Deployment

Use these pages when you are preparing or operating a production TOW instance. If you are here for the first time, start with Install TOW: clone the deploy kit, run ./install.sh, sign in.

Set up

• Install TOW
• Production hardening
• authentik and SSO
• Runtime configuration
• Air-gapped and private registries

Operate

• Back up and restore
• Upgrades
• Security and AI data controls
• User deactivation and deletion
• Background AI system
• Connect external chat apps through MCP

Go-live checklist

Before opening the deployment to users:

• .env has no placeholder or empty secrets (the installer guarantees this).
• The bundled proxy answers locally: curl -fsS http://127.0.0.1:<port>/api/health.
• Your edge proxy forwards to the bundled proxy, including the /api/mcp location and streaming timeouts.
• runtime.public_app_url exactly matches the URL users visit, and backend_cors_origins includes that origin.
• session_cookie_secure: true for HTTPS deployments.
• /api/health responds through the public URL, and /api/socket.io reaches the backend.
• The first admin account was registered intentionally.
• A test email sends from Admin → Server Settings, and a small attachment uploads and downloads.
• A managed encrypted backup and a restore drill have run; systemctl list-timers 'tow-backup*' shows the daily backup and prune timers.