Production Deployment

# TaskFlow Production Deployment Runbook

## Preflight
1. Required CI checks are green for the exact release commit.
2. Verify production environment variables and secret scopes.
3. Verify Supabase production Site URL and redirect allowlist.
4. Confirm recovery posture: recent backup/PITR where required.
5. Review Prisma migrations for backward compatibility.

## Deploy
1. Run `prisma migrate deploy` as a one-off production migration job.
2. Promote the exact API image `sha-<commit>` to Railway.
3. Wait for `/health/ready` to pass.
4. Promote/deploy the matching verified web commit on Vercel.
5. Run smoke tests.
6. Observe 5xx, p95 latency, readiness, database signals, and Sentry.

## Rollback
- If API code/config is broken, roll Railway back to the last known-good deployment/image and rerun smoke tests.
- If web code/config is broken, promote a known-good previous Vercel deployment/commit.

# Production Environment Matrix

| Variable | Web | API | Secret? | Notes |
|---|---:|---:|---:|---|
| NEXT_PUBLIC_SITE_URL | yes | no | no | Canonical web origin |
| NEXT_PUBLIC_API_URL | yes | no | no | Public API origin |
| NEXT_PUBLIC_SUPABASE_URL | yes | no | no | Public project URL |
| NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY | yes | no | no | Browser-safe public key |
| DATABASE_URL | no | yes | yes | Production Postgres connection |
| SUPABASE_URL | no | yes | no | Production project URL |
| SUPABASE_SERVICE_ROLE_KEY | no | yes | yes | Server only |
| CORS_ORIGIN | no | yes | no | Exact production web origin |
| SENTRY_DSN | as needed | as needed | treat carefully | Production telemetry |

Never use `NEXT_PUBLIC_` for database credentials, service-role keys, registry tokens, or other secrets.

# TaskFlow Production Topology

- Web: `https://app.taskflow.example.com` -> Vercel (`apps/web`)
- API: `https://api.taskflow.example.com` -> Railway Docker image service
- Data/Auth/Storage/Realtime: separate production Supabase project

## Environment rule

Local, staging, and production use separate configuration. Preview deployments must not receive production credentials merely for convenience.

## Release identity

Use the same Git commit SHA in API image tags, release notes, error monitoring, and deployment records.

# TaskFlow Production Deployment Snapshot

This snapshot is a study/reference package for Phase 34. Replace `taskflow.example.com`, project references, image paths, and secrets with real environment values.

Primary course topology:
- Next.js -> Vercel
- NestJS/Fastify -> Railway from GHCR SHA image
- PostgreSQL/Auth/Storage/Realtime -> Supabase production project

Render is documented as an API-host alternative.

# Source Notes

Current source basis verified during Phase 34 generation:

- Vercel environment configuration and deployment protection guidance.
- Railway Docker-image sources, GHCR private registries, deployment health checks, domains, rollback behavior.
- Render Docker web-service and HTTP health-check documentation as the API-host alternative.
- Supabase production checklist, shared responsibility model, maturity model, Auth redirect URLs, and security configuration guidance.

The course topology and release decisions remain TaskFlow architecture choices; provider behavior should be rechecked before a future production launch because cloud platforms evolve.

# Supabase Production Checklist for TaskFlow

- Use a production project separate from local/staging.
- Set Auth Site URL to the canonical production web origin.
- Add exact production Auth redirect paths.
- Review Security Advisor and Performance Advisor.
- Apply schema through version-controlled migrations.
- Verify indexes and connection topology under expected load.
- Configure private Storage bucket rules used by Task attachments.
- Deploy Realtime Broadcast triggers and authorization policies.
- Review backups/PITR and access controls appropriate to the business.

// Production binding example - adapt to the existing TaskFlow main.ts.
const host = '0.0.0.0';
const port = Number(process.env.PORT ?? 3001);

await app.listen(port, host);

NODE_ENV=production
# PORT is injected by Railway. The app must listen on 0.0.0.0:$PORT.
DATABASE_URL=replace-with-production-connection
SUPABASE_URL=https://PROJECT_REF.supabase.co
SUPABASE_PUBLISHABLE_KEY=replace-with-public-key
SUPABASE_SERVICE_ROLE_KEY=replace-with-server-only-secret
CORS_ORIGIN=https://app.taskflow.example.com
# SENTRY_DSN=...

NEXT_PUBLIC_SITE_URL=https://app.taskflow.example.com
NEXT_PUBLIC_API_URL=https://api.taskflow.example.com
NEXT_PUBLIC_SUPABASE_URL=https://PROJECT_REF.supabase.co
NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=replace-with-public-key
# SENTRY_DSN=...

# Railway API Service

- Source: Docker Image
- Image: `ghcr.io/<org>/<repo>-api:sha-<full-commit>`
- Healthcheck: `/health/ready`
- Public domain: `api.taskflow.example.com`
- Keep GHCR pull credentials read-only.
- Do not use `:latest` for production application releases.
- Railway health checks gate new deployments before traffic promotion.

# Render Alternative for the API

Render can host the NestJS Docker web service as an alternative to Railway. Configure the service to listen on `0.0.0.0` and the platform port, set an HTTP health-check path such as `/health/ready`, and attach the custom API domain. Render uses health checks when deciding whether a new web-service deployment can receive traffic.

Keep the same application-level architecture and production environment separation regardless of platform.

param(
  [string]$Web = "https://app.taskflow.example.com",
  [string]$Api = "https://api.taskflow.example.com"
)

$ErrorActionPreference = "Stop"

Write-Host "Checking API liveness..."
Invoke-WebRequest "$Api/health/live" -UseBasicParsing | Out-Null

Write-Host "Checking API readiness..."
Invoke-WebRequest "$Api/health/ready" -UseBasicParsing | Out-Null

Write-Host "Checking web sign-in route..."
Invoke-WebRequest "$Web/sign-in" -UseBasicParsing | Out-Null

Write-Host "PASS: unauthenticated production smoke checks"
Write-Host "Run the authenticated smoke flow separately with a controlled test identity."

# Production Verification Matrix

| Check | Expected |
|---|---|
| Web custom domain | HTTPS + expected production app |
| API `/health/live` | 2xx |
| API `/health/ready` | 2xx when DB is available |
| Auth sign in | Session established |
| Auth confirmation/reset | Returns to production domain |
| GET /tasks as member | Only authorized rows |
| Cross-workspace ID | 403/404 according to policy |
| Create/update test Task | Persists after reload |
| Attachment flow | Private upload/download works |
| Realtime flow | Authorized peer receives refresh signal |
| 5xx / Sentry | No unexpected release regression |
| Rollback rehearsal | Known-good version restored |