Getting started

Production checklist Draft

The base production variant requires these settings before up -d --build. This page mirrors the infrastructure README; the README remains the operational authority.

Required settings

Setting	Purpose
`POSTGRES_USER` / `POSTGRES_DB` / `POSTGRES_PASSWORD`	Production database identity and credentials.
`DATABASE_URL_DOCKER`	Container-reachable connection URL. Write complete URLs; the backend does not expand `${...}` references.
`PESAGUARD_API_URL`	Public base URL used by the status strip and integrations.
`JWT_SECRET_KEY`	Token signing. Treat rotation as a planned operation.
`KAFKA_BOOTSTRAP_SERVERS_DOCKER`	Broker address reachable from containers, not host localhost.
`REDIS_URL_DOCKER`	Redis connection for asynchronous work.
`PESAGUARD_BIND_HOST_DOCKER`	Bind address for the API container.
`API_SERVER_NAME` (AWS/tunnel overlays)	The hostname nginx serves — a hostname, not a URL.

Before you go live

Validate the merged configuration with config --quiet — never with plain config, which can print resolved secrets.
Review actual published ports. The AWS overlay's ports: [] does not necessarily remove base-file published ports during Compose merging.
Keep the root .env out of images and out of git. Merge new keys into existing deployments; do not replace the file.
Confirm the reverse proxy passes X-Forwarded- headers and that TLS terminates in front of the API.
Check status probes answer after rollout, and that the audit trail records the rollout operator.

Not a certification

This checklist mirrors repository documentation. It does not certify production suitability of network or security controls; review exposure against your own environment before go-live.