28
CodeDev system / System reference
CodeDev deployment and operations
Render/Docker production configuration, PostgreSQL, Cloudinary, Redis/Valkey, migrations, uptime monitoring, health checks, recovery, and deployment verification.
01Production dependencies
| Component | Role |
|---|---|
| Render web service | Runs Gunicorn/Flask |
| PostgreSQL | Durable application data |
| Cloudinary | Durable project/media images |
| Redis/Valkey | Shared rate limits for multi-worker production |
| GitHub Actions | Static/runtime/dependency/migration checks |
| UptimeRobot/external monitor | Independent /healthz availability checks |
| /healthz | Readiness/health verification |
02Critical environment categories
dotenvProduction configuration shape
APP_ENV=production
REQUIRE_POSTGRES=1
COOKIE_SECURE=1
TRUST_PROXY=1
DATABASE_URL=<managed PostgreSQL URL>
MEDIA_STORAGE=cloudinary
CLOUDINARY_URL=<secret>
RATELIMIT_STORAGE_URI=<Redis/Valkey URL>
SECRET_KEY=<strong persistent secret>
MFA_ENCRYPTION_KEY=<persistent Fernet key>
ADMIN_PATH_SEED=<persistent random seed>03Deployment sequence
- Build/install pinned dependencies.
- Validate the final environment with scripts/validate_production_env.py before startup.
- Run bootstrap/migrations before accepting traffic.
- Start optional one-per-container uptime helper when enabled.
- Start Gunicorn with the configured concurrency.
- Verify the exact deployed commit and /healthz.
- Run scripts/live_verify.py from outside the deployed host.
- Perform authenticated critical-flow smoke tests: admin login/MFA, a safe CMS read/write, real media delivery, and Resend/Gmail when enabled.
bashDeployment verification helpers
python scripts/validate_production_env.py --env-file /path/to/production.env
python scripts/live_verify.py https://YOUR_DOMAIN --expect-indexing04External uptime monitoring
- Configure UptimeRobot or another independent HTTP monitor against the public /healthz endpoint.
- Use a 5-minute interval and enable the desired alert contact.
- No monitoring-provider key is required by CodeDev, and monitoring cannot block migrations, security checks, or Gunicorn startup.
- Keep /healthz as the authoritative readiness target rather than checking only the home page.
05Operational rules
- Preserve SECRET_KEY, MFA_ENCRYPTION_KEY, and ADMIN_PATH_SEED across normal redeploys.
- Never paste real secrets into tickets/chat/logs.
- Use UptimeRobot or another external uptime monitor against /healthz; an in-process helper cannot detect or wake a fully stopped container.
- Back up durable data and test restore procedures.
- Treat failed CI/migrations/health checks as release blockers until understood.