Before it serves real traffic.
WHAT TO VERIFY IN CONFIGURATION
Debug disabled Errors logged, not displayed Correct endpoints and credentials Every required value present
WHAT TO CONFIRM
No secrets in the code or repository No development dependencies installed No test data or accounts remaining
WHAT TO SET UP
Structured logging with request identifiers Health endpoints Metrics Alerting Backups, with a tested restore
WHAT TO CONFIGURE AT THE BOUNDARY
Encryption throughout Security headers Rate limits Request and body size limits Timeouts
WHAT TO PREPARE
A deployment procedure A rollback procedure A record of what is deployed
WHAT TO DOCUMENT
How to deploy How to restore How to access logs Who to contact
WHERE TO KEEP THAT
Somewhere reachable when the system is not.
WHAT TO TEST BEFORE OPENING
Every important path Behaviour when a dependency is unavailable Restoring from a backup
