ANQ Publish

From a build to something people can use

Building the application is only one part of getting it into use. ANQ Publish replaces my previous deployment setup with a smaller system for publishing registered apps, inspecting their state, and managing recovery.

It now runs this portfolio and four web demos. A separate production game host runs Enshrouded, managed from the same control centre. The administrative interface stays private; this page explains the system rather than offering shared access to its controls.

A control centre, independent nodes

The React and TypeScript interface brings together application status, bounded logs, deployment by image digest, rollback, backups, and start, stop and restart controls. An administrator signs in with a password and authenticator. Caddy and Authelia protect the dashboard; its HTTP ingress uses a permissioned Unix socket.

The centre runs separately from the application and game nodes. Dedicated SSH keys, pinned host identities and a forced command restrict the requests each node accepts. Applications have their own Unix accounts, rootless containers and database stores. There is no remote container socket or public agent API.

Accepted operations continue on their node if the centre goes away. Retrying a request ID retrieves its recorded result. A failed node does not silently redirect work elsewhere, and an intentionally stopped service must be started before a release.

Releases and recovery are different operations

A release uses an immutable image digest, backs up before a database migration, starts the new image and checks readiness. A failed health check recovers the previous image. That rollback does not undo a database migration; data compatibility still needs an explicit decision.

Encrypted database and state backups go to a separate host. Scheduled checks detect stale backups, failed services, low disk space and unreachable nodes. Email alerts were tested from all three hosts and receipt was confirmed. These copies are off-host but with the same provider; they are not immutable backups.

Testing the path all the way through

Verification includes host and agent regressions, dashboard API tests, browser workflows, mobile layouts and automated accessibility scans. Separate virtual machines exercised real SSH restrictions, node isolation, service operations and reboot behaviour.

The Ubuntu fleet then passed real deployment and recovery checks. Database backups were restored into isolated PostgreSQL containers and compared with the saved data. The owner enrolled MFA and used the public HTTPS control centre to view both nodes.

For Enshrouded, an external client joined, placed a flame altar and bound to it. After a graceful save, backup and restart, the owner rejoined and confirmed the altar and spawn binding remained. This verifies that particular deployed setup; the independent NixOS game tooling has its own fixture-based checks.

An encrypted owner recovery kit was also used to restore the control services into a fresh Ubuntu VM. Original-password login, encrypted MFA integrity and authentication enforcement survived a reboot. The VM was network-isolated before loading real keys, and its plaintext state was removed afterward.

Keeping the boundary small

The centre holds operational authority across registered nodes. Rootless containers do not make that authority harmless. Registration and key changes remain host-administrator tasks; the browser does not accept arbitrary commands or adopt unrelated containers.

Arbitrary Compose imports, multi-tenant hosting, automatic image updates, database major upgrades and zero-downtime releases remain outside this version. Complete backup-host replacement and provider-independent monitoring are separate recovery work.

Developed with AI-assisted implementation and repeated local and live-host verification. Those checks are evidence of observed behaviour, not an independent security review.