# VPS deployment

The public topology keeps GPU claims honest:

```text
backplane.cyberelf.link
  -> Nginx on vps2
      /api/* -> Backplane Runtime evidence backend on 127.0.0.1:8994
      /*      -> validated Sites deployment
```

The VPS service runs the real control plane—tenant routing, card manifests,
policy, memory, exact compute, limits, batching, and receipts—but uses the
deterministic evidence backend. GPU model execution remains a self-hosted
runtime path through `TransformersBackend` or `VLLMBackend`.

## Deployment

Build the wheel and pass the deployed Sites origin host to the atomic release
script:

```bash
python -m pip wheel . --no-deps --wheel-dir dist-py
./deploy/deploy_vps2.sh <sites-origin-host> vps2
```

The script uploads one wheel, creates a timestamped virtual environment, keeps
the previous `current` target for rollback, installs the systemd and Nginx
surfaces, issues the dedicated certificate when absent, and runs internal plus
public health checks before reporting success.

## Manual first deployment

1. Build, save, and deploy the site.
2. Replace `__SITE_HOST__` in the Nginx template with the Sites deployment host.
3. Install `nginx.bootstrap.conf`, reload Nginx, and issue a dedicated certificate:

   ```bash
   sudo mkdir -p /var/www/backplane-acme
   sudo certbot certonly --webroot -w /var/www/backplane-acme \
     -d backplane.cyberelf.link --non-interactive --agree-tos \
     --email justin@cyberelf.link
   ```

4. Install the final Nginx file and `backplane-runtime.service`.
5. Build a virtual environment in a timestamped release, install the wheel,
   switch `/opt/backplane-runtime/current`, restart, and check:

   ```bash
   curl --fail http://127.0.0.1:8994/api/health
   curl --fail https://backplane.cyberelf.link/api/health
   ```

Do not proxy the research Workbench server from `C:\Backplane`; it has a global
mutable model and was never designed as a hostile public boundary.
