# Server deployment

Publish a locked, self-contained server from the repository root:

```powershell
./scripts/publish-server.ps1
./scripts/publish-server.ps1 -Runtime linux-x64
./artifacts/server/win-x64/VoiceCat.Server.exe --help
```

The default endpoint is TCP and UDP port 8384. The server creates its TLS identity and SQLite
database in the data directory. Account passwords are accepted only through a hidden prompt,
redirected standard input, or `VOICECAT_ADMIN_PASSWORD`; they are never command arguments.

```powershell
./artifacts/server/win-x64/VoiceCat.Server.exe account add Operator --admin --data-dir ./voicecat-data
./artifacts/server/win-x64/VoiceCat.Server.exe --data-dir ./voicecat-data --allow-guests false
```

The checked-in `Dockerfile` builds the managed Linux server. `docker-compose.yml` runs it as a
non-root user with a read-only filesystem, persistent `/data`, and TCP/UDP 8384 exposed.

For a host installation, `deploy/linux/install.sh` installs a published Linux binary and the
systemd unit. Validate a published binary with:

```bash
sh deploy/linux/smoke.sh artifacts/server/linux-x64/VoiceCat.Server
```

The server exposes `--health-check host:port` for TLS-aware probes. Before release, run the
container and the concurrent client soak:

```powershell
./scripts/soak-server.ps1 -HostName 127.0.0.1 -Port 8384 -Minutes 30 -Pairs 4
```