Production hardening

TLS, secrets, backups, and the few things compose does not do for you.

Secrets

Rotate V5_ADMIN_PASSWORD and V5_JWT_SECRET before the first public packet.
Do not commit .env.
API keys are shown once — treat them like passwords.

TLS and URLs

Terminate TLS in Caddy / nginx / your PaaS. Set V5_PUBLIC_URL and NEXT_PUBLIC_SITE_URL to the public https origins. Forward X-Forwarded-For so geo and the visitor hash see the client, not the proxy.

Backups

Postgres is the only datastore. Snapshot the volume or pg_dump. Rollups can be rebuilt from events if you still have the partitions.

Upgrading

terminal

git pull
docker compose up --build

Read the changelog before you pull. Migrations live with the API.