Readiness

This replaces the old “report” style page with something you can actually use. Walk the list before going live and tick the boxes inside your preferred tracker.

Core Services

• PostgreSQL, Redis, backend, and frontend containers are healthy (docker compose ps or provider UI)
• /api/v1/health returns "status": "healthy"
• Admin user exists and you can sign in

Configuration

• JWT_SECRET and SERVER_ENCRYPTION_KEY generated from a secure source
• CORS_ORIGINS and VITE_API_URL match the public domain
• ENABLE_REGISTRATION is set the way you expect (defaults to false)
• Backups or snapshots configured for PostgreSQL and Redis data

Security

• HTTPS enabled end to end (certificate issued or managed by your platform)
• Security headers validated (check with curl -I or securityheaders.com)
• Rate limiting enabled on the backend (default configuration ships enabled)
• Admin accounts protected with MFA where available

Monitoring & Logs

• Logs flowing to the platform dashboard or your log aggregator
• Optional metrics endpoint enabled if you plan to scrape Prometheus (ENABLE_METRICS=true)
• Alerting configured for downtime or error spikes

Final Smoke Test

• Create, edit, and delete an encrypted note via the UI
• Trigger password reset and verify the email flow (if applicable)
• Perform a redeploy to ensure environment variables survive restarts

If something fails, jump to the relevant deployment page or the Troubleshooting section. Keep the checklist short and factual so it never turns into busywork.