# annoNet

Arrowstack production deployment for the uploaded `annonet-arrowstack-ready.zip` source of truth.

Production overlays applied during the Docker build:

- Keycloak MCP tokens must use the configured machine client and required role.
- annoNet org/team/agent authority remains explicit in `ANNONET_MCP_*`.
- `ANNONET_MCP_TOKEN` is optional and empty in production.
- The viewer proxy uses an explicit public-host allowlist via `ANNONET_PROXY_ALLOWED_HOSTS`.
- Private/LAN proxy targets are disabled unless `ANNONET_PROXY_ALLOW_PRIVATE=true` is deliberately set for a trusted local deployment.
- Same-origin proxied HTML/CSS resources are rewritten through annoNet so production Vite/Astro applications render inside the annotation viewer.

Runtime port: `8787`

Readiness: `/api/health/ready`