Deployment Checklist

#Before you touch production

• Target host and environment confirmed (no staging/prod mix-ups)
• Deploy path exclusive to this app
• Branch and commit SHA intended for release
• Required secrets available (not guessed)
• Backward-compatible migrations planned if schema changes
• Rollback owner and plan named

#Host preflight

• Disk headroom for images/logs (df -h)
• Memory headroom for build + runtime (free -h)
• Docker available or PM2/runtime path explicit
• Outbound network for registry/Git
• Time sync sane (date -u)

#Source & build

• Clone or pull succeeded with auth
• Lockfiles respected (npm ci, not ad-hoc installs without reason)
• Build artifacts present
• Image tags immutable (prefer SHA tags)

#Runtime & config

• .env or secret injection complete
• Ports not conflicting (ss -lntp)
• Health endpoint defined
• Restart policy set

#Verification (non-negotiable)

• Process/container healthy
• Local HTTP health check passes
• Public/route check passes if customer-facing
• Logs free of boot-loop errors for N minutes
• Deploy recorded with commit + operator context

#Aftercare

• Auto-deploy profile updated only if paths/commands changed intentionally
• Monitoring quiet for new error classes
• Document partial failures honestly for the next engineer

#One-page command capture

df -h && free -h
docker version || pm2 -v
git -C "$APP_DIR" rev-parse --short HEAD
curl -fsS "http://127.0.0.1:$PORT/health"

#Closing

Checklists are how reliable teams scale process without scaling chaos.