# Deployment

## Public Deployment Shape

```mermaid
flowchart TD
  User["WeChat mini-program user"]
  Domain["banban.api.talkingq.com"]
  Nginx["Nginx container\nTLS + reverse proxy + static verify files"]
  FastAPI["talkingq-url FastAPI process\n/home/ubuntu/banban-backend"]
  MySQL["1Panel MySQL container\nMySQL 8.x"]
  MQTT["Configured MQTT broker"]
  COS["Tencent COS"]
  Certbot["certbot container\nLet's Encrypt renewals"]

  User -->|HTTPS| Domain --> Nginx --> FastAPI
  FastAPI --> MySQL
  FastAPI --> MQTT
  FastAPI --> COS
  Certbot --> Nginx
```

## Startup Responsibilities

```mermaid
sequenceDiagram
  autonumber
  participant Proc as FastAPI process
  participant Init as init_db
  participant Scheduler as TaskScheduler
  participant MQTT as TalkingQMQTTService
  participant Roles as role_manager
  participant Firmware as firmware_scanner

  Proc->>Init: initialize and migrate database tables
  Proc->>Scheduler: start periodic tasks
  Proc->>MQTT: connect to configured broker
  Proc->>Roles: initialize role definitions
  Proc->>Firmware: scan firmware files
  Proc-->>Proc: serve API routes and assets
```

## Deployment Notes

- The mini-program production API base should resolve to
  `https://banban.api.talkingq.com`.
- WeChat legal domains must include the API host and any audio/COS download
  domains used by `mediaUrl`.
- MySQL table shape should be checked against the live database before direct
  data work, because deployment state can drift from local schema files.
- Device identity data should normally enter through `device_imei_mapping`;
  `device_auth` is activated by device bootstrap unless a deliberate pre-activation
  path is required.

## Source Anchors

- Docker/Nginx assets: `talkingq-url/docker-compose.yml`, `talkingq-url/nginx.conf`
- Runtime startup: `talkingq-url/main.py`
- Database initialization: `talkingq-url/database/init_db.py`
- Mini-program API config: `banban-mini/config/prod.js`, `banban-mini/src/config/env.ts`