---
type: User Story
title: Deploy and operate the platform securely
description: Operators have repeatable builds, migrations, credential provisioning, configuration, and security checks.
tags: [operations, security, database, deployment]
timestamp: 2026-08-01T19:46:09Z
story_id: US-015
status: verified
---

# User Story

As a platform operator, I want reproducible deployment and security controls, so that the portal, bot, database, and proxy can be operated safely.

# Acceptance Criteria

- [x] The repository is an npm TypeScript workspace with separate web, bot, contract, database, network, and Minecraft modules.
- [x] PostgreSQL is available through Docker Compose for local use.
- [x] Drizzle changes use generated, versioned migrations rather than schema push.
- [x] Velocity credentials can be provisioned or rotated with a one-time-displayed token stored only as a hash.
- [x] The Velocity Gradle wrapper produces a tested shaded JAR.
- [x] Environment examples document database, Keycloak, Discord, trusted proxy, and ProxyCheck settings without secrets.
- [x] The web application sets CSP, framing, MIME, referrer, and permissions headers.
- [x] The web runtime provides a dependency-free health endpoint for orchestration probes.
- [x] npm dependency audit and Semgrep security review complete without findings at the last verified change.
- [x] Architecture, Keycloak, API error, security, bot, and Velocity operating documentation is available.

# Implementation

- [`package.json`](../package.json)
- [`compose.yml`](../compose.yml)
- [`packages/database/drizzle`](../packages/database/drizzle)
- [`packages/database/scripts/create-plugin-credential.ts`](../packages/database/scripts/create-plugin-credential.ts)
- [`plugins/velocity/build.gradle.kts`](../plugins/velocity/build.gradle.kts)
- [`apps/web/next.config.ts`](../apps/web/next.config.ts)

# Validation

Use `npm test`, `npm run typecheck`, `npm run lint`, `npm run build`, `npm run velocity:build`, `npm audit`, and `npm run design:validate`.

# Related Stories

- [Administrator SSO](us-011-admin-sso.md)
- [Standardize API errors](us-014-problem-details.md)
- [Build and publish versioned releases](us-016-automated-releases.md)