Platform / Platform
Production readiness
Runtime probes, durable secret storage, deployment gates, authorization boundaries, and outbound network protections used by the production release.
01 Health and observability endpoints
reference| Route | Behavior | Authentication |
|---|---|---|
| GET /health | Liveness JSON with status and timestamp | Public |
| GET /ready | Checks the repository, pending migrations, and required Oban queues; unhealthy returns 503 | Public |
| GET /metrics | Prometheus text export; responses are never cached | Dedicated bearer token required in production |
02 Durable managed secrets
detailsRequired provider
Production requires SECRET_PROVIDER=postgres or SECRET_PROVIDER=aws_secrets_manager. The local ETS provider is allowed only in development and test because a restart destroys its values.
Stable encryption key
SECRETS_ENCRYPTION_KEY must be at least 32 bytes and remain stable across releases and nodes. PostgreSQL values are encrypted at rest; the key also stabilizes credential digests for every provider.
03 Release and migration behavior
detailsVersioned, readiness-gated deploys
deploy.sh builds a versioned release, runs database migrations, switches the active symlink, restarts the service, and waits up to 30 seconds for /ready. A failed restart or readiness check rolls back when that rollback is safe.
Legacy local-secret migration
A still-running legacy local provider can be exported and imported automatically only when moving to PostgreSQL. The encrypted backup is retained. Automatic rollback is intentionally disabled after that import because restarting the old ETS-backed release would lose its values.
04 Authorization boundaries
detailsWorkspace roles
Owners and admins can manage workspace configuration; members can read and operate; auditors are read-only. Machine callers are authorized by exact credential scopes.
Platform administration
Platform access requires users.admin=true and recent reauthentication. A missing platform_role has owner access; explicit roles are viewer, operator, and owner.
05 Outbound request safety
detailsSSRF and redirect controls
Production outbound HTTP requires HTTPS unless a trusted connector explicitly opts into private networking. Loopback, link-local, multicast, documentation, and other reserved ranges are always blocked; DNS results are validated and pinned, and automatic redirects are disabled.
Related docs
see also