Skip to content

Latest commit

 

History

History
290 lines (229 loc) · 9.72 KB

PRE_DEPLOYMENT_CHECKLIST.md

File metadata and controls

290 lines (229 loc) · 9.72 KB

Pre-Deployment Checklist

This checklist ensures the Stellar Micro-Donation API is production-ready before deployment. Complete all items and verify each step before proceeding to production.

1. Environment Configuration

Required Environment Variables

  • API_KEYS - Set with strong, randomly generated keys (use openssl rand -hex 32)
  • ENCRYPTION_KEY - Required for production environment (32+ character random string)
  • NODE_ENV - Set to production
  • STELLAR_NETWORK - Set to mainnet for production (or testnet for staging)
  • PORT - Configured (default: 3000, must be 1-65535)

Optional Environment Variables (Verify if Used)

  • HORIZON_URL - Custom Horizon URL if not using default
  • MOCK_STELLAR - Set to false (or remove) for production
  • MIN_DONATION_AMOUNT - Configured appropriately (default: 0.01 XLM)
  • MAX_DONATION_AMOUNT - Configured appropriately (default: 10000 XLM)
  • MAX_DAILY_DONATION_PER_DONOR - Set if rate limiting is needed
  • LOG_TO_FILE - Set to true for production logging
  • LOG_DIR - Configured if file logging is enabled
  • LOG_VERBOSE - Set to false for production

Environment Validation

  • Run environment validation: Ensure all required variables pass validation
  • Verify .env file is NOT committed to version control
  • Confirm .env.example is up-to-date with all required variables
  • Test environment variable loading on target deployment platform

2. Security Checks

API Security

  • API keys are strong and unique (minimum 32 characters)
  • API keys are stored securely (environment variables, secrets manager)
  • Rate limiting is configured appropriately
  • CORS settings are configured for production domains only
  • Authentication middleware is enabled on all protected endpoints

Stellar Network Security

  • Using mainnet for production (not testnet)
  • Service account secret keys are stored securely
  • Wallet private keys are never logged or exposed
  • Transaction signing happens server-side only
  • Memo fields are validated and sanitized

Data Security

  • Database file permissions are restricted (600 or 640)
  • Database backups are configured and tested
  • Sensitive data is encrypted at rest
  • Error messages don't expose sensitive information in production
  • SQL injection prevention is in place (parameterized queries)

Network Security

  • HTTPS/TLS is enabled and configured
  • SSL certificates are valid and not expired
  • Security headers are configured (helmet.js or equivalent)
  • Input validation is enabled on all endpoints
  • File upload restrictions are in place (if applicable)

3. Code Quality & Testing

Linting & Code Standards

  • Run npm run lint - All linting errors resolved
  • Code follows project style guidelines
  • No console.log statements in production code
  • All TODO/FIXME comments are addressed or documented

Testing

  • Run npm test - All tests pass
  • Unit test coverage is adequate (check coverage report)
  • Integration tests pass with real Stellar testnet
  • End-to-end tests completed successfully
  • Load testing performed (if applicable)
  • Error handling tested for all endpoints

Dependencies

  • Run npm audit - No high/critical vulnerabilities
  • All dependencies are up-to-date or documented exceptions exist
  • No unused dependencies in package.json
  • Production dependencies are separated from dev dependencies
  • Lock file (package-lock.json) is committed

4. Database Preparation

Database Setup

  • Database schema is initialized: npm run init-db
  • All migrations are applied: npm run migrate:memo (if applicable)
  • Database indexes are created for performance
  • Database connection pooling is configured
  • Database backup strategy is in place

Data Validation

  • Sample/test data is removed from production database
  • Database constraints are properly defined
  • Foreign key relationships are validated
  • Data integrity checks pass

5. Application Configuration

Server Configuration

  • Server starts successfully: npm start
  • Health check endpoint responds: GET /health
  • All API endpoints are accessible and respond correctly
  • Recurring donation scheduler is running
  • Scheduler interval is appropriate for production (default: 60s)

Logging Configuration

  • Application logging is configured and working
  • Log rotation is set up (if file logging enabled)
  • Log levels are appropriate for production (INFO or WARN)
  • Sensitive data is not logged (API keys, private keys, passwords)
  • Error tracking/monitoring is configured (e.g., Sentry, LogRocket)

Performance

  • Response times are acceptable under expected load
  • Memory usage is within acceptable limits
  • Database query performance is optimized
  • Connection timeouts are configured appropriately
  • Resource limits are set (if using containers)

6. Stellar Network Integration

Network Configuration

  • Stellar network is set to mainnet for production
  • Horizon URL is correct for the target network
  • Network connectivity to Horizon is verified
  • Transaction submission is tested on target network
  • Transaction verification is working correctly

Wallet & Account Setup

  • Service account is funded with sufficient XLM
  • Service account trustlines are established (if needed)
  • Wallet creation is tested and working
  • Transaction history retrieval is functional
  • Balance checking is accurate

Transaction Handling

  • One-time donations are processed correctly
  • Recurring donations are scheduled and executed
  • Transaction memos are properly formatted
  • Idempotency is working (duplicate prevention)
  • Failed transaction handling is robust

7. Monitoring & Observability

Application Monitoring

  • Health check endpoint is monitored
  • Uptime monitoring is configured
  • Performance metrics are collected
  • Error rates are tracked
  • API response times are monitored

Alerting

  • Critical error alerts are configured
  • Service downtime alerts are set up
  • Database connection failure alerts exist
  • Stellar network connectivity alerts are configured
  • Disk space and resource alerts are in place

Logging & Debugging

  • Centralized logging is configured (if applicable)
  • Log aggregation is working
  • Debug mode is disabled in production
  • Stack traces are captured for errors
  • Request/response logging is appropriate for production

8. Documentation

API Documentation

  • API endpoints are documented
  • Request/response examples are provided
  • Error codes and messages are documented
  • Authentication requirements are clear
  • Rate limits are documented

Operational Documentation

  • Deployment process is documented
  • Rollback procedure is documented
  • Backup and restore procedures are documented
  • Incident response plan exists
  • Runbook for common issues is available

Code Documentation

  • README.md is up-to-date
  • Architecture documentation is current
  • Configuration options are documented
  • Environment variables are documented in .env.example
  • Code comments are adequate for complex logic

9. CI/CD Pipeline

Continuous Integration

  • CI pipeline runs successfully
  • All automated tests pass in CI
  • Linting checks pass in CI
  • Security scans pass (CodeQL or equivalent)
  • Build artifacts are generated correctly

Deployment Automation

  • Deployment scripts are tested
  • Deployment process is documented
  • Rollback mechanism is in place and tested
  • Environment-specific configurations are managed
  • Deployment notifications are configured

Version Control

  • All changes are committed to version control
  • Branch is up-to-date with main/production branch
  • Version number is updated (package.json)
  • CHANGELOG is updated with release notes
  • Git tags are created for releases

10. Final Verification

Pre-Deployment Testing

  • Smoke tests pass on staging environment
  • Critical user flows are tested end-to-end
  • Performance testing completed
  • Security scanning completed
  • Backup and restore tested

Deployment Readiness

  • Deployment window is scheduled
  • Stakeholders are notified
  • Rollback plan is ready
  • Support team is briefed
  • Monitoring dashboards are ready

Post-Deployment Plan

  • Post-deployment verification steps are defined
  • Monitoring plan for first 24 hours is in place
  • On-call rotation is scheduled
  • Communication plan for issues is established
  • Success metrics are defined

Quick Verification Commands

Run these commands to verify key aspects before deployment:

# Install dependencies
npm install

# Run linting
npm run lint

# Run tests
npm test

# Check for vulnerabilities
npm audit

# Initialize database
npm run init-db

# Start server (verify it starts without errors)
npm start

# In another terminal, test health endpoint
curl http://localhost:3000/health

Emergency Contacts

Document key contacts for production issues:

  • DevOps/Infrastructure team contact
  • Database administrator contact
  • Security team contact
  • Product owner contact
  • On-call engineer contact

Sign-Off

  • Developer sign-off: Code is production-ready
  • QA sign-off: Testing is complete
  • Security sign-off: Security review passed
  • DevOps sign-off: Infrastructure is ready
  • Product owner sign-off: Feature set approved

Deployment Date: _________________

Deployed By: _________________

Version: _________________

Notes: _________________