Deploying Infrastructure

HQ’s shared cloud infrastructure (the vault, team platform, VaultApi, and the Cognito identity pool) lives in the hq-pro repo. hq-console deploys separately on Vercel, and hq-deploy has its own CloudFormation templates under infra/.

Prerequisites

Access to the indigoai-us/hq-pro repo
pnpm 10 and Node.js
AWS CLI v2 with credentials for the target account (only for non-production stages)

SST

hq-pro uses SST 4 (sst 4.7.2 in package.json) with the AWS provider. The config is sst.config.ts at the repo root; the resources it composes are under infra/ (for example infra/vault-service.ts defines VaultApi, and infra/cognito.ts defines the user pool clients).

Stages

Stage	Purpose
`hq-prod`	Production. Resources are retained on removal. The API is served at `https://hqapi.hq.computer`.
`hq-dev`	Shared development stage.
other names	Ephemeral stages. Resources are removed when the stage is removed.

Production deploys

Production deploys run through CI only. Merge to main; after the CI workflow passes, the Deploy Prod workflow (.github/workflows/deploy-prod.yml) sends the merged SHA to a serialized CodeBuild runner, which runs sst deploy --stage hq-prod and then the post-deploy migrations. Routine local production deploys are blocked. The emergency break-glass path is documented in hq-pro’s docs/runbooks/hq-pro-continuous-deploy.md.

Development stages

pnpm install
pnpm deploy --stage <stage>   # deploy a non-production stage
pnpm dev                      # sst dev with live Lambda reloading

To remove an ephemeral stage:

pnpm sst remove --stage <stage>