Production Checklist

Use this checklist before launch. For field definitions, see Configuration Index. For deployment steps, see Docker Compose or Helm.

Required

Check	Acceptance criteria
Config validation	synctv config validate --strict passes.
JWT secret	jwt.secret comes from a secret or environment variable and is not an example value.
OPAQUE setup secret	security.opaque_server_setup_secret is generated, backed up, and stable across restarts.
Credential encryption key	security.credential_encryption_key is 64 hex characters and backed up.
TOTP encryption key	security.totp_encryption_key is an independent 64-character hex key and is backed up.
Email outbox encryption key	security.email_outbox_encryption_key is 64 hex characters, shared by all replicas, and backed up.
Short-lived security-domain keys	Proxy signing, media swarm, provider sessions, login discovery, WebAuthn enumeration, and file tokens use six distinct values.
Root password	bootstrap.root_password or SYNCTV_BOOTSTRAP_ROOT_PASSWORD is not committed to Git.
PostgreSQL	Uses persistent storage.
Database backup	At least one restorable backup exists.
Migration	Startup logs or synctv db status show healthy migration state.
Readiness	/health/ready succeeds.
TLS	Public entrypoints use HTTPS.
Management	management gRPC is not exposed to normal public clients.

Caution

OPAQUE, Provider credentials, and the email outbox use separate long-lived secrets. Back up every secret together with PostgreSQL.

Network And Entry Points

Check	Acceptance criteria
HTTP entrypoint	The Nginx reverse proxy or Ingress supports WebSocket upgrades; Nginx proxy caching and response buffering are disabled.
CORS	When frontend and API use different origins, server.cors_allowed_origins contains only real origins.
Trusted proxies	server.trusted_proxies contains only proxy networks you control.
gRPC	Public gRPC uses separate Service/Ingress resources from HTTP.
Metrics	Metrics listener has authentication and is not exposed directly to the public internet.
STUN/RTMP	Required UDP/TCP ports are open when built-in STUN or livestreaming is enabled.

Runtime Dependencies

Check	Acceptance criteria
Redis	Redis is configured for production; multi-replica mode requires Redis.
Redis key prefix	redis.key_prefix is not shared with test, staging, or another production environment.
Logs	Logs are collected and searchable in the existing logging system.
Metrics	A Prometheus-compatible scraper is configured, with alerts based on Metrics Catalog.
Capacity	WebSocket connections, database connections, Redis, proxy bandwidth, and livestream traffic are estimated.

Feature Checks

Feature	Acceptance criteria
WebAuthn/passkeys	webauthn.rp_id and webauthn.rp_origin match the real HTTPS entrypoint.
Email	SMTP is configured and verified with synctv settings test-email.
OAuth2	Browser authorization redirectUrl is in oauth2.allowedRedirectUrls and matches the provider registration; the Apple provider has a Web Services ID, a nativeClientId matching the signed app Bundle ID, and matching server-side secrets.
Provider credentials	Credentials are stored through secrets or controlled admin flows, not in the repository.
File-backed slice cache	Cache directory has capacity planning and cleanup policy.
Livestream HLS	Single-node storage is confirmed; multi-replica mode uses publisher-node proxy, shared_file, or S3.
Cluster mode	All replicas share PostgreSQL, Redis, redis.key_prefix, and cluster.secret.
OpenAPI	Production exposure of /swagger-ui/ and /api-docs/openapi.json has been decided.

Verification Commands

General

synctv config validate --strict
synctv db status
curl -fsS http://localhost:8081/health/ready

Docker Compose

make compose-config
make compose-up
make compose-ps
make compose-logs SERVICE=synctv

Helm

helm lint ./helm/synctv
helm template synctv ./helm/synctv --values values.yaml
kubectl -n synctv rollout status deploy/synctv
kubectl -n synctv get pods

Before Upgrade

Check	Acceptance criteria
Database backup	PostgreSQL backup is complete before upgrade.
Secret continuity	Target version uses the same production secrets.
Test environment	Target version has started in a test environment with migrations, login, room reads/writes, and Provider access verified.
Rolling update	server.shutdown_drain_timeout_seconds is lower than Kubernetes termination grace period.
Rollback	Rollback version, database state, and config source are known.