# GoChat production bundle

This directory is a source-free delivery package. It contains the GoChat and
Shangwutong images plus every repository file referenced by the production
Compose configuration.

```bash
sha256sum -c SHA256SUMS
docker load --input images/gochat-*-images.tgz
cp .env.example .env
# Replace every CHANGE_ME value and create the external secret/mount paths.
deploy/docker/deploy.sh .env --allow-local-images
```

`--allow-local-images` is only for this SHA256-verified bundle, whose loaded
application images use source-versioned local tags. For registry promotion,
replace both application image references with immutable `@sha256:` digests and
run the same command without that flag:

```bash
deploy/docker/deploy.sh .env
```

The bundle uses source-versioned local image tags so it can start immediately
after `docker load`; `SHA256SUMS` protects the handoff. Registry-based
production promotion requires immutable `@sha256:` references and the strict
preflight performed by `deploy.sh` without `--allow-local-images`.

See `docs/ops/02-production-operations.md` for TLS, backup, rollback, and drill
requirements.