# Nur Falah — Estate & Waqf Suite · Deployment Guide

**Target:** `moslem04.falahos.my`
**Stack:** Svelte 5 + Vite PWA (static SPA), same pattern as `moslem03.falahos.my`
**Server:** Docker Swarm (nginx:alpine) on the Contabo VPS, Traefik + Let's Encrypt

---

## 1. Build & push image

```bash
docker build -t git.falahos.my/wmj/nur-falah-prevention:latest .
docker push git.falahos.my/wmj/nur-falah-prevention:latest
```

## 2. Deploy to the swarm

```bash
docker stack deploy -c deploy/docker-stack.yml nur-falah-prevention
```

Traefik picks up the labels in `deploy/docker-stack.yml` and routes
`moslem04.falahos.my` to the service automatically, issuing a Let's Encrypt
certificate on first request.

## 3. DNS

Point `moslem04.falahos.my` at the same VPS IP already serving `moslem03.falahos.my`
(A/AAAA record, or CNAME if using a CDN in front).

## 4. Verify

```bash
curl -sI https://moslem04.falahos.my/ | grep -i "cache-control"
# index.html: cache-control: no-cache, must-revalidate

curl -sI https://moslem04.falahos.my/sw.js | grep -i "cache-control"
# sw.js: cache-control: no-cache, no-store, must-revalidate
```

- [ ] `https://moslem04.falahos.my/` returns 200
- [ ] Service worker activates (DevTools → Application → Service Workers)
- [ ] App installs as PWA
- [ ] All 6 modules load without console errors: Faraid, Assets, Wassiyah, Hibah, Family Waqf, Claims (H2)

## 5. Rollback

```bash
docker service update --rollback nur-falah-prevention_web
```

## Known gaps before this is production-grade (not blocking this deploy, tracked for follow-up)

- **Encryption at rest**: storage.js currently uses plain `localStorage`. Horizon 1
  PRD §10 requires encrypted-at-rest for Asset Registry / wassiyah / hibah / waqf
  drafts. WebCrypto AES-GCM wrapping is the next hardening step.
- **PDF export**: current export is plain-text download + browser print dialog, not
  a dedicated PDF pipeline. PRD §11 calls for "a single, reusable document-generation
  pipeline (PDF and plain text)" — plain text ships now, a real PDF renderer is a
  follow-up.
- **Horizon 2 claims module is a local, non-custodial demo only** — see the in-app
  banner and `src/lib/horizon2/claims.js`. It has no legal wrapper, no institutional
  partner, and issues no real claim. Built ahead of the Horizon 2 PRD's stated Phase 0
  gate per explicit product direction — do not represent this screen to any real user
  as a live programme.
- **Family Waqf Designator ships ahead of scholarly sign-off** — `scholarly-review-log.md`
  OPEN-01 (the waqf one-third cap conflict) is still unresolved. Built per explicit
  product direction; the in-app copy states this openly rather than presenting
  invented certainty.