml
services:
  backend-worker:
    command: celery -A api.infrastructure.messaging.celery_worker worker -Q backend_celery --concurrency=4

  webhook-worker:
    command: celery -A api.infrastructure.messaging.celery_worker worker -Q webhook --concurrency=2
```


## Health Checks {#health-checks}


Every service exposes a health endpoint. Configure Docker health checks:

```yaml
services:
  backend:
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/api/v1/health/"]
      interval: 30s
      timeout: 10s
      retries: 3
```