Deployment

Deploy your systemprompt.io application to the cloud with a single command. The deployment process builds a Docker image, pushes it to the registry, and starts your services.

This page covers systemprompt.io Cloud. To self-host on your own infrastructure (Docker/GHCR, Kubernetes, one-click PaaS templates, self-host panels), see the Deploy section.

Deployment Pipeline

┌──────────┐    ┌──────────┐    ┌──────────┐    ┌──────────┐    ┌──────────┐
│ Validate │───▶│  Build   │───▶│   Push   │───▶│  Deploy  │───▶│   Sync   │
│  Config  │    │  Image   │    │ Registry │    │ Services │    │ Secrets  │
└──────────┘    └──────────┘    └──────────┘    └──────────┘    └──────────┘

Basic Deployment

Deploy to Production

systemprompt cloud deploy --profile production

Deploy with Options

# Dry run (preview the sync without deploying)
systemprompt cloud deploy --profile production --dry-run

# Preflight checks only, no deploy
systemprompt cloud deploy --profile production --check

# Skip confirmation prompts (CI)
systemprompt cloud deploy --profile production --yes

You can also run the preflight on its own with systemprompt cloud doctor --profile production.

What Happens During Deploy

1. Validate - Check local configuration for errors
2. Build - Create Docker image with compiled Rust code
3. Push - Upload image to systemprompt.io registry
4. Deploy - Start new containers, drain old ones
5. Sync - Push secrets and configuration to cloud database

Deployment Options

Flag	Description
--profile <name>	Profile to deploy
--dry-run	Preview the sync without deploying
--check	Run the pre-deploy preflight only, without deploying
--no-sync	Skip pre-deploy sync from cloud (may lose runtime files)
--skip-push	Skip pushing the image
--yes	Skip confirmation prompts

Checking Status

# Current deployment status
systemprompt cloud status

# Runtime logs (same CLI surface locally and in cloud)
systemprompt infra logs view --level error --since 1h

CI/CD Integration

GitHub Actions Example

name: Deploy to Production
on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build systemprompt.io CLI
        run: cargo build --release

      - name: Deploy
        run: ./target/release/systemprompt cloud deploy --profile production --yes

systemprompt cloud auth login is an interactive OAuth flow, so authenticate once on the runner (or seed its cached credentials) before automated deploys.

GitLab CI Example

deploy:
  stage: deploy
  script:
    - cargo build --release
    - ./target/release/systemprompt cloud deploy --profile production --yes
  only:
    - main

Rollback Strategies

Rollback is git-driven: check out the last known-good commit and redeploy it.

# Roll back to the previous release
git checkout <last-good-commit>
systemprompt cloud deploy --profile production --yes

Run systemprompt cloud deploy --profile production --dry-run first to preview what the redeploy will change.

Cloud Infrastructure Architecture

Understanding the systemprompt.io Cloud architecture helps diagnose deployment and connectivity issues.

Multi-Tenant Architecture

                        ┌─────────────────────────────────┐
                        │       DNS (Cloudflare)          │
                        │   *.systemprompt.io → Proxy     │
                        └───────────────┬─────────────────┘
                                        │
                        ┌───────────────▼─────────────────┐
                        │     Management API (Proxy)      │
                        │  (Wildcard SSL Termination)     │
                        └───────────────┬─────────────────┘
                                        │ internal routing
              ┌─────────────────────────┼─────────────────────────┐
              │                         │                         │
    ┌─────────▼─────────┐     ┌─────────▼─────────┐     ┌─────────▼─────────┐
    │  Tenant A App     │     │  Tenant B App     │     │  Tenant C App     │
    │  sp-{tenant-id}   │     │  sp-{tenant-id}   │     │  sp-{tenant-id}   │
    │  Own IP address   │     │  Own IP address   │     │  Own IP address   │
    └───────────────────┘     └───────────────────┘     └───────────────────┘

Request Flow

1. DNS Resolution: {tenant-id}.systemprompt.io resolves via wildcard DNS to the Management API
2. SSL Termination: Management API terminates SSL using the wildcard certificate (*.systemprompt.io)
3. Proxy Routing: The proxy extracts the subdomain, looks up the tenant, and routes to sp-{tenant-id}
4. Tenant Response: The tenant app processes the request and returns the response

Key Components

Component	Purpose	Hostname
Management API	SSL termination, tenant routing	*.systemprompt.io
Tenant App	Individual tenant application	{tenant-id}.systemprompt.io
Cloud Database	Shared PostgreSQL database	Internal

SSL Certificates

All wildcard certificates live on the Management API, not on individual tenant apps. Custom domains and their TLS certificates are managed through the CLI:

# Point a custom domain at your tenant
systemprompt cloud domain set example.com

# Check domain and certificate status
systemprompt cloud domain status

# Remove the custom domain
systemprompt cloud domain remove

Verifying Connectivity

# Check tenant status
systemprompt cloud status

# Check via custom domain
curl -sI https://{tenant-id}.systemprompt.io/

# Check custom domain and certificate status
systemprompt cloud domain status

Common Issues

Symptom	Cause	Solution
SSL handshake fails	Certificate on wrong app	Move cert to Management API
502 Bad Gateway	Tenant app not found or down	Check systemprompt cloud status
DNS mismatch error	Cert expects different IP	Remove cert from tenant, add to proxy
"Awaiting configuration"	DNS not pointing to correct IP	Verify wildcard DNS points to proxy

---

Troubleshooting

Issue	Cause	Solution
Build fails	Rust compilation error	Check cargo build locally
Push fails	Authentication expired	Run systemprompt cloud auth login
Deploy fails	Resource limits	Check cloud dashboard for quotas
Sync fails	Database schema mismatch	Run migrations first
Site unreachable after deploy	SSL/DNS routing issue	See Cloud Infrastructure section above

Quick Reference

Task	Command
Deploy	systemprompt cloud deploy --profile <name>
Preflight	systemprompt cloud doctor --profile <name>
Status	systemprompt cloud status
Logs	systemprompt infra logs view --level error --since 1h
Restart	systemprompt cloud restart
Domains/TLS	systemprompt cloud domain status