# Production checklist

> Everything to confirm before a self-hosted installation takes real traffic, with a link to each how-to.

Source: https://docs.grovs.io/docs/self-hosting/operate/production-checklist

Work through it after the first successful login and before you ship app builds that point at your server.

## Server

- [ ] The server meets the [Community size](https://docs.grovs.io/docs/self-hosting/operate/sizing#tiers): 4 vCPU, 8 GB RAM, 80 GB SSD, for up to 100,000 users.
- [ ] The process settings fit the server and the [connection budget](https://docs.grovs.io/docs/self-hosting/operate/sizing#connection-budget) adds up.
- [ ] `GROVS_VERSION` is a [numbered release](https://docs.grovs.io/docs/self-hosting/operate/upgrades#pin-the-version), not `latest`.

## DNS and TLS

- [ ] Every [DNS record](https://docs.grovs.io/docs/self-hosting/get-started/deployment#dns) points at the server, including `*` on the links domain and `*` on the test links domain.
- [ ] Link records are DNS-only if you use Cloudflare.
- [ ] [Wildcard certificates](https://docs.grovs.io/docs/self-hosting/get-started/deployment#tls-and-universal-links) are pre-issued for both link domains, so Universal Links and App Links work on the first request.
- [ ] `ACME_EMAIL` is a mailbox you read.

## Secrets and `.env`

- [ ] `.env` is readable by its owner only: [Secrets and `.env`](https://docs.grovs.io/docs/self-hosting/operate/security#secrets-and-env).
- [ ] An encrypted copy of `.env` is stored off the server.
- [ ] Nobody plans to change the [secrets that must never change](https://docs.grovs.io/docs/self-hosting/operate/security#rotate-secrets).

## Firewall and ports

- [ ] Only TCP 80 and 443 are open to the internet, and SSH is limited to your IP: [Firewall](https://docs.grovs.io/docs/self-hosting/operate/security#firewall).
- [ ] No database port is published: [Exposed ports](https://docs.grovs.io/docs/self-hosting/operate/security#exposed-ports).
- [ ] The local trial override is not in use.

## Email

- [ ] SMTP is set up so password resets, invites and exports reach people: [Email](https://docs.grovs.io/docs/self-hosting/configure/configuration#email).

## First admin and members

- [ ] The bootstrap admin password is reset and cleared from `.env`: [Admin accounts](https://docs.grovs.io/docs/self-hosting/operate/security#admin-accounts).
- [ ] Two-factor authentication is on for every account.
- [ ] Only the people who need access are members.

## Backups

- [ ] The [backup script](https://docs.grovs.io/docs/self-hosting/operate/backups#backup-script) runs on a [schedule](https://docs.grovs.io/docs/self-hosting/operate/backups#schedule-backups).
- [ ] Backups are copied off the server.
- [ ] A [restore test](https://docs.grovs.io/docs/self-hosting/operate/backups#test-your-restore) has succeeded on a separate server.

## Monitoring

- [ ] An external monitor checks `https://<API_HOST>/up`: [Health endpoints](https://docs.grovs.io/docs/self-hosting/operate/monitoring#health-endpoints).
- [ ] Alerts fire for stopped containers, ClickHouse failures, growing queues and low disk: [What to alert on](https://docs.grovs.io/docs/self-hosting/operate/monitoring#what-to-alert-on).
- [ ] Docker [log rotation](https://docs.grovs.io/docs/self-hosting/operate/monitoring#log-rotation) is on.

## Updates

- [ ] You watch [Grovs releases](https://github.com/grovs-io/self-host/releases) and know the [upgrade and rollback steps](https://docs.grovs.io/docs/self-hosting/operate/upgrades).
- [ ] Operating system [updates](https://docs.grovs.io/docs/self-hosting/operate/security#updates) are applied regularly.

## Branding and links

- [ ] `DEFAULT_LOGO_URL` and `DEFAULT_SOCIAL_PREVIEW_URL` point at your own public images: [Default images](https://docs.grovs.io/docs/self-hosting/configure/configuration#default-images).
- [ ] An uploaded image shows on a link page: [Uploaded images](https://docs.grovs.io/docs/self-hosting/configure/configuration#uploaded-images-must-be-reachable).

## SDKs

- [ ] Every app build passes your SDK host as `baseURL`, including release builds: [SDK configuration](https://docs.grovs.io/docs/self-hosting/configure/sdk-configuration#the-base-url-is-your-sdk-host).
- [ ] `useTestEnvironment` matches the API key's environment.
- [ ] Associated Domains and App Links list both link domains: [Universal Links and App Links](https://docs.grovs.io/docs/self-hosting/configure/sdk-configuration#universal-links-and-app-links).
- [ ] A link opened on a real device lands in the app: [Verify the connection](https://docs.grovs.io/docs/self-hosting/configure/sdk-configuration#verify-the-connection).