flyio-prod-checklistGate a Fly.io production release across ownership, configuration, identity, health, capacity, data, observability, cost, and rollback. Use when reviewing a first launch or material change. Trigger with: "review Fly production readiness", "approve Fly launch", "run Fly go-live checklist".
Independent GitHub snapshot · Automated classification · Original documentation governs
name: flyio-prod-checklist description: >- Gate a Fly.io production release across ownership, configuration, identity, health, capacity, data, observability, cost, and rollback. Use when reviewing a first launch or material change. Trigger with: "review Fly production readiness", "approve Fly launch", "run Fly go-live checklist". allowed-tools: Read, Grep, Write, Edit version: 2.0.0 argument-hint: '[app-environment-and-release]' model: inherit effort: high license: MIT author: Jeremy Longshore jeremy@intentsolutions.io tags:
Make go-live a signed evidence boundary. The gate must cover the actual workload: stateless Machines, region-bound volumes, Managed Postgres, release commands, health semantics, autostart, networking, observability, billing, and tested rollback.
Record app, organization, environment, domains, regions, process groups, data stores, objectives, on-call route, and accepted risks.
Use scoped expiring tokens, protect production environments, inspect secret names and digests without values, and prove rotation and revocation.
Validate image, architecture, ports, processes, signals, release command, health checks, strategy, unavailable capacity, and volume compatibility.
Confirm Machine redundancy where required, regional placement, dependency failure behavior, Managed Postgres or volume backup boundaries, restore tests, and reconciliation.
Prove logs, metrics, health, alerts, provider-status escalation, resource inventory, cost owner, and cleanup of obsolete billable resources.
Run the approved release path, observe acceptance gates, restore the prior image or config in a drill, and close only after actual fleet reconciliation.
Production deploy uses the narrowest app or organization token in a protected environment. Read-only monitoring should not share deploy authority. Remember that anyone with deploy access can deploy code that reads runtime App secrets.
Use Read and Grep to inspect application configuration, deployment evidence, provider documentation, fixtures, logs, schemas, and existing tests before proposing a change. Use Write or Edit only for an approved plan, configuration, implementation, test, or redacted receipt. Do not create, deploy, scale, restart, stop, suspend, destroy, rotate, revoke, expose, or migrate live Fly.io resources without explicit operator approval.
Return the target organization, app, environment, region set, Machine or database identifiers, source-contract fingerprint, evidence, unresolved risks, rollback state, and final decision without exposing tokens, secrets, connection strings, or customer data.
A web app with Managed Postgres passes only after the team proves two healthy Machines, scoped deploy and read-only tokens, a rolling deploy, database restore and reconnect, region-aware alerts, current cost ownership, and rollback to the previous image.
| Failure | Response |
|---|---|
| Required evidence is missing | Keep the gate open and assign the exact proof, owner, and deadline. |
| Exception has no expiry | Reject it or add a compensating control, approver, review date, and rollback trigger. |
| Rollback drill fails | Do not approve go-live until image, config, secret, and data recovery paths are corrected. |