Production hardening checklist

Use this checklist to review a MobilityManager deployment before it goes live. Each item maps to a setting or behaviour enforced by the platform. Work through them alongside the linked detailed articles.

Secrets and keys

• Set a strong Jwt__Key of at least 32 bytes that is not a committed default. The app refuses to start in Production otherwise.
• Set DocumentStorage__LocalEncryptionKey (base64 32-byte) whenever encryption at rest is enabled, or explicitly disable it.
• Use a unique, strong database password and never reuse example values from .env.example.
• Store all secrets in a secret store or Kubernetes Secret — never in ConfigMaps or source control.

Environment and database

• Run with ASPNETCORE_ENVIRONMENT=Production so fail-fast security checks are active.
• Set DatabaseProvider to PostgreSQL or SqlServer and point SystemConnection and TenantConnection at managed databases.
• For SQL Server connections, keep Encrypt=True and validate the server certificate.
• Confirm the account in each connection string has only the privileges it needs.

Transport and network

• Terminate TLS at a reverse proxy, load balancer, or ingress; the container serves plain HTTP on port 8080.
• Do not expose the container port directly to the internet.
• Restrict database ports to the application network only.

Warning: The development Docker Compose file publishes PostgreSQL on port 5432 for convenience. Do not carry that port mapping into a production host.

Runtime and container hardening

• Run the container as a non-root user with a read-only root filesystem and dropped Linux capabilities, as the Kubernetes base manifests do.
• Provide writable volumes only where needed (/tmp, /app/data, /app/logs).
• Set resource requests and limits so a single instance cannot exhaust node memory.
• Pin the image to a specific version tag rather than latest.

Availability and monitoring

• Run at least two replicas with a PodDisruptionBudget so upgrades and node drains keep the service available.
• Wire liveness, readiness, and startup probes to /livez, /readyz, and /healthz.
• Monitor the health endpoints from your NOC or uptime tooling.

Data protection

• Configure automated backups for both the system and tenant databases and test a restore.
• Back up the JWT and document encryption keys securely; losing the encryption key makes encrypted documents unrecoverable.

Note: Uploads are capped at 50 MB per request by the application. Keep this in mind when sizing reverse-proxy body limits so large but valid uploads are not blocked upstream.

Related

• Setting the JWT signing key for production
• Configuring the document encryption-at-rest key
• Kubernetes deployment overview
• Backing up and restoring your databases