cd /path/to/ittisal
docker compose -f license-server/deploy/docker-compose.yml \
  --env-file license-server/deploy/.env up -d --build

./license-server/deploy/scripts/verify-production-env.sh
curl -s https://lic.ittisal.app/api/v1/health/ready | jq

Never use plain docker compose up without production env file — breaks Redis auth.

• nginx :443 → console :4100, API :3100
• Postgres 127.0.0.1:5440
• Redis internal (rate limits)
• Signing key: deploy/secrets/license-signing.key

curl -s https://lic.ittisal.app/api/v1/health/ready
docker compose -f license-server/deploy/docker-compose.yml logs -f license-api

docker compose -f license-server/deploy/docker-compose.yml exec -T license-db \
  pg_dump -U license ittisal_license | gzip > license-db-$(date +%F).sql.gz

Restore procedure, signing key compromise, and incident response: see docs/license/RECOVERY.md

1. Run deploy/scripts/rotate-signing-key.sh
2. Deploy new PEM to all API nodes
3. Add public key to packages/license-core
4. Console → Key rotation → Re-issue all (FIDO / break-glass)

LICENSE_SERVER_URL=https://lic.ittisal.app/api/v1

Set on SaaS platform; enables lease check-in sweeper.

• WRONGPASS Redis — use production compose + env file only
• CORS — LICENSE_ALLOWED_ORIGINS=https://lic.ittisal.app
• No email — Settings → SMTP or LICENSE_SMTP_*
• UNKNOWN_KEY on platform — public key missing in license-core
• STALE check-in — platform must apply self-heal signedLic

Full table: docs/license/TROUBLESHOOTING.md

• docs/license/README.md — hub
• docs/license/DEPLOYMENT.md — Linux, Docker, K8s
• docs/license/API.md — REST reference
• docs/license/ARCHITECTURE.md — design
• license-server/SECURITY_CHECKLIST.md — go-live checklist