# SEEN - Production Deployment Checklist

Use this checklist before deploying SEEN to production.

## Pre-Deployment

### Security Configuration

- [ ] **Generate Strong Secrets**
  ```bash
  ./scripts/generate-secrets.sh
  ```
  - [ ] JWT secret (32+ bytes)
  - [ ] Database password (20+ characters)
  - [ ] Cache password (optional)

- [ ] **Configure Environment**
  - [ ] Copy `backend/.env.production` to `backend/.env.production.local`
  - [ ] Update `SEEN_AUTH_JWT_SECRET` with generated secret
  - [ ] Update `POSTGRES_PASSWORD` in docker-compose.prod.yml
  - [ ] Set `SEEN_TMDB_API_KEY` (get from https://www.themoviedb.org/settings/api)
  - [ ] Set `SEEN_IGDB_CLIENT_ID` and `SEEN_IGDB_CLIENT_SECRET` (optional)
  - [ ] Update `SEEN_CORS_ALLOWED_ORIGINS` with your domain

- [ ] **HTTPS/TLS Setup**
  - [ ] Domain name configured and pointing to server
  - [ ] SSL certificate obtained (Let's Encrypt recommended)
  - [ ] Reverse proxy configured (Caddy/Nginx/Traefik)
  - [ ] HTTP to HTTPS redirect enabled
  - [ ] HSTS header configured

- [ ] **Security Headers**
  - [ ] Verify nginx.conf has all security headers
  - [ ] CSP configured for your domain
  - [ ] X-Frame-Options set
  - [ ] X-Content-Type-Options set

- [ ] **Access Control**
  - [ ] Database not exposed to public internet
  - [ ] Cache not exposed to public internet
  - [ ] Only ports 80 and 443 open on firewall
  - [ ] SSH access restricted to specific IPs (if applicable)

### Infrastructure

- [ ] **Server Requirements**
  - [ ] 2+ CPU cores
  - [ ] 4GB+ RAM
  - [ ] 20GB+ disk space
  - [ ] Ubuntu 22.04 or similar Linux distribution
  - [ ] Docker and Docker Compose installed

- [ ] **Resource Limits**
  - [ ] CPU limits configured in docker-compose.prod.yml
  - [ ] Memory limits configured
  - [ ] Disk space monitoring set up

- [ ] **Networking**
  - [ ] Internal network configured for services
  - [ ] Firewall rules applied
  - [ ] DNS records configured
  - [ ] Load balancer configured (if scaling)

### Backup Strategy

- [ ] **Automated Backups**
  - [ ] Backup service enabled in docker-compose.prod.yml
  - [ ] Backup retention policy set (default: 7 days)
  - [ ] Backup directory created: `mkdir -p backups`
  - [ ] Backup permissions set: `chmod 700 backups`

- [ ] **Backup Testing**
  - [ ] Test backup creation
  - [ ] Test backup restoration
  - [ ] Verify backup file integrity
  - [ ] Document restore procedure

- [ ] **Off-site Backups**
  - [ ] Configure backup sync to remote storage (S3, etc.)
  - [ ] Encrypt backups before transfer
  - [ ] Test remote backup restoration

### Monitoring

- [ ] **Health Checks**
  - [ ] Backend health endpoint accessible
  - [ ] Frontend health endpoint accessible
  - [ ] Database health check working
  - [ ] Cache health check working

- [ ] **Logging**
  - [ ] Log rotation configured (10MB max, 3 files)
  - [ ] Log aggregation set up (optional: ELK, Loki)
  - [ ] Error tracking configured (optional: Sentry)
  - [ ] Access logs enabled

- [ ] **Metrics**
  - [ ] Prometheus metrics endpoint (optional)
  - [ ] Grafana dashboards (optional)
  - [ ] Alert rules configured
  - [ ] Uptime monitoring (optional: UptimeRobot, Pingdom)

### Application Configuration

- [ ] **Rate Limiting**
  - [ ] `SEEN_RATE_LIMIT_ENABLED=true`
  - [ ] Rate limits configured appropriately
  - [ ] Test rate limiting works

- [ ] **CORS**
  - [ ] `SEEN_CORS_ALLOWED_ORIGINS` set to your domain
  - [ ] No wildcard (*) in production
  - [ ] Test CORS from browser

- [ ] **Cookies**
  - [ ] `SEEN_SECURE_COOKIES=true`
  - [ ] SameSite policy configured
  - [ ] Test cookie security

- [ ] **Database**
  - [ ] Connection pool size appropriate (default: 25)
  - [ ] PostgreSQL tuning applied
  - [ ] Indexes verified
  - [ ] Vacuum schedule configured

- [ ] **Cache**
  - [ ] Memory limit set (default: 512MB)
  - [ ] Eviction policy configured (allkeys-lru)
  - [ ] TTL values appropriate
  - [ ] Persistence enabled

## Deployment

### Build and Deploy

- [ ] **Code Quality**
  - [ ] All tests passing
  - [ ] No TypeScript errors
  - [ ] No Go build errors
  - [ ] Linting passes
  - [ ] Security scan completed

- [ ] **Build Images**
  ```bash
  docker compose -f docker-compose.yml -f docker-compose.prod.yml build
  ```
  - [ ] Frontend builds successfully
  - [ ] Backend builds successfully
  - [ ] Images tagged appropriately

- [ ] **Deploy Services**
  ```bash
  docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
  ```
  - [ ] All services start successfully
  - [ ] Health checks pass
  - [ ] No error logs

### Verification

- [ ] **Smoke Tests**
  - [ ] Frontend loads at https://yourdomain.com
  - [ ] Backend API responds at /api/v1/health/live
  - [ ] User registration works
  - [ ] User login works
  - [ ] Dashboard loads
  - [ ] Search works
  - [ ] Watch later works
  - [ ] Downloads work

- [ ] **Security Tests**
  - [ ] HTTPS enforced
  - [ ] Security headers present
  - [ ] CORS working correctly
  - [ ] Rate limiting active
  - [ ] Authentication required for protected endpoints
  - [ ] SQL injection tests pass
  - [ ] XSS tests pass

- [ ] **Performance Tests**
  - [ ] Response times acceptable (<100ms for cached)
  - [ ] Cache hit rate >80%
  - [ ] Database queries optimized
  - [ ] No memory leaks
  - [ ] CPU usage normal

## Post-Deployment

### Monitoring

- [ ] **Set Up Alerts**
  - [ ] Health check failures
  - [ ] High error rates
  - [ ] High resource usage
  - [ ] Disk space low
  - [ ] Backup failures

- [ ] **Regular Checks**
  - [ ] Daily: Check logs for errors
  - [ ] Daily: Verify backups completed
  - [ ] Weekly: Review metrics and performance
  - [ ] Weekly: Check for security updates
  - [ ] Monthly: Test disaster recovery

### Maintenance

- [ ] **Update Schedule**
  - [ ] Security patches: Immediate
  - [ ] Minor updates: Weekly
  - [ ] Major updates: Monthly
  - [ ] Dependency updates: Monthly

- [ ] **Backup Verification**
  - [ ] Weekly: Verify backup files exist
  - [ ] Monthly: Test backup restoration
  - [ ] Quarterly: Test disaster recovery plan

- [ ] **Database Maintenance**
  - [ ] Weekly: VACUUM ANALYZE
  - [ ] Monthly: Check table sizes
  - [ ] Quarterly: Review indexes
  - [ ] Yearly: Major version upgrade

### Documentation

- [ ] **Operations Runbook**
  - [ ] Deployment procedure documented
  - [ ] Rollback procedure documented
  - [ ] Disaster recovery plan documented
  - [ ] Troubleshooting guide created
  - [ ] Contact information updated

- [ ] **User Documentation**
  - [ ] User guide created
  - [ ] API documentation published
  - [ ] FAQ created
  - [ ] Support channels documented

## Security Audit

### Regular Security Checks

- [ ] **Monthly**
  - [ ] Review access logs for suspicious activity
  - [ ] Check for failed login attempts
  - [ ] Verify SSL certificate expiry
  - [ ] Update dependencies
  - [ ] Review firewall rules

- [ ] **Quarterly**
  - [ ] Full security audit
  - [ ] Penetration testing
  - [ ] Dependency vulnerability scan
  - [ ] Review and rotate secrets
  - [ ] Update security documentation

- [ ] **Yearly**
  - [ ] Comprehensive security review
  - [ ] Third-party security audit
  - [ ] Disaster recovery drill
  - [ ] Compliance review
  - [ ] Update security policies

## Compliance

### Data Protection

- [ ] **GDPR (if applicable)**
  - [ ] Privacy policy published
  - [ ] Cookie consent implemented
  - [ ] Data retention policy defined
  - [ ] User data export capability
  - [ ] User data deletion capability

- [ ] **General**
  - [ ] Terms of service published
  - [ ] Data encryption at rest (optional)
  - [ ] Data encryption in transit (HTTPS)
  - [ ] Audit logging enabled
  - [ ] Incident response plan documented

## Sign-Off

- [ ] **Technical Lead**: _________________ Date: _______
- [ ] **Security Review**: _________________ Date: _______
- [ ] **Operations**: _________________ Date: _______
- [ ] **Management**: _________________ Date: _______

## Notes

Use this space to document any deviations from the checklist or additional steps taken:

```
[Add notes here]
```

---

**Checklist Version**: 1.0.0  
**Last Updated**: April 6, 2026  
**Next Review**: [Set date]
