Production go-live checklist

Run through this list before you flip your FastStaq deployment to public. It catches the issues that most commonly bite at launch.

Secrets and configuration

• Strong, unique JWT_SECRET (32+ chars), ENCRYPTION_KEY, API_KEY_PEPPER, and AFFILIATE_ATTRIBUTION_SECRET.
• METRICS_BEARER_TOKEN set so /metrics is protected.
• No test or placeholder values left in .env.
• FRONTEND_URL (and BACKEND_URL if used) point at the real domains.

Database and Redis

• Production DATABASE_URL with SSL, and migrations applied (db:migrate:deploy).
• Managed Redis reachable with REDIS_PASSWORD set.
• Connection pool sizes budgeted under your provider limits.
• Backups enabled on the database.

Payments

• Live Stripe keys (sk_live_...).
• Live products/prices created and the correct STRIPE_PRICE_* set.
• Live webhook endpoint created and STRIPE_WEBHOOK_SECRET set. See Setting up Stripe webhooks (live).
• A real (small) test purchase provisions correctly.

Email and storage

• SMTP configured with an authenticated domain (SPF/DKIM/DMARC).
• File storage bucket configured with S3_PUBLIC_URL and the client NEXT_PUBLIC_STORAGE_URL.

Security and proxy

• HTTPS enforced end to end.
• TRUST_PROXY_HOPS set to match your proxy chain.
• WEBHOOK_ALLOW_PRIVATE_NETWORKS=false.
• Admin 2FA policy decided (COMPLIANCE_REQUIRE_MFA_FOR_ADMINS / ADMIN_2FA_ENFORCED).

Compliance flags

• AUDIT_LOG_STRICT=true, retention >= 365 days, MFA for admins on. The server refuses to boot in production if these are unsafely relaxed unless you set the documented break-glass override.

Observability

• Health checks wired for API and worker.
• Logs shipping to your aggregator.
• An admin account exists and can reach /admin.

Content

• Legal pages generated with your details. See Legal pages and consent.
• Knowledge base and any launch blog posts published.

Related articles

• Deploying to production with Docker
• Setting up Stripe webhooks (live)

Still need help?

Open a support ticket if any check fails.