33 lines
3.3 KiB
Markdown
33 lines
3.3 KiB
Markdown
|
# Phase 15 release checklist
|
||
|
|
|
||
|
|
Use this checklist for a Virtualmin-managed VPS deployment. A checked item is evidence, not an assumption; record the owner, timestamp, commit, image digests, and backup ID in the release record.
|
||
|
|
|
||
|
|
## Go/no-go prerequisites
|
||
|
|
|
||
|
|
- [ ] Reviewed commit and release owner approved; previous image pair and configuration revision are retained for rollback.
|
||
|
|
- [ ] Patched Linux host has Docker Engine and Compose v2, sufficient CPU/RAM/disk, restricted Docker access, host firewalling, and a protected deployment directory outside public web roots.
|
||
|
|
- [ ] Virtualmin/DNS points to the host; HTTPS certificate, renewal monitoring, reverse proxy, and maintenance route are tested.
|
||
|
|
- [ ] API exposure is restricted to the required private path/host; only the intended web entry point is public.
|
||
|
|
- [ ] Production environment values are injected from a protected secret store/environment. `.env` is untracked, mode `0600`, and contains no committed or logged secrets.
|
||
|
|
- [ ] Bootstrap admin values, if needed, are supplied together, used once, removed immediately, and the password is rotated. `AUTOMATED_OUTREACH_ENABLED=false` is verified in rendered Compose.
|
||
|
|
- [ ] Encrypted off-host backup destination, retention schedule, legal-hold owner, monitoring destination, and incident/rollback owner are confirmed.
|
||
|
|
|
||
|
|
## Validate, deploy, and verify
|
||
|
|
|
||
|
|
- [ ] `docker compose config --quiet` passes; rendered configuration was reviewed without exposing secret values.
|
||
|
|
- [ ] Images build from the reviewed commit, are scanned, and their digests are recorded.
|
||
|
|
- [ ] Backup is taken before release/schema change; checksum/manifest is verified.
|
||
|
|
- [ ] Backup restores into an isolated volume/environment; `PRAGMA integrity_check`, foreign-key checks, representative row counts, tenant-scoped reads, and API tests pass. Schema/migration result is recorded.
|
||
|
|
- [ ] `docker compose up -d` completes and both services report `healthy`; running is not accepted as ready.
|
||
|
|
- [ ] `curl -fsS https://<host>/healthz` and the API liveness/readiness endpoints pass (`/api/v1/health/live`, `/api/v1/health/ready`). These checks do not replace authenticated smoke tests.
|
||
|
|
- [ ] Authenticated smoke tests cover login, tenant-scoped list/detail/child access, a safe mutation/audit readback, and cross-tenant non-disclosure.
|
||
|
|
- [ ] Monitoring sees health/restarts, API errors/latency, disk and `/data` pressure, auth failures, backup age/failure, TLS expiry, migration failures, and unexpected egress without collecting secrets or full contact data.
|
||
|
|
- [ ] No outbound provider/send/SMTP activity is present; unexpected egress is treated as an incident.
|
||
|
|
|
||
|
|
## Retain and sign off
|
||
|
|
|
||
|
|
- [ ] Release record contains commit, image digests, non-secret config fingerprint, schema/migration result, backup ID, test output, approver, and rollback decision.
|
||
|
|
- [ ] Data, audit/source lineage, logs, and backup retention/deletion rules are applied; legal holds are preserved.
|
||
|
|
- [ ] Rollback path was reviewed: restore the prior compatible image/config first, stop writes if needed, and restore data only after compatibility approval. Do not use `docker compose down -v` on a data-bearing host.
|
||
|
|
- [ ] Known limitations are accepted explicitly: no Virtualmin/TLS/DNS provisioning, only SQLite-level readiness, no standalone migration/backup CLI, SQLite/in-process worker only, no PITR/HA, and no production egress isolation.
|