VENTEXCONNECTSECURITAS EX VIGILANTIADOCS
DEEN
Open Connect
ARC-04 / 9 MIN / 02 AUG 2026

Production operation and deployment

System boundaries, minimum components and safe publication on a dedicated server.

State: controlled MVP · not externally audited
MaturityPrepared framework
Review basisRepository-aligned
Reviewed2026-08-09
01

Minimum topology

The installable PWA, public product site and API are separate applications. PostgreSQL stores structured records, Redis coordinates realtime state and object storage holds private file ciphertext.

app.ventex-connect.com   -> web / PWA + same-origin API
www.ventex-connect.com   -> product site
docs.ventex-connect.com  -> controlled documentation
status.ventex-connect.com-> measured public status
                          -> PostgreSQL / Redis / Object Storage
02

Public edge

Only the TLS reverse proxy listens publicly on ports 80 and 443. Databases, cache, object storage and internal application ports remain on a private network or localhost.

  • Automated TLS with HSTS
  • Rate limits in front of sign-in and sensitive APIs
  • No public administration consoles
  • Separate production and test secrets
  • Verify DNS and certificates for every subdomain
03

Operational minimum

A successful container start is not a reliable service. Recovery, alerting and update procedures must work in practice before release.

  • Encrypted off-site backups
  • Recovery drill with measured RPO and RTO
  • System and application monitoring
  • Timely security updates
  • Documented incident and key-change process
04

Status measurement

The public status portal checks only explicitly configured health endpoints. Public targets use HTTPS; the API readiness probe may additionally use only the fixed Docker service name on the isolated network. Unconfigured components appear as not monitored and are never silently shown as available.