Platform

Deployment

Kaveon deploys as three tiers — the Next.js frontend on Vercel, the FastAPI backend on Azure Container Apps, and Azure PostgreSQL. CI builds and ships on every push.

Topology

text

Browser ──► Vercel  (kaveon-web · NextAuth: GitHub / Google / Microsoft)
               │  same-origin /api/kaveon proxy (injects X-User-* + secret)
               ▼
            Azure Container Apps  (kaveon-api · FastAPI · image from kaveonacr)
               │  psycopg2 / DefaultAzureCredential (Managed Identity)
               ▼
            Azure PostgreSQL Flexible Server (PG 18)
               ├── kaveonmeta  (control plane + DLM/context)
               └── kaveon      (data warehouse — the rows)

The browser only talks to Vercel; the proxy forwards to the Container App with X-User-* headers stamped by KAVEON_PROXY_SECRET, which the API validates (see Auth & RBAC).

Both databases live on one Azure Database for PostgreSQL Flexible Server (PG 18): kaveonmeta holds Kaveon’s own state plus the DLM context, and kaveon is the data warehouse. In production both authenticate via Managed Identity — no stored password. Self-hosting elsewhere only needs the METADATA_* connection settings changed.

CI/CD

.github/workflows/ci.yml runs on every push and PR to dev:

web — install, type-check shared types, lint, tsc, and build kaveon-web.
api — install, compileall, and run pytest if tests exist.
secrets — a gitleaks scan.
deploy (web) — on push to dev (after web passes), vercel deploy --produsing the VERCEL_TOKEN / VERCEL_ORG_ID / VERCEL_PROJECT_ID secrets.

.github/workflows/deploy.yml ships the API on push to dev: it builds and pushes the image to kaveonacr.azurecr.io and runs az containerapp update to roll it out. The Vercel build installs with npm install --legacy-peer-deps (pnpm fails in Vercel’s build sandbox).

Key environment variables

Where	Vars
Both tiers	`KAVEON_PROXY_SECRET` (must match)
Web (Vercel)	`AUTH_SECRET`, `AUTH_URL`, provider IDs/secrets, `API_URL`
API (Azure Container Apps)	`METADATA_DATABASE` (=`kaveonmeta`), `AAD_DATABASES` (=`kaveon`), `METADATA_HOST`/`PORT`/`SSLMODE`, `KAVEON_PROXY_SECRET`

First run needs no database config — the setup wizard appears on first sign-in and initializes the metadata schema for you. Data-source endpoints are always registered from the UI, never from .env.

Production notes

The reference deployment is a zero-cost demo, not hardened. For production, put the API on private networking, use managed secrets (e.g. Key Vault), run a dedicated warehouse, and prefer managed-identity auth for Fabric/Azure SQL over connection strings.