Production checklist

Work through it after the first successful login and before you ship app builds that point at your server.

Server

• The server meets the Community size: 4 vCPU, 8 GB RAM, 80 GB SSD, for up to 100,000 users.
• The process settings fit the server and the connection budget adds up.
• GROVS_VERSION is a numbered release, not latest.

DNS and TLS

• Every DNS record points at the server, including * on the links domain and * on the test links domain.
• Link records are DNS-only if you use Cloudflare.
• Wildcard certificates are pre-issued for both link domains, so Universal Links and App Links work on the first request.
• ACME_EMAIL is a mailbox you read.

Secrets and .env

• .env is readable by its owner only: Secrets and .env.
• An encrypted copy of .env is stored off the server.
• Nobody plans to change the secrets that must never change.

Firewall and ports

• Only TCP 80 and 443 are open to the internet, and SSH is limited to your IP: Firewall.
• No database port is published: Exposed ports.
• The local trial override is not in use.

Email

• SMTP is set up so password resets, invites and exports reach people: Email.

First admin and members

• The bootstrap admin password is reset and cleared from .env: Admin accounts.
• Two-factor authentication is on for every account.
• Only the people who need access are members.

Backups

• The backup script runs on a schedule.
• Backups are copied off the server.
• A restore test has succeeded on a separate server.

Monitoring

• An external monitor checks https://<API_HOST>/up: Health endpoints.
• Alerts fire for stopped containers, ClickHouse failures, growing queues and low disk: What to alert on.
• Docker log rotation is on.

Updates

• You watch Grovs releases and know the upgrade and rollback steps.
• Operating system updates are applied regularly.

Branding and links

• DEFAULT_LOGO_URL and DEFAULT_SOCIAL_PREVIEW_URL point at your own public images: Default images.
• An uploaded image shows on a link page: Uploaded images.

SDKs

• Every app build passes your SDK host as baseURL, including release builds: SDK configuration.
• useTestEnvironment matches the API key's environment.
• Associated Domains and App Links list both link domains: Universal Links and App Links.
• A link opened on a real device lands in the app: Verify the connection.