# Production Verification Checklist

Use this run-book after deploying the production stack.

## 1. Application health
- [ ] `curl http://<server-ip>:3000/api/health` returns `OK`.
- [ ] `docker compose -f docker-compose.prod.yml ps` shows `backend`, `frontend`, `db`, `redis` as healthy.
- [ ] PostgreSQL contains expected tables (`vips`, `drivers`, `schedule_events`, `flights`, `users`).

## 2. HTTPS validation
- [ ] DNS resolves the public domain to the Droplet (`dig vip.example.com +short`).
- [ ] `certbot certificates` shows the Let's Encrypt certificate with a valid expiry date.
- [ ] `curl -I https://vip.example.com` returns `200 OK`.
- [ ] Qualys SSL Labs scan reaches at least grade **A**.

## 3. Front-end smoke tests
- [ ] Load `/` in a private browser window and confirm the login screen renders.
- [ ] Use dev login or OAuth (depending on environment) to access the dashboard.
- [ ] Verify VIP and driver lists render without JavaScript console errors.

## 4. Hardening review
- [ ] UFW/DigitalOcean firewall allows only SSH (22), HTTP (80), HTTPS (443).
- [ ] `ADMIN_PASSWORD` and `JWT_SECRET` rotated to secure values.
- [ ] Scheduled backups for PostgreSQL configured (e.g., `pg_dump` cron or DO backups).
- [ ] Droplet rebooted after kernel updates (`needrestart` output clean).
- [ ] `docker compose logs` reviewed for warnings or stack traces.

Document any deviations above and create follow-up tasks.

