Production Checklist

Essential checklist for deploying ZeroStarter to production

Complete this checklist before deploying ZeroStarter to production to ensure security, performance, and reliability.

Environment Configuration

Required Environment Variables

1. Set NODE_ENV to production

   NODE_ENV=production
   

   This enables production optimizations in Next.js and other libraries.

2. Generate authentication secret

   openssl rand -base64 32
   

   Set the output as:

   BETTER_AUTH_SECRET=your-generated-secret
   

   Never reuse development secrets in production. Generate a new one.

3. Configure database connection

   POSTGRES_URL=postgresql://user:password@host:5432/database?sslmode=require
   

   Ensure:

   • SSL is enabled (sslmode=require)
   • Connection pooling is configured
   • Credentials are stored securely
4. Set application URLs

   # API configuration
   HONO_APP_URL=https://api.yourdomain.com
   HONO_TRUSTED_ORIGINS=https://yourdomain.com,https://www.yourdomain.com
   
   # Client configuration
   NEXT_PUBLIC_APP_URL=https://yourdomain.com
   NEXT_PUBLIC_API_URL=https://api.yourdomain.com
   

   Separate multiple trusted origins with commas, no spaces.

Optional Environment Variables

OAuth Providers

If using GitHub OAuth:

GITHUB_CLIENT_ID=your-github-client-id
GITHUB_CLIENT_SECRET=your-github-secret

If using Google OAuth:

GOOGLE_CLIENT_ID=your-google-client-id
GOOGLE_CLIENT_SECRET=your-google-secret

Configure OAuth redirect URLs:

• GitHub: https://yourdomain.com/api/auth/callback/github
• Google: https://yourdomain.com/api/auth/callback/google

Rate Limiting

HONO_RATE_LIMIT=60
HONO_RATE_LIMIT_WINDOW_MS=60000

Default: 60 requests per minute, 120 for authenticated users.

Analytics

NEXT_PUBLIC_POSTHOG_HOST=https://eu.i.posthog.com
NEXT_PUBLIC_POSTHOG_KEY=your-posthog-key

See Analytics documentation for setup.

User Feedback

NEXT_PUBLIC_USERJOT_URL=your-userjot-url

Optional: UserJot integration for user feedback (configuration not yet documented).

Database Setup

1. Choose a PostgreSQL provider

   Recommended providers:

   • Vercel Postgres - Integrated with Vercel deployments
   • Neon - Serverless Postgres with autoscaling
   • Supabase - Postgres with additional features
   • Railway - Simple deployment platform
   • AWS RDS - Enterprise-grade managed Postgres
2. Enable connection pooling

   For serverless deployments, use connection pooling:

   # Neon example
   POSTGRES_URL=postgresql://user:pass@host/db?sslmode=require&pool_timeout=10&max_connections=20
   
3. Run migrations

   bun run db:migrate
   

   Verify schema:

   bun run db:studio
   
4. Set up automated backups

   Configure daily backups with your database provider:

   • Retention period: 7-30 days
   • Backup schedule: Daily at low-traffic hours
   • Point-in-time recovery: Enable if available

Security

Authentication

API Security

Infrastructure

Performance

Build Optimization

1. Verify Turbo cache is working

   turbo build --summarize
   

   Check the summary for cache hits.

2. Enable Next.js optimization features

   Ensure these are enabled in next.config.ts:

   export default {
     compress: true,
     reactStrictMode: true,
     images: {
       formats: ['image/avif', 'image/webp'],
     },
   }
   
3. Configure build caching

   For Vercel:

   • Turborepo Remote Cache is automatic

   For Docker:

   DOCKER_BUILDKIT=1 docker-compose build
   

Runtime Performance

Monitoring

Application Monitoring

1. Set up error tracking

   Integrate error tracking:

   • Sentry - Error tracking and performance monitoring
   • LogRocket - Session replay and error tracking
   • Better Stack - Log aggregation and monitoring
2. Configure analytics

   Set up PostHog or alternative:

   NEXT_PUBLIC_POSTHOG_HOST=https://eu.i.posthog.com
   NEXT_PUBLIC_POSTHOG_KEY=your-key
   

   See Analytics guide.

3. Set up uptime monitoring

   Use services like:

   • Uptime Robot - Free uptime monitoring
   • Better Uptime - Advanced monitoring and status pages
   • Pingdom - Enterprise monitoring

Infrastructure Monitoring

Testing

Pre-Deployment Tests

Post-Deployment Tests

1. Verify application loads

   • Visit your production URL
   • Check browser console for errors
   • Verify static assets load correctly
2. Test authentication

   • Sign up with email
   • Sign in with OAuth providers
   • Test sign out
   • Verify session persistence
3. Test API endpoints

   curl https://api.yourdomain.com/health
   

   Verify protected endpoints require authentication.

4. Test rate limiting

   Make multiple requests to verify rate limiting:

   for i in {1..70}; do curl https://api.yourdomain.com/endpoint; done
   

   Should return 429 after 60 requests.

Documentation

Backup and Recovery

Database Backups

1. Configure automated backups

   Set up with your database provider:

   • Daily automated backups
   • 7-30 day retention
   • Point-in-time recovery if available
2. Test backup restoration

   # Create test backup
   pg_dump $POSTGRES_URL > backup.sql
   
   # Test restore to staging
   psql $STAGING_POSTGRES_URL < backup.sql
   
3. Document recovery procedure

   Create runbook with:

   • Backup location and access
   • Restoration commands
   • Expected recovery time
   • Contact information for database provider

Disaster Recovery

Compliance

GDPR Compliance

Accessibility

Cost Optimization

Vercel Deployment

Docker Deployment

Database

Launch Preparation

Pre-Launch

1. Set up staging environment

   Deploy to staging with production-like configuration:

   # Staging environment
   NODE_ENV=production
   NEXT_PUBLIC_APP_URL=https://staging.yourdomain.com
   NEXT_PUBLIC_API_URL=https://api-staging.yourdomain.com
   
2. Perform load testing

   Use tools like:

   • k6 - Open-source load testing
   • Artillery - Modern load testing toolkit
   • Locust - Python-based load testing

   Example k6 test:

   import http from 'k6/http';
   export default function() {
     http.get('https://api.yourdomain.com/health');
   }
   
3. Review all checklist items

   Go through each section and ensure all items are completed.

Launch Day

1. Deploy to production

   • Deploy API service first
   • Verify API is healthy
   • Deploy web service
   • Monitor error rates
2. Smoke test

   Test critical user flows:

   • Homepage loads
   • Authentication works
   • API calls succeed
   • Database queries work
3. Monitor closely

   Watch for:

   • Error spikes
   • Performance degradation
   • Failed requests
   • Database connection issues

Post-Launch

Ongoing Maintenance

Weekly Tasks

Monthly Tasks

Resources

Vercel Deployment

Vercel-specific deployment guide

Docker Deployment

Docker containerization guide

Analytics Setup

Configure PostHog analytics

Database Management

Database schema and migrations