# Production deployment

These files are the non-secret, host-specific deployment manifests for the
initial x1/x2/lithium topology.

- Install the x1 and x2 files as
  `~/compose/ArchiveControl-cache/{compose.yaml,client.toml}`.
- Install the lithium files as
  `~/compose/ArchiveControl-archive/{compose.yaml,client.toml}`.
- Create sibling `state`, `backups`, and `secrets` directories owned by the
  configured container UID/GID.
- Secret files are never committed. Each `secrets` directory contains
  `archive_control_token`, `qb_password`, and `syncthing_api_key`, each a
  regular non-empty file with mode `0600`.

The Syncthing mounts intentionally reproduce each instance's `/var/syncthing`
layout, including nested data binds. This lets route discovery and route
provisioning use one safe API-to-local path mapping without altering an
existing Syncthing configuration.

Before starting a stack, validate it with:

```sh
docker compose config
docker compose run --rm archive-client --check-config
```

The check is fail-fast and performs local permission, filesystem, sparse-file,
hard-link, and reflink probes. Normal startup additionally probes the local
qBittorrent and Syncthing APIs before registration.