Production cutover checklist

AgentBI on the shared VPS (Traefik HTTPS). Live example: https://agentbi.online.

Prerequisites

1. DNS — A record for AGENTBI_DOMAIN → VPS public IP (see deploy/DNS.md).
2. Secrets on VPS — in /home/smdg/agentbi: bash cp .env.production.example .env # Required: POSTGRES_PASSWORD, REDIS_PASSWORD, SECRET_KEY, ADMIN_PASSWORD # Required: AGENTBI_DOMAIN, CORS_ORIGINS=https://$AGENTBI_DOMAIN # Recommended: ADMIN_API_KEY (platform tenant bootstrap) # SSO (Google): GOOGLE_SSO_ENABLED=true, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET # SSO_PUBLIC_BASE_URL / SSO_FRONTEND_URL = https://$AGENTBI_DOMAIN # Billing: STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, STRIPE_PRICE_PRO, STRIPE_PRICE_BUSINESS # STRIPE_SUCCESS_URL / STRIPE_CANCEL_URL → …/settings.html?billing=success|cancel # Observability: SENTRY_DSN, LOG_JSON=true, JWT_EXPIRE_MINUTES=480 chmod 600 .env
3. Google OAuth — redirect URI: https://$AGENTBI_DOMAIN/api/v1/auth/sso/callback
4. Stripe — webhook: https://$AGENTBI_DOMAIN/api/v1/billing/webhook
   Events: checkout.session.completed, customer.subscription.*

Deploy

1. Fresh DB password — if the Postgres volume used a weak password, ALTER USER or wipe volumes once (data loss).
2. Deploy — push to main (CI → Deploy) or: bash COMPOSE_FILE=docker-compose.prod.yml ./deploy.sh Deploy builds SHA-tagged images, backs up DB before migrate, runs Alembic, writes VERSION.
3. Verify
4. curl -sf https://$AGENTBI_DOMAIN/api/v1/health/ready
5. curl -sf https://$AGENTBI_DOMAIN/api/v1/version → matches deploy SHA
6. Open UI, sign in; /docs must be 404 in production
7. SSO: Google button; map email domains first (Users → Organizations)
8. Cross-tenant ingest isolation (bt_ keys)
9. Settings → Billing / Stripe Checkout + Customer Portal
10. Settings → Domain (optional vanity host — DB only)

Tenant + SSO mapping

Prefer UI: Users → Organizations → SSO email domains (comma-separated, unique across tenants).

bash curl -X POST https://$AGENTBI_DOMAIN/api/v1/tenants \ -H "X-Admin-Key: $ADMIN_API_KEY" \ -H "Content-Type: application/json" \ -d '{"name":"Acme Corp","allowed_email_domains":["acme.com"]}'

SSO @acme.com users auto-provision into that tenant. Unknown domains are rejected. IdP roles are capped at admin (never super_admin).

Ops

1. Backups — cron ./scripts/backup_postgres.sh + pre-migrate dumps from deploy.sh; copy off-host.
2. Docker prune — ./scripts/vps/install_vps_ops.sh (daily safe prune).
3. Swap — sudo /home/smdg/bin/setup-swapfile once (2G, low swappiness).
4. Rotate — change bootstrap admin password in-app.
5. Monitor — Sentry alerts + uptime on /api/v1/health/ready for 48h after cutover.

Rollback

```bash ./scripts/rollback.sh --sha "$(cat VERSION.prev)"

optional: --restore backups/backup_….dump.gz

```

Or redeploy a previous git SHA via Actions (workflow_dispatch / prior commit).