Deployment checklist · Sharkhex Classifieds

Before opening an install to the public:

Server

☐ APP_ENV=prod, APP_DEBUG=0, a long random APP_SECRET.
☐ HTTPS works on the domain and http:// redirects to it.
☐ The worker runs and restarts on its own (Docker restart: unless-stopped or Supervisor).
☐ GET /api/v1/health answers 200, and an uptime monitor checks it.
☐ Database backups run every night (bin/backup-db from cron, or the host's own) and one restore has been tried.
☐ /build/* and /uploads/* are cached for a year and responses are compressed.
☐ SENTRY_DSN set, or another way to see errors.

☐ MAILER_DSN set and SEND_EMAIL=1.
☐ The sender address in Settings, Platform is allowed by the provider, with SPF and DKIM records on the domain.
☐ A test: register an account and receive the confirmation email.

☐ Name, logo, favicon, share image, colours, home texts.
☐ Public URL is the real address (emails and the sitemap use it).
☐ Legal name, address, registration number and tax ID; terms and privacy pages reviewed.
☐ Support email and social links.

☐ Category tree with images, attributes per category, free-listing limits where wanted.
☐ Locations imported for the country.
☐ Report reasons and banned words.

☐ Storage on S3 with a CDN address, if not using the server's disk.
☐ SMS provider for phone verification.
☐ Facebook app (with https://your-domain/login/check-facebook as a valid redirect address) for "Continue with Facebook".
☐ EXPO_DSN for the mobile app's push notifications.
☐ Analytics, Pixel and AdSense ids.

☐ Search indexing on (Settings, Platform), https://your-domain/robots.txt and /sitemap.xml answer.
☐ Post a listing, search for it, message the seller from another account, report it, moderate it in the admin.