The application operating guide.

Start with one project

1. Sign in with an enabled email OTP or GitHub method.
2. Create a project with a display name, slug and available region.
3. Connect a GitHub repository or upload a ZIP without secrets.
4. Review framework, build/start commands, port, CPU and memory.
5. Follow deployment progress and open the healthy endpoint.

The public website links to the configured customer console. It does not create a second deployment system.

Source → snapshot → healthy release

ZIP analysis reads bounded manifest data. It rejects unsafe archive paths, duplicates, symlinks and oversized input without executing uploaded source.

Deployment subsequently builds and starts the runtime. A release becomes eligible for traffic only after the required health checks. Keep the deployment ID and logs available when investigating failures.

Review detected defaults

Python defaults to uvicorn main:app. Node uses the repository’s start script. Next.js uses build/start scripts. Review nested project paths and custom commands. Bring a Dockerfile when default detection is insufficient.

Recovery

Retries, timeout/cancellation, previous healthy release and rollback belong to release history. A new unhealthy release should not replace healthy traffic.

Attach data services

Postgres, Redis Cache and Ojas Store attach to the project graph. Managed data services stay pinned to their node. Automatic data migration and replication are not claimed.

Storage capacity is finite

Ojas Store uses an S3-compatible abstraction. Usable capacity excludes OS, metadata, reserves and other platform data. Commercial quotas must reflect safe available capacity.

A dedicated storage fleet or durable external S3 backend should remain separate from ordinary application-worker disks. Signed URLs and policy-controlled credentials belong to the Ojas Store product layer.

Move an existing PostgreSQL database

Controlled custom-format dump import and backup/restore are pilot workflows. Database Studio, SQL Editor and explicit environment bindings are implemented in source for controlled Pilot rollout. Live-host validation and feature configuration still determine availability.

1. Create a custom-format dump from the existing database using pg_dump -Fc. Keep the dump private: it contains application data.
2. Create the target Ojas Postgres resource. Confirm the project, environment and intended target.
3. Use the authorized custom-dump import workflow. For a non-empty target, make a recovery backup before restoring.
4. Verify schema and data through an authorized connection. Use the authorized Database Studio table browser to inspect schema and data.
5. Attach the intended database as DATABASE_URL for that environment using the enabled resource-binding workflow. Do not assume a Production database also belongs to Staging.
6. Deploy and test the application against the target. Cut over only after verification; retain a recovery path.

Five concepts, five jobs

Database resource

Persistent Postgres data, separate from app releases.

DATABASE_URL binding

The explicit database connection selected for an application environment.

Migration

Application-managed schema changes, run deliberately.

SQL Editor

Manual, bounded SQL with read-only default and authorized write mode.

Database dump

A private export used to move or recover database state.

For a new application

Create Ojas Postgres, confirm the correct environment attachment, explicitly run your application’s migrations, then deploy and test. OjasBase should not silently run arbitrary migration commands.

Formats and lifecycle

pg_dump -Fc import is the existing controlled path. Plain .sql/.sql.gz import uses the enabled dedicated migration workflow under restricted permissions; it is separate from custom-dump upload. Redeploying an application must not delete its persistent database.

Environment bindings

The v0.4.3.2 model maps production + DATABASE_URL to production-db, and staging + DATABASE_URL to staging-db. Duplicate bindings should be rejected rather than silently overwritten. Binding metadata must never return passwords.

Domain verification + HTTPS

1. Add the hostname to your project when custom-domain support is enabled.
2. Create the returned CNAME, or explicit apex A/AAAA target.
3. Add the returned TXT ownership proof.
4. Request verification. Wait for DNS, ingress synchronization and a trusted certificate.
5. Confirm a healthy release before the domain becomes active.

Removing a domain remains pending if ingress is unavailable. Its hostname stays reserved until route deletion is acknowledged. Caddy manages certificate issuance and renewal; real CA behavior must be verified on the host.

Estimates, budgets and billing

Usage/projection APIs provide INR cost visibility. Project budgets produce alerts. They do not currently force a runtime stop. Provider purchasing caps are separate operator controls.

Early Access monthly minimums are credited toward usage. Compute uses reserved resources. Network metering, commercial plan enforcement, payment processing and GST invoices need rollout validation.

Secrets + security architecture

Normalized secret records use project, environment, service and key identity. AES-GCM binds encryption to that identity. Versioned ciphertext is stored without returning plaintext through normal metadata APIs.

Environment-aware delivery, build/runtime scope, feature-gated .env import, versioned encryption, immutable release bindings and secret redaction are implemented in source. Validate enabled flows on the host and keep keys out of source.

Operator master-key management, worker Docker authority and real-host network isolation remain operational responsibilities.

Backend API reference

Use your configured API origin. Customer APIs enforce tenant ownership and roles; operator routes require platform administrator authority.

Project creation example

{
  "display_name": "Client Portal",
  "slug": "client-portal",
  "region_code": "in-south-blr-1"
}

For complete schemas, use /docs or /openapi.json on your backend origin. Mutating cookie requests require a trusted browser origin.