Production Checklist

Use this checklist before you treat a Skitflow instance or a hosted application as production.

Server baseline

• Use a supported Linux distribution from the Installation guide.
• Keep SSH key-based access for administrators and disable password SSH where possible.
• Restrict inbound ports to SSH, HTTP, HTTPS, and the Skitflow ports you explicitly need.
• Keep enough free disk for Docker images, volumes, logs, and backups.
• Put the Skitflow dashboard behind HTTPS before inviting users.

DNS and HTTPS

• Point the dashboard domain to the control-plane server.
• Point application domains to the server or load balancer that receives Traefik traffic.
• Verify ACME certificate issuance after DNS changes.
• Document where DNS is managed and who can change it.

Backups and restore

• Configure database backups for stateful services.
• Configure volume backups for persistent application data.
• Store backups outside the same host or disk that runs the workload.
• Run at least one test restore before relying on the backup plan.
• Record the restore owner and expected recovery time.

Deployment safety

• Prefer CI-built Docker images for production apps, not heavy builds on the Skitflow server.
• Configure health checks for every long-running service.
• Use rollback settings for services where a failed release must revert automatically.
• Keep environment variables scoped to the project/environment that needs them.
• Avoid exposing container ports directly unless the service intentionally bypasses Traefik.

Observability

• Enable Monitoring for server and container resource usage.
• Enable Swarm Monitoring if you run multiple nodes.
• Enable Observability when you need route metrics, logs, and traces.
• Define retention so telemetry does not silently fill the disk.
• Set alert destinations in Notifications.

Security and access

• Give users the minimum role they need.
• Use SSO for teams when available.
• Review audit logs after changing roles, domains, certificates, registries, or secret providers.
• Keep registry credentials and secret-provider credentials out of docs, tickets, and screenshots.

Release and upgrade hygiene

Before upgrading Skitflow itself:

1. Read the release notes for breaking changes.
2. Confirm recent backups exist.
3. Capture the currently running image/version.
4. Upgrade during a maintenance window if the instance hosts critical workloads.
5. Verify dashboard health, Traefik routing, deployments, logs, and backups after the upgrade.