flyio-prod-checklist

# Fly.io Production Checklist ## Overview Fly.io runs applications on edge infrastructure across 30+ regions with Machines, Volumes, and managed Postgres. A production deployment requires multi-region redundancy, proper secret management, health checks, and rollback procedures. Misconfigured auto-scaling means cold starts; missing volume backups mean data loss. This checklist ensures your Fly.io app is production-hardened. ## Authentication & Secrets - [ ] `FLY_API_TOKEN` stored in CI secrets (never in fly.toml or source) - [ ] All app secrets set via `fly secrets` (not `[env]` block) - [ ] Deploy tokens scoped per app (not org-wide personal tokens) - [ ] Key rotation scheduled (quarterly, or after team changes) - [ ] No hardcoded secrets in Dockerfile or codebase ## API Integration - [ ] Production base URL: app deployed to `https://<app>.fly.dev` - [ ] `force_https = true` in fly.toml http_service - [ ] Custom domain with TLS certificate active and auto-renewing - [ ] `min_machines_running = 1` to avoid cold starts - [ ] Machines deployed in 2+ regions for redundancy - [ ] Concurrency limits tuned (`soft_limit`/`hard_limit` per workload) - [ ] Volumes backed up if using persistent storage ## Error Handling & Resilience - [ ] Health check endpoint configured with appropriate grace period - [ ] Graceful shutdown handles SIGTERM within 10s window - [ ] Auto-stop/auto-start configured for cost optimization - [ ] Postgres standby replica provisioned for database apps - [...