go-sip/deploys/physical-deployment.md

Physical production deployment

This is the target host layout, not an approved deployment of the current binary. The current business commands are isolated Mock-only and reject mixed/real before opening resources; the local release manifest has production_approval=false. Neither the steps below nor a local package/check authorize real services or calls. Native Asterisk loading and required non-production diagnostics still need separate evidence.

Production is a small systemd installation on Debian 13 amd64:

1. native Asterisk Cell (asterisk.service), owned by the approved SIP management release;
2. sip-go-agent-agent.service;
3. sip-go-agent-dispatcher.service.

This project does not run production services in Docker and does not install RabbitMQ, OSS, AI or SaaS infrastructure. Those systems are supplied through injected endpoints and credentials.

The pinned versions are in versions.lock.json. Build a release candidate with build-package.sh; it writes the archive to dist/packages/ and is intentionally not production-approved. Production installation requires a clean, externally approved manifest. Build/install Asterisk separately with the scripts in cell/. The Asterisk installer preserves /etc/asterisk; the management-approved static Cell configuration is installed separately.

The Go installer creates /opt/sip-go-agent, /etc/sip-go-agent and /var/lib/sip-go-agent, installs the two Go units, and enables them. It does not install test tooling, Docker, a broker, provider SDK credentials or AI snapshots. Start services only after the injected environment, mTLS identity, broker ACL and static Cell artifact have been reviewed.

For local or isolated testing, use the Docker-backed RabbitMQ target make mq-integration-local. Use test/nonprod-call-evidence.sh for the required capture-first gate when testing against a native non-production Asterisk host. Neither path is part of the production package.