Deployment Overview
SAPOT is a multi-component system deployed as independent services on a LAN.
The established bare-metal/systemd path below remains supported. For an offline site that uses Docker Engine and a prebuilt immutable artifact, use the offline Docker bundle guide instead, and follow install-ubuntu-server.md for the first install on a fresh Ubuntu Server 24.04 host.
Components and deployment units
Each component runs as its own OS process on the same host (or split across hosts on the same LAN), with systemd supervising the long-running services.
| Component | Process | Managed by |
|---|---|---|
| FastAPI server | Gunicorn + uvicorn workers | systemd server-main-api.service |
| Nginx reverse proxy | nginx | systemd |
| MariaDB | mysqld | systemd |
| Redis | redis-server | systemd |
| Admin frontend | next start | systemd or manual |
| GSM module API | Gunicorn + uvicorn | systemd server-GSM-api.service |
| Tileserver | tileserver binary | systemd tileserver.service |
| MikroTik router | RouterOS (vendor) | RouterOS web UI |
Deployment prerequisites
Install these on the host before starting any component; the Nix flake per component can substitute for the manual Python/Node setup.
- Linux host (tested Debian/Ubuntu)
- Nix package manager (optional —
flake.nixper component) - Python 3.11+ with venv
- Node.js + pnpm (admin frontend)
- MariaDB server
- Redis server
- Nginx
- TLS certificate at
/home/sapot/certs/server.crtandserver.key
Network requirements
SAPOT is LAN-first (see ADR 0005) — the server must be reachable at a stable address on the same subnet as mobile devices.
- Static IP or DHCP reservation for the server on the LAN
- MikroTik router for captive portal (optional)
- Mobile devices on the same LAN subnet
Deployment order
Later steps depend on earlier ones being up — start data stores before the API, and the API before anything that proxies or calls it.
- Start MariaDB and Redis
- Start SAPOT FastAPI server (creates DB tables on first run)
- Start Nginx (proxy to
:8000) - Start GSM module API (if hardware connected)
- Start tileserver
- Build and serve admin frontend
Detailed guides
- server.md
- mobile-eas.md
- admin-frontend.md
- gsm-module.md
- tileserver.md
- environment-config.md
- secrets-management.md
- monitoring-logging.md
- runbooks.md — backup/restore, manual DDL application, TLS rotation, rollback, disaster recovery
- incident-response.md — severity levels, roles, and communication process during a live incident
- maintenance.md — recurring backup/cert/log/dependency upkeep schedule