annoNet

Arrowstack production deployment for the uploaded annonet-arrowstack-ready.zip source of truth.

Production overlays applied during the Docker build:

Keycloak MCP tokens must use the configured machine client and required role.
annoNet org/team/agent authority remains explicit in ANNONET_MCP_*.
ANNONET_MCP_TOKEN is optional and empty in production.
The viewer proxy uses an explicit public-host allowlist via ANNONET_PROXY_ALLOWED_HOSTS.
Private/LAN proxy targets are disabled unless ANNONET_PROXY_ALLOW_PRIVATE=true is deliberately set for a trusted local deployment.
Same-origin proxied HTML/CSS resources are rewritten through annoNet so production Vite/Astro applications render inside the annotation viewer.

Runtime port: 8787

Readiness: /api/health/ready