Deployment Guide

1. System User and Directories

# Create system user
sudo useradd -r -s /bin/false race-app
sudo mkdir -p /opt/race-console
sudo mkdir -p /var/log/race-console
sudo chown race-app:race-app /opt/race-console /var/log/race-console

# Create application directory structure
cd /opt/race-console
sudo -u race-app mkdir -p {config,logs,static,templates}

2. Python Environment

# Install Python dependencies
sudo apt update
sudo apt install python3-pip python3-venv postgresql-client

# Create virtual environment
sudo -u race-app python3 -m venv /opt/race-console/venv
sudo -u race-app /opt/race-console/venv/bin/pip install --upgrade pip

# Install application dependencies
sudo -u race-app /opt/race-console/venv/bin/pip install -r requirements.txt

3. Database Setup

# PostgreSQL installation and configuration
sudo apt install postgresql postgresql-contrib

# Create database and user
sudo -u postgres createdb race_console_prod
sudo -u postgres createuser race_app
sudo -u postgres psql -c "ALTER USER race_app WITH PASSWORD 'your_secure_password';"
sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE race_console_prod TO race_app;"

# Initialize database schema
export DATABASE_URL="postgresql://race_app:your_secure_password@localhost/race_console_prod"
/opt/race-console/venv/bin/python -c "from app import db; db.create_all()"

Environment Variables

Create /opt/race-console/.env with production settings:

# Database Configuration
DATABASE_URL=postgresql://race_app:your_secure_password@localhost/race_console_prod

# Security Settings
SESSION_SECRET=your_very_long_random_secret_key_here
FLASK_ENV=production
SECRET_KEY=another_very_long_random_secret_key

# AVEVA CONNECT Configuration (optional defaults)
CONNECT_TENANT_ID=your_tenant_id
CONNECT_NAMESPACE_ID=your_namespace_id
CONNECT_CLIENT_ID=your_client_id
CONNECT_CLIENT_SECRET=your_client_secret

# Logging Configuration
LOG_LEVEL=INFO
LOG_FILE=/var/log/race-console/app.log

# Performance Settings
WORKERS=4
WORKER_CONNECTIONS=1000
TIMEOUT=30

Application Configuration

Update /opt/race-console/config/app_config.json:

{
  "monitoring": {
    "poll_interval": 30,
    "batch_size": 100,
    "timeout": 10,
    "retry_attempts": 3
  },
  "events": {
    "max_age_days": 90,
    "cleanup_interval_hours": 24,
    "batch_cleanup_size": 1000
  },
  "security": {
    "session_timeout": 3600,
    "max_login_attempts": 5,
    "lockout_duration": 300
  },
  "performance": {
    "cache_timeout": 300,
    "max_concurrent_requests": 50,
    "database_pool_size": 20
  }
}

Systemd Service File

Create /etc/systemd/system/race-console.service:

[Unit]
Description=RACE Management Console
After=network.target postgresql.service
Requires=postgresql.service

[Service]
Type=exec
User=race-app
Group=race-app
WorkingDirectory=/opt/race-console
Environment=PATH=/opt/race-console/venv/bin
EnvironmentFile=/opt/race-console/.env
ExecStart=/opt/race-console/venv/bin/gunicorn --bind 0.0.0.0:5000 --workers 4 --timeout 30 --keep-alive 2 --max-requests 1000 --max-requests-jitter 100 main:app
ExecReload=/bin/kill -s HUP $MAINPID
Restart=always
RestartSec=10

# Security settings
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/opt/race-console /var/log/race-console

[Install]
WantedBy=multi-user.target

Service Management

# Enable and start the service
sudo systemctl daemon-reload
sudo systemctl enable race-console.service
sudo systemctl start race-console.service

# Check service status
sudo systemctl status race-console.service

# View logs
sudo journalctl -u race-console.service -f

Nginx Configuration

Create /etc/nginx/sites-available/race-console:

server {
    listen 80;
    server_name race-console.your-domain.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name race-console.your-domain.com;

    # SSL Configuration
    ssl_certificate /etc/ssl/certs/race-console.crt;
    ssl_certificate_key /etc/ssl/private/race-console.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512;
    ssl_prefer_server_ciphers off;

    # Security headers
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

    # Proxy settings
    location / {
        proxy_pass http://127.0.0.1:5000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_redirect off;
        
        # WebSocket support (if needed)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    # Static files
    location /static {
        alias /opt/race-console/static;
        expires 1y;
        add_header Cache-Control "public, immutable";
    }

    # Logging
    access_log /var/log/nginx/race-console.access.log;
    error_log /var/log/nginx/race-console.error.log;
}

Enable Site

# Enable the site
sudo ln -s /etc/nginx/sites-available/race-console /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx