> ## Documentation Index
> Fetch the complete documentation index at: https://docs.apowerb.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Production notes

> What to check before and after a deployment.

## Before

* `WORKING_MODE=production`
* `ENCRYPT_KEY` generated, backed up, never rotated casually
* `RAG_WEBHOOK_SECRET` changed from its default
* `FRONTEND_URLS` restricted to the real origins
* `PUBLIC_BASE_URL` set to the public HTTPS URL — webhook registration uses it
* A database dump taken, since migrations run forward at boot

## Network surface

Only expose what needs exposing. Internal services — collectors, ETL, schedulers — bind
to loopback and stay behind the reverse proxy.

<Warning>
  Check the listening surface after every deployment, not just at install time. A
  service that binds `0.0.0.0` by default is one compose edit away from being on the
  public internet without authentication.
</Warning>

## After

Verify three things separately, because they fail independently:

<Steps>
  <Step title="Installed">
    The package and its extras are present in the environment.
  </Step>

  <Step title="Loaded">
    Extensions named in `TH2_EXTENSIONS` actually loaded. Installing a brick without
    naming it leaves the service healthy and silently short of a capability — see
    [Editions](/concepts/editions).
  </Step>

  <Step title="Started">
    The expected module is the one running. A hard-coded module path in a deploy script
    survives a rename and starts the wrong thing.
  </Step>
</Steps>

Then confirm the surface: the number of routes served should match what the previous
known-good instance served.

```bash theme={null}
curl -s https://YOUR_DOMAIN/openapi.json | python3 -c 'import json,sys; print(len(json.load(sys.stdin)["paths"]), "paths")'
```


## Related topics

- [Configuration](/configuration.md)
- [Database](/self-hosting/database.md)
- [Contributing](/contributing/contributing.md)
- [RAG](/guides/rag.md)
- [Architecture](/concepts/architecture.md)