Deployment

The service runs as a container. Building from a clone needs no registry access and is the quickest way to get an instance up:

git clone https://github.com/AI-team-UoA/RECITALS-cryptography-manager.git
cd RECITALS-cryptography-manager

docker build -t recitals-cryptography-manager .
docker run -p 6001:6001 \
  -v "$(pwd)/config.yaml:/app/config.yaml:ro" \
  -v crm-audit:/app/audit \
  recitals-cryptography-manager

Prebuilt images are published to ghcr.io/ai-team-uoa/recitals-cryptography-manager on every push to main, tagged latest, main and sha-<commit>. Pushing a vX.Y.Z git tag also publishes X.Y.Z and X.Y, which is what a deployment should pin.

For a platform deployment, deploy/uc3/ holds a Compose template and an annotated .env.example. The template pins the image by digest, keeps the audit and budget state in a named volume, and runs the container read-only with no capabilities. Copy both files and config.yaml to the deployment repository and fill in the .env.

The package is currently private. Pulling it requires authenticating to the registry with a personal access token carrying the read:packages scope, and membership of the organisation:

echo "$GITHUB_TOKEN" | docker login ghcr.io -u YOUR_USERNAME --password-stdin
docker pull ghcr.io/ai-team-uoa/recitals-cryptography-manager:latest

An organisation owner can make it public from the package's settings page, after which the pull works anonymously and no login is needed.

The image runs as an unprivileged user, exposes port 6001 and carries a healthcheck against /health. Audit records and privacy budget state are written to /app/audit, which is declared as a volume: a privacy budget that resets when the container is replaced is not a guarantee of anything.

Images are linux/amd64 only, because PyDP publishes x86_64 manylinux wheels and no aarch64 build.

For local development and integration testing, docker-compose.yml brings the service up alongside stand-ins for the three downstream services it forwards audit records to, so that path is genuinely exercised rather than merely configured. It builds from the working tree, so it needs no registry access either:

docker compose up --build
docker compose logs -f ledger compliance identity   # watch records arrive

.github/workflows/ci.yml runs the linter, the type checker and the test suite on Python 3.10, 3.11 and 3.12, then builds the image, smoke-tests it, and publishes to the registry. Pull requests build the image to prove the Dockerfile still works but never publish it.