---
title: Deployment
description: Nothing is currently deployed. What GitHub Pages did wrong, what was torn down, and the four things to settle before the Openship cutover.
---

:::danger[Nothing is deployed, as of 2026-09-09]
There is no live frontend and no live backend. Any link to a running TALA instance is stale.
:::

## What was torn down

GitHub Pages was removed on **2026-08-13**. The workflow published the repository root without ever running a build, so it served unbuilt TypeScript source that browsers refuse to execute. The site was down for **17 days** before anyone noticed.

Gone with it: the `gh-pages` branch, the `deploy` script, the `github-pages` environment, and the Pages site itself. The last working build survives only as the tag `rollback-pages-2026-06-16`.

As of 2026-09-09 the Render backend instance still exists and nothing references it. It is slated for deletion, with no owner or date set.

## The plan

Both halves will move to a single VPS via **Openship**, with the database staying on Supabase.

| Host | Serves |
| --- | --- |
| `hqtala.com` | marketing |
| `app.hqtala.com` | the SPA |
| `api.hqtala.com` | the API |

The VPS is a Contabo box reachable as `ssh tala-vps`. Root login is key-only, hardened after 11.5k brute-force attempts in 17 hours. The `00-` prefix on the sshd drop-in file is load-bearing: `sshd_config` takes the first value it sees for a keyword, so the file has to sort ahead of the distro defaults. Rename it and the hardening silently stops applying.

## Before the cutover

1. **Give CORS the real origins**

    `main.ts` derives its CORS allowlist from `FRONTEND_URL` as a comma-separated list. If `FRONTEND_URL` is unset, the allowlist is `http://localhost:5173` alone, and every request from `app.hqtala.com` is rejected by CORS.

2. **Build the frontend, then publish dist/**

    The Pages outage was caused by publishing source instead of a build. `npm run build` runs `tsc -b && vite build` and emits `dist/`. Publish that folder, nothing above it.

3. **Set VITE_API_URL at build time**

    `VITE_API_URL` is baked into the bundle by Vite at build time, not read at runtime. If it is missing, the build falls back to `http://localhost:8000` — every visitor's browser would then call their own machine, not the API.

4. **Create the production Supabase project and run every migration**

    That includes `LockDownPublicSchema`. See [Environments](/operations/environments#row-level-security).

## These docs

The site is static by default — `blume build` emits plain HTML, a search index, `llms.txt`, a sitemap, and OG images into `dist/`. It can go anywhere.

Two features would require switching to `deployment.output: "server"` with an adapter:

- **MCP server** at `/mcp`, so Claude Code and Cursor can read these docs directly.
- **Ask AI**, the in-page assistant.

Both are off because as of 2026-09-09 the docs have no host. Turn them on with the Openship cutover, alongside a `deployment.site` value so `llms.txt` links resolve absolutely.