# Production Readiness

**Task 018** — hardening for internal deployment of Anwal Growth Platform v0.1.0.

## Environment checklist

Copy [`.env.example`](../.env.example) to `.env.local` (dev) or platform secrets (prod).

| Group | Variables | Required |
|-------|-----------|----------|
| Core | `MONGODB_URI`, `NEXTAUTH_SECRET`, `NEXTAUTH_URL`, `APP_URL` | Yes |
| Bootstrap | `INITIAL_ADMIN_*`, `BOOTSTRAP_SECRET` | First deploy only |
| SMTP | `SMTP_HOST`, `SMTP_PORT`, `SMTP_USER`, `SMTP_PASS`, `SMTP_FROM` | For sending |
| IMAP | `IMAP_HOST`, `IMAP_PORT`, `IMAP_USER`, `IMAP_PASS`, `IMAP_*` | For inbox sync |
| AI | `AI_PROVIDER`, `OPENAI_API_KEY`, models | Optional (fallback rules work) |
| Sending tuning | `EMAIL_SEND_BATCH_SIZE`, `EMAIL_SEND_DELAY_MS`, `EMAIL_TRACKING_ENABLED` | Optional |

See [10-environment-variables.md](./10-environment-variables.md).

## MongoDB setup

1. Create database (e.g. `anwal_growth`) on Atlas or self-hosted MongoDB 6+.
2. Restrict network access (IP allowlist / VPC).
3. Use a dedicated application user with read/write on the app database only.
4. Set `MONGODB_URI` in deployment secrets.

### Index sync

Duplicate index warning on `users.email` was fixed (schema uses `unique: true` on field only).

After deploy or model changes, sync indexes:

```bash
npx tsx scripts/sync-indexes.ts
```

Requires `MONGODB_URI` loaded (e.g. from `.env.local`). Script: `scripts/sync-indexes.ts`.

## SMTP / IMAP setup

- Configure provider credentials in env (or per-mailbox in Settings after admin login).
- Verify via UI: `/email-test` (SMTP) and inbox sync (IMAP).
- Health check reports `smtp` / `imap` as `configured` or `not_configured` (no secrets).

## AI provider setup

- Default `AI_PROVIDER=fallback` works without API keys.
- For OpenAI: set `OPENAI_API_KEY` and optionally override provider/model in Settings → AI.
- Keys are **never** stored in MongoDB.

## Build and run

```bash
npm install
npm run lint
npm run build
npm start
```

Development:

```bash
npm run dev
```

## Deployment steps (summary)

1. Provision MongoDB + secrets.
2. Set all required env vars on host (Vercel, VPS, container).
3. `npm run build` in CI or on server.
4. Run index sync once against production DB.
5. Bootstrap admin (once): `POST /api/admin/bootstrap` with `x-bootstrap-secret`.
6. Disable or remove `BOOTSTRAP_SECRET` in production after bootstrap.
7. Log in as admin; configure system settings, mailboxes, AI.
8. Run [21-smoke-test-checklist.md](./21-smoke-test-checklist.md).

## Backup plan

- **MongoDB Atlas:** enable continuous backup / snapshots.
- **Self-hosted:** schedule `mongodump`:

```bash
mongodump --uri="$MONGODB_URI" --out=./backup-$(date +%Y%m%d)
```

- Store dumps off-server, encrypted.
- Backup before any **Data Cleanup** scope execution.

## Restore plan

```bash
mongorestore --uri="$MONGODB_URI" --drop ./backup-YYYYMMDD
```

Test restore on a staging database before relying on production restore.

## First admin bootstrap

```bash
curl -X POST "%APP_URL%/api/admin/bootstrap" \
  -H "x-bootstrap-secret: YOUR_BOOTSTRAP_SECRET"
```

Never commit passwords. Rotate `BOOTSTRAP_SECRET` after use.

## Security checklist

- [ ] HTTPS for `NEXTAUTH_URL` and `APP_URL`
- [ ] Strong `NEXTAUTH_SECRET` (32+ random bytes)
- [ ] `BOOTSTRAP_SECRET` unset in prod after first admin
- [ ] MongoDB not publicly open without auth
- [ ] Admin-only `/settings/*` and `/api/settings/**`, `/api/admin/data-cleanup/**`
- [ ] Viewer role cannot POST/PATCH destructive APIs (permission guards)
- [ ] Mailbox passwords encrypted at rest; never returned in API
- [ ] Inbound HTML stripped of scripts in inbox UI (see `src/lib/html-safety.ts`)

## Health endpoint

`GET /api/health` (public) returns:

- `status`: `ok` | `degraded` | `error`
- `version`: app version
- `database`: connection state
- `smtp` / `imap`: config presence only
- `ai`: provider, availability, model (no API keys)

## Post-deployment smoke test

Use [21-smoke-test-checklist.md](./21-smoke-test-checklist.md).

## Related

- [12-deployment.md](./12-deployment.md)
- [11-security.md](./11-security.md)
- [19-data-cleanup-reset.md](./19-data-cleanup-reset.md)