Deployment Documentation

Levy Core On-Prem is the locally operated edition of Levy's micromobility-rental platform. It is delivered as a signed, source-confidential software package for installation on customer-owned infrastructure inside the required country, facility, or regulated data boundary.

The edition includes the rider experience, operator applications, core APIs, PostgreSQL data platform, object storage integration, background workers, IoT and GPS gateway, installation controller, local observability, backup and recovery tooling, and provider-neutral interfaces for customer-selected payment and messaging gateways.

Install the application

Infrastructure engineers and certified installers should begin with the Third-Party Installation Guide. It identifies the package received by the customer, the programs installed on each server, supported reference topologies, hardware and network requirements, customer responsibilities, exact bootstrap and application commands, expected output, first login, acceptance, upgrade, rollback, and uninstall.

The installation does not require a source checkout. The customer receives signed OCI images, compiled Levy command-line tools, an installation controller, database assets, conformance catalogs, and a customer-specific site package. Customer administrators prepare or certify the local platform; the certified installer then executes the application installation through levyctl.

Production deployment model

Each customer receives an isolated deployment with no mandatory Levy-operated runtime dependency. Operational data—including rider, vehicle, rental, GPS, payment, messaging, logs, metrics, traces, objects, evidence, and backups—remains inside the customer's approved boundary.

Documentation set

The documentation is organized in the order used by solution architects, customer infrastructure teams, security reviewers, installers, and operations teams.

What the customer receives

Every customer handoff is a read-only, customer- and release-bound package. Its package index binds every component by version and digest.

• signed release index and compatibility matrix;
• digest-pinned OCI images for the enabled product profile;
• signed installation controller and compatible levyctl client;
• customer target policy, entitlement, and installation request template;
• supported-platform and capacity profiles;
• customer site, topology, network, DNS, certificate, retention, and responsibility records;
• payment, messaging, identity, maps, IoT, mobile, and optional-provider manifests;
• non-secret configuration and secret-reference ledger;
• database baseline, migrations, backup, restore, and disaster-recovery controls;
• preflight, conformance, residency, security, financial, safety, and golden-journey catalogs;
• installation, upgrade, rollback, recovery, support, and uninstall runbooks;
• source-exclusion, SBOM, provenance, vulnerability, licensing, and certification receipts;
• machine-generated evidence templates and final acceptance contract.

No customer-specific server source is compiled at the installation site. Customer variation is expressed through signed configuration, approved provider adapters, mobile release metadata, and feature manifests.

Installation lifecycle

1. Site readiness

Customer platform, security, database, network, identity, provider, device, and operations owners install or certify Linux, Kubernetes, a private registry, PostgreSQL/PostGIS, object storage, OIDC, secrets, ingress, monitoring, and backups. The installation guide supplies the reference topology, software inventory, commands, and validation procedure.

2. Artifact custody

Customer security imports the signed release into a private local registry or decrypts the approved offline media inside the customer boundary. Signatures, digests, revocation state, source-exclusion receipts, and custody records are independently verified before installer access is enabled.

3. Controller bootstrap

Customer platform and security teams install the three compiled Levy tools, import the OCI bundle, bootstrap the signed installation controller, and provision the installer's short-lived OIDC and mTLS identity. The installer receives no Kubernetes, registry, database, object-store, backup, secret, node, shell, image-export, or generic workload access.

4. Installation execution

The installer validates the package, opens an immutable installation case, runs full preflight, generates the redacted installation plan, creates a recovery point, applies the approved plan, observes controller reconciliation, creates the first customer administrator, and records typed receipts for every phase.

5. Conformance and acceptance

The installed system executes provider, identity, IoT, job, backup/restore, observability, residency, security, golden-journey, financial, and safety verification. Controlled live-value and staff-only canaries run under named customer approval.

6. Handoff

The customer receives the as-built record, verified backup and recovery evidence, runbooks, responsibility matrix, SLO/RPO/RTO record, support procedure, and signed evidence index. Installer identities, sessions, media, certificates, and temporary workspaces are revoked or closed with receipts.

Source confidentiality model

The production protection profile is designed for a third-party installer who must deploy and verify the application without receiving Levy's original server source or broad access to the runtime environment.

The installer operates only through an allowlisted controller API. The controller accepts signed, schema-valid requests bound to one customer, environment, package, release, configuration digest, target policy, and evidence repository. It rejects free-form commands, arbitrary image digests, raw manifests, shell execution, generic log access, cross-environment requests, unsigned mutations, and expired approvals.

Runtime images are minimal, hardened, and scanned for original source, source maps, build metadata, repository history, credentials, debug facilities, and prohibited cloud destinations. Image import and decryption remain customer-custodian actions. The installer can read typed status and redacted receipts without seeing image layers, application secrets, consumer data, or raw platform logs.

Local provider integration

Payments, messaging, identity, maps, and device protocols use versioned adapter contracts and customer-specific provider manifests. The customer can connect an approved in-country service without changing the core application.

Payment adapters cover tokenization handoff, authorization or sale, capture, void, refund, webhook verification, retries, timeouts, settlement, reconciliation, currencies, and minor units. Messaging adapters cover OTP and transactional delivery, sender identity, templates, callbacks, suppression, rate limits, and retries. Conformance suites validate each adapter before production activation.

Operations and lifecycle

The package includes local dashboards, metrics, logs, traces, alerts, health checks, job and queue visibility, payment and wallet reconciliation, IoT command status, capacity thresholds, backup status, certificate expiry, entitlement state, and default-deny egress monitoring.

Upgrades are digest-pinned and compatibility checked. The controller creates a pre-upgrade recovery point, applies expand-and-contract database changes, executes canary and acceptance checks, and preserves the certified rollback path. Backup acceptance always includes an isolated restore. Disaster-recovery exercises prove the declared RPO and RTO using customer-owned systems.

Production acceptance

A completed installation has signed proof that the exact customer, environment, release, controller, CLI, configuration, platform profile, providers, device protocols, and mobile clients were installed and verified. Acceptance includes:

• zero undeclared outbound destinations;
• no original server source or build material delivered to the installer;
• all enabled rental, operator, payment, messaging, wallet, IoT, GPS, job, and mobile journeys passing;
• financial idempotency and settlement reconciliation with zero unexplained variance;
• ride-end and lock safety behavior under dependency failure;
• backup, isolated restore, rollback, and recovery evidence;
• verified customer monitoring, alerting, escalation, and operational ownership;
• complete disposition of synthetic installation fixtures;
• revocation of installer access and closure of temporary custody surfaces;
• customer and Levy approval of the signed final evidence index.

The result is a customer-operated Levy Core On-Prem environment that can be administered, upgraded, recovered, audited, and supported entirely within the approved local infrastructure boundary.