Skip to main content

​
Before

  • WORKING_MODE=production
  • ENCRYPT_KEY generated, backed up, never rotated casually
  • RAG_WEBHOOK_SECRET changed from its default
  • FRONTEND_URLS restricted to the real origins
  • PUBLIC_BASE_URL set to the public HTTPS URL — webhook registration uses it
  • A database dump taken, since migrations run forward at boot

​
Network surface

Only expose what needs exposing. Internal services — collectors, ETL, schedulers — bind to loopback and stay behind the reverse proxy.
Check the listening surface after every deployment, not just at install time. A service that binds 0.0.0.0 by default is one compose edit away from being on the public internet without authentication.

​
After

Verify three things separately, because they fail independently:
1

Installed

The package and its extras are present in the environment.
2

Loaded

Extensions named in TH2_EXTENSIONS actually loaded. Installing a brick without naming it leaves the service healthy and silently short of a capability — see Editions.
3

Started

The expected module is the one running. A hard-coded module path in a deploy script survives a rename and starts the wrong thing.
Then confirm the surface: the number of routes served should match what the previous known-good instance served.

Related topics

ConfigurationDatabaseContributingRAGArchitecture