Production readiness checklist
Review the minimum security, recovery and access setup before relying on a Control server.
Before moving an important workload to Control, check the following.
Management access
- The Control management hostname uses a trusted HTTPS certificate.
- Administrator accounts use strong unique passwords and MFA.
- Unneeded sessions and API tokens have been removed.
- A separate SSH path to the server has been tested.
Security
- UFW policy is understood before it is enabled.
- A second SSH connection succeeds after firewall activation.
- Fail2ban is running if you intend to use it.
- ModSecurity policy is enabled per Site only after testing in Detect only when appropriate.
Recovery
- At least one backup destination is configured, preferably with an off-server copy for important data.
- Important Sites or databases have schedules and useful retention.
- A recovery point can be created successfully.
- A Control recovery bundle has been exported, verified and stored separately if this server is important.
Workloads
- DNS points where expected.
- HTTPS is valid.
- Health is green.
- SFTP or deployment access works.
- Runtime environment values have been entered.
- Application-specific backup/restore behaviour has been tested where required.