12. Deployment

During development, [Android Studio] (or [gradlew installDebug]) installs the “debug” version of the application: signed with an automatically generated debug key, which enables the debugger. To deploy it, the “release” version is built.

12.1. The production version of the application

Build the application, specifying the address of the production server. In a command prompt window open to the [rdvmedecins_kotlin] folder:

1	`gradlew assembleRelease -Pserver=https://rdvmedecins.example.com`

[Gradle] compiles the [Kotlin] code into “bytecode,” then into [Dalvik] code (the format of the [.dex] files, executed by the virtual machine of [Android], [ART]), and packages everything—along with the resources and libraries—into a APK file: the installation format for [Android] applications. Unlike [Flutter], there is no engine to embed: the interface is rendered by [Compose], a library like any other. The resulting file, [app/build/outputs/apk/release/app-release-unsigned.apk], is a few megabytes in size.

The [buildTypes { release [ ... ] }] block in [app/build.gradle.kts] configures this version. There, you can enable the [R8] ([optimization [ enable = true ]]) optimizer: it removes unused code from the libraries and shortens the names, which reduces the size of the APK. You must then instruct it to retain what the serializer finds through reflection (the rules for [kotlinx.serialization] are provided with the library) and TEST the optimized version.

Sign it. [Android] only installs SIGNED applications. The easiest way is to use [Android Studio]: the [Build / Generate Signed App Bundle or APK] menu creates the developer key (a password-protected “keystore” file that you must keep safe: all updates to the application must be signed with it), then builds and signs the APK. You can also define the signature in [app/build.gradle.kts] (block [signingConfigs]) by reading the passwords from the properties of [Gradle] rather than hard-coding them.
Install it. With the phone connected to the computer (USB cable, USB debugging enabled):

1	`adb install app-release.apk`

You can also copy the APK file to the phone and open it: [Android] will then ask you to allow the installation of apps “from unknown sources.”

For actual publication:
[Google Play Store] requires an “Android App Bundle” rather than a APK: [gradlew bundleRelease], or the same menu as [Android Studio]. Google generates the APK files tailored to each phone;
the app’s name and icon are configured in [res/values/strings.xml] ([app_name]) and [res/mipmap-*/] ([New / Image Asset] menu from [Android Studio]);
[versionCode] (an integer) must increment with each publication; [versionName] is the displayed version;
the server must be set to HTTPS (passwords are transmitted), and the [android:usesCleartextTraffic="true"] line is removed from the manifest;
the token is stored in [SharedPreferences], a private application file. For added security, it can be encrypted using the “keystore” from [Android] (library [androidx.security]).

12.2. The Production Server

In a live production environment, don’t forget the [.env] file on the server:

a long, random [JWT_SECRET];
an empty [CAPTCHA_TEST];
[COOKIE_SECURE=true] if the site is served via HTTPS (it must be). The mobile client sends the cookie regardless of this option: it is the browser that enforces it;
[TRUST_PROXY=true] if the server is located behind a proxy ([nginx]...), so that the attempt limit sees the clients’ actual IP address.

We then launch the compiled server: [npm run build], followed by [npm run start:prod].