Production Deployment

​

Overview

​

Production Environment Variables

​

conformly-core (Backend)

​

conformly-frontend (Platform App)

​

conformly-web (Marketing Site)

​

Security

​

Secrets Management

• Never commit .env files to version control
• Use secrets management services (AWS Secrets Manager, HashiCorp Vault, or Vercel encrypted env vars)
• Rotate API keys (Stripe, Supabase, Google, OpenAI) regularly
• Use separate credentials for development, staging, and production

​

Authentication

• All API traffic over HTTPS/TLS
• CORS restricted to production domains only (no localhost)
• Rate limiting enabled (RATE_LIMIT_PER_MINUTE, RATE_LIMIT_BURST)
• JWT token expiration tuned for security (ACCESS_TOKEN_EXPIRE_MINUTES=30)
• Supabase Row-Level Security (RLS) enforced on all tables

​

Stripe Webhooks

• Verify the Stripe-Signature header using STRIPE_WEBHOOK_SECRET
• Use a dedicated webhook endpoint (POST /api/v1/payments/webhook)
• Handle checkout.session.completed and customer.subscription.deleted events

​

Database

• Supabase manages connection pooling and SSL
• RLS policies enforce workspace-level tenant isolation
• The profiles table uses a CHECK constraint on role (admin, engineer, manager, viewer)
• The handle_new_user() trigger automatically creates profiles on signup

​

Backend Infrastructure (EC2)

# Pull latest changes
git pull origin main

# Rebuild and restart
docker compose -f docker-compose.prod.yml up -d --build

# Verify
docker compose -f docker-compose.prod.yml ps
docker compose -f docker-compose.prod.yml logs -f backend

backend:
  command: ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000",
            "--proxy-headers", "--forwarded-allow-ips", "*"]

​

Reverse Proxy (Nginx)

server {
    listen 443 ssl;
    server_name beta-api.conformly.ai;

    ssl_certificate /etc/letsencrypt/live/beta-api.conformly.ai/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/beta-api.conformly.ai/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
    }
}

​

Performance

​

Scaling

• Backend: Horizontal scaling behind ALB or nginx; each instance runs the full Docker stack
• Celery Workers: Scale independently — docker compose up -d --scale celery-worker=5
• Redis: Use managed Redis (ElastiCache) for high availability
• Database: Supabase manages read replicas and connection pooling

​

Caching

• Redis caches frequently accessed data and session state
• Analysis results are persisted to Supabase tables — no re-computation on page refresh
• Frontend uses TanStack Query with stale-while-revalidate caching

​

Monitoring

• Celery Flower: Task monitoring dashboard (docker compose --profile monitoring up -d)
• Container logs: docker compose logs -f backend celery-worker
• APM: Integrate Datadog, New Relic, or Sentry for error tracking
• Metrics: Prometheus + Grafana for system-level monitoring
• Health checks: GET /health endpoint for load balancer probes

​

Reliability

​

High Availability

• Deploy across availability zones
• Use managed Supabase (automatic failover)
• Redis persistence enabled for job state recovery
• Health checks and auto-restart via Docker restart: unless-stopped

​

Backup

• Supabase manages automated database backups
• Application logs shipped to centralized storage
• Document recovery procedures and test them regularly

​

Deployment Checklist

• All environment variables set with production values
• ALLOWED_ORIGINS restricted to production domains
• Stripe keys switched from sk_test_ to sk_live_
• STRIPE_SUCCESS_URL and STRIPE_CANCEL_URL point to production URLs
• HTTPS/TLS enabled with valid certificates
• Nginx reverse proxy configured with forwarded headers
• --reload flag removed from production compose
• Rate limiting enabled
• Monitoring and alerting configured
• Supabase email templates configured (confirmation, password reset)
• Database handle_new_user() trigger verified