Choose a Deployment Profile
Choose a profile from requirements you can verify. Caracal ships deployment mechanics; it does not certify capacity, high availability, multi-region operation, or a cloud service.
Decision
Section titled “Decision”| Requirement | Use | Do not infer |
|---|---|---|
| Local development from source | caracal up with development Compose | Production hardening |
| One Docker host with bundled stores | Installed runtime and packaged Compose | Host redundancy or zero downtime |
| Kubernetes 1.30+ with operator dependencies | Helm chart | A tested SLO or managed stores |
| Declarative chart installation | caracalStack OpenTofu module | Resources beyond namespace, optional Secret, and Helm release |
| Provider-neutral VM bootstrap | caracalHost OpenTofu module | VM, firewall, TLS, backup, or monitoring creation |
Prerequisites
Section titled “Prerequisites”Define ingress, recovery objectives, storage ownership, secret delivery, monitoring, and maintenance policy. If availability matters, prove it in your environment; replicas, PDBs, HPAs, and atomic upgrades are mechanisms, not guarantees.
Safe Procedure
Section titled “Safe Procedure”- Use
devonly on a local development host. - Pin a release and use
stablefor production evaluation. - Keep Compose ports loopback-bound; add an operator-owned TLS proxy for remote access.
- For Helm, provide Postgres, Redis, runtime Secret, ingress, and network egress explicitly.
- Establish backup, restore, metrics, alerts, and incident ownership before production traffic.
Verify
Section titled “Verify”Confirm assets render, secrets resolve, migrations finish, and /ready passes. Run a canary token exchange and Gateway request, then locate its audit evidence.
Rollback or Recovery
Section titled “Rollback or Recovery”Keep the prior release and values. Restore data only from a tested backup and restore secrets separately. Helm rollback never reverses database migrations.