Skip to content
MantisDocs

Production Checklist

Production Checklist

Section titled “Production Checklist”

Use this checklist to verify your Mantis deployment is ready for production.

Security

Section titled “Security”

Authentication

Section titled “Authentication”
  • Changed default admin password
  • JWT secret is cryptographically random (32+ characters)
  • JWT private key is secured (file permissions 400)
  • Session tokens have appropriate expiry

TLS/mTLS

Section titled “TLS/mTLS”
  • Valid TLS certificates installed (not self-signed)
  • mTLS enabled for client authentication
  • Registration tokens created with auto_approve disabled (new clients reviewed before approval)
  • Certificate expiration monitoring configured
  • CA private key stored securely (HSM or secrets manager)

Encryption

Section titled “Encryption”
  • MANTIS_ENCRYPTION_KEY is a secure 32-byte base64 value
  • Encryption key stored in secrets manager (not in .env)
  • Key rotation procedure documented

Access Control

Section titled “Access Control”
  • RBAC roles configured appropriately
  • Principle of least privilege applied
  • Admin accounts limited and audited
  • SSO/OIDC configured (if applicable)

Configuration

Section titled “Configuration”

Environment

Section titled “Environment”
  • Log level set to info for all services (not debug/trace): RUST_LOG=info for Mandible, MANTIS_LOG_LEVEL=info for Thorax, TARSUS__LOG_LEVEL=info for Tarsus
  • Lens production build served (no dev server, source maps disabled)
  • CORS origins restricted to actual domains
  • All default passwords changed

Database

Section titled “Database”
  • External/managed PostgreSQL (not containerized)
  • Connection pooling configured appropriately
  • SSL/TLS enabled for database connections
  • Database credentials in secrets manager

Message Queue

Section titled “Message Queue”
  • External/managed RabbitMQ (not containerized)
  • TLS enabled for all connections
  • Queue credentials secured

Cache

Section titled “Cache”
  • External/managed Redis (not containerized)
  • AUTH password configured
  • TLS enabled (if supported)

Infrastructure

Section titled “Infrastructure”

Network

Section titled “Network”
  • Only Lens, Mandible, and Thorax exposed externally
  • Database/RabbitMQ/Redis on internal network only
  • Firewall rules configured
  • Rate limiting enabled

Reverse Proxy

Section titled “Reverse Proxy”
  • TLS termination configured
  • X-Forwarded headers passed correctly
  • DDoS protection enabled
  • Request size limits configured

Scaling

Section titled “Scaling”
  • Multiple Thorax instances for HA (if needed)
  • Load balancer configured
  • Health checks configured

Operations

Section titled “Operations”

Monitoring

Section titled “Monitoring”
  • Health endpoints monitored
  • Prometheus metrics collected
  • Alerting configured for critical issues
  • Certificate expiration alerts

Logging

Section titled “Logging”
  • Centralized logging configured
  • Log retention policy defined
  • Audit logs enabled and monitored
  • No sensitive data in logs

Backup

Section titled “Backup”
  • Database backup schedule configured
  • Backup restoration tested
  • CA certificate/key backed up securely
  • Disaster recovery plan documented

Compliance

Section titled “Compliance”

Audit

Section titled “Audit”
  • Audit logging enabled
  • Audit log retention policy defined
  • Audit log integrity verification enabled

Documentation

Section titled “Documentation”
  • Runbooks for common operations
  • Incident response procedures
  • Contact information documented

Final Verification

Section titled “Final Verification”
Terminal window
# Verify all services are healthy
./docker.sh health


# Check for security misconfigurations
# (Review the output carefully)
curl -s https://your-domain/api/v1/health | jq
Section titled “Related Documentation”