# ADR 0005: Deploy through an isolated Docker edge on the new public-IP target

Status: accepted

Date: 2026-08-20

## Context

The requested final destination changed from a remote Plesk subpath to the
current Docker host, reachable through public edge address `99.26.147.74` on
TCP port 80. Read-only inspection shows host port 80 is free, Docker is active,
and unrelated containers already publish ports 8777–8780. The host itself owns
LAN address `10.0.0.57`, not the public address, so inbound reachability depends
on NAT/router and firewall configuration outside Compose.

Registration passwords, PIN/PIC traffic, and game packets must not cross the
public Internet over HTTP or plaintext WebSocket. An IP-address-only HTTP URL
also cannot provide the secure browser context required by the production
client controls.

## Decision

- Use a dedicated Compose project and internal Docker network.
- Publish only an edge proxy on host ports 80 and, once TLS is provisioned,
  443. Never publish registration, game bridge, asset service, Cosmic, or
  database ports.
- Serve the production portal at `/`; retain prefix-aware staging tests.
- Make port 80 a redirect/health entrypoint. Enable registration and gameplay
  only on a trusted HTTPS/WSS origin.
- Require external evidence that `99.26.147.74` forwards to `10.0.0.57`, and
  record router/firewall changes as an operator-owned Stage 9 input.
- Preserve unrelated Docker projects and prove their containers/ports are
  unchanged before and after deployment and rollback.

## Consequences

The requested HTTP URL can be the public entrypoint, but it cannot be the final
credential-bearing origin. A trusted hostname/certificate and NAT forwarding
are explicit deployment blockers. No port is published and no router or
firewall state is changed until all earlier blueprint stages pass.
