Production Checklist

A checklist to run through before deploying your application to production.

TIP

For security architecture and core features, see Security Overview.

Pre-deployment Checks

File Security

• [ ] .env.production file exists
• [ ] File permissions are 600 or stricter
• [ ] Sensitive files added to .gitignore
• [ ] Configuration files contain no placeholders (e.g., change-me, xxx)

# Check permissions
ls -la .env.production
# Should show: -rw------- (600)

# Fix permissions
chmod 600 .env.production

Configuration Validation

• [ ] All required keys are set
• [ ] Sensitive values are not empty
• [ ] Value formats are correct (URLs, ports, etc.)
• [ ] No hardcoded secrets

cfg := env.ProductionConfig()
cfg.RequiredKeys = []string{
    "DB_HOST", "DB_PORT", "DB_USER", "DB_PASSWORD",
    "API_KEY", "API_URL",
}
cfg.FailOnMissingFile = true

Security Configuration Checks

Audit Logging

• [ ] Audit logging is enabled
• [ ] Log directory is writable
• [ ] Log file permissions are correct

auditFile, _ := os.OpenFile("/var/log/app/audit.log",
    os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0600)
cfg.AuditEnabled = true
cfg.AuditHandler = env.NewJSONAuditHandler(auditFile)

Sensitive Data Handling

• [ ] Sensitive values obtained with GetSecure
• [ ] Close() called promptly to release resources
• [ ] Logs do not output raw sensitive values

secret := loader.GetSecure("DB_PASSWORD")
defer secret.Close()
log.Printf("Password length: %d", secret.Length())

Access Control

• [ ] AllowedKeys whitelist set (recommended)
• [ ] ValidateValues enabled
• [ ] Reasonable size limits set

cfg.AllowedKeys = []string{"APP_NAME", "DB_HOST", "API_KEY"}
cfg.ValidateValues = true
cfg.MaxVariables = 100

At Deployment Checks

• [ ] Configuration files loaded from a secure location
• [ ] Application validates configuration at startup
• [ ] Application refuses to start on configuration error
• [ ] Sensitive information is not output to logs

Post-deployment Checks

• [ ] Application runs normally
• [ ] Audit logs are being written correctly
• [ ] No sensitive information leaked
• [ ] Monitoring for configuration-related errors

Quick Check Script

#!/bin/bash
# pre-deploy-check.sh

set -e

echo "=== Pre-deployment Config Check ==="

# Check file exists
[ -f ".env.production" ] || { echo "ERROR: .env.production not found"; exit 1; }

# Check permissions
PERMS=$(stat -c %a .env.production 2>/dev/null || stat -f %Lp .env.production)
[ "$PERMS" = "600" ] || [ "$PERMS" = "400" ] || echo "WARNING: permissions are $PERMS"

# Check for placeholders
grep -qE "(change-?me|placeholder|xxx|YOUR_)" .env.production && \
    { echo "ERROR: Found placeholder values"; exit 1; }

# Check required keys
for key in DB_HOST DB_PORT DB_USER DB_PASSWORD API_KEY; do
    grep -q "^$key=" .env.production || { echo "ERROR: Missing $key"; exit 1; }
done

echo "=== All checks passed ==="

Related Documentation

• Security Overview - Security architecture and core features
• SecureValue API - Secure value handling
• Constants & Errors - Forbidden keys list