Deployment choices
Ophiolite separates application identity, network access and scientific data permissions. Your IT department can operate the services in its environment. Current deployment recipes are pilot tooling, not a turnkey production release.
Three starting points
Section titled “Three starting points”- Evaluation: synthetic data on loopback services. A separate two-container Keycloak/PostgreSQL example demonstrates persistent identity storage; it does not install the complete suite or OSDU.
- Private pilot: a stable HTTPS address on an approved network, configured identity provider and explicitly admitted users. Private HTTPS browser sign-in has been exercised; a client DNS configuration issue required a test mapping.
- Production: qualify your identity provider, network, backups, restore, service restart, monitoring and upgrades before admitting customer data.
What IT can choose
Section titled “What IT can choose”Keycloak is an optional identity provider or broker. The platform uses OIDC; compatibility with every provider is not implied. IT controls provider clients, callback addresses, MFA, account recovery and user lifecycle. Organization and scientific project permissions remain separate from successful login.
Tailscale is one private network option. Corporate VPN and HTTPS ingress are other deployment choices, subject to testing. IT controls DNS, certificates and network policy. End users sign in and use projects; they do not need to administer containers.
A data backend and destination are separate choices. OSDU service integration does not mean every native-backend feature has been qualified against OSDU. Published assets have one authoritative backend and retain exact revisions, units, nulls, coordinate claims and provenance across supported conversions.
Recovery and limits
Section titled “Recovery and limits”An unreachable hostname is a network/DNS issue; a rejected sign-in is an identity issue; denied scientific access requires a project permission review. Do not solve these by disabling TLS or sharing administrator credentials.
Back up databases, payload storage and private configuration, then test restoration in isolation. Container replacement is not data recovery. Physical passkey acceptance, real email delivery and broad customer-provider certification remain open gates. Virtual passwordless authentication has passed; see account security. Each component repository maintains its own user/developer contracts; Integration owns the complete deployment recipes and cross-component evidence.