Production checklist

Run through this before pointing real users - or the public internet - at Eddytor.

Secrets & credentials

• Rotate any default credentials. The installer generates random POSTGRES_PASSWORD and Garage keys into .env; if your .env predates that or was hand-written, rotate any eddytor/eddytor-secret defaults.
• Back up EDDYTOR_ENCRYPTION_KEY - losing it makes every stored secret unrecoverable, and a wrong key fails server boot with secret decrypt failed. Back up .env (Compose) or the eddytor-secrets Secret (Kubernetes). See Backups & key rotation.

Datastores

• External, backed-up Postgres - not the bundled eval instance. See Bundled vs external.
• A real object store (managed S3 / GCS / Azure Blob), not bundled Garage. See Connect storage.
• Snapshot Postgres before upgrades - migrations are forward-only. See Upgrades.

Networking & TLS

• Front Eddytor with a TLS-terminating load balancer / ingress - the binaries speak plaintext; encrypt at the edge. See TLS.
• Set server.public_url to your HTTPS hostname (it drives cookies, OAuth, and JWKS - it must match the address users hit).
• Set server.cookie_domain to the apex (e.g. .eddytor.example.com) for cross-subdomain SSO.
• Lock server.cors.allowed_origins to your real SPA host(s); drop the localhost wildcard. See CORS.
• Running the Web UI? Set EDDYTOR_UI_ORIGIN + EDDYTOR_UI_API_BASE_URL to the public HTTPS origins and point EDDYTOR__SERVER__WEB_REDIRECT_URIS at ${EDDYTOR_UI_ORIGIN}/auth/callback. See Web UI.

Auth & delivery

• Wire real SMTP - without it, magic-link sign-in only logs links to stdout, so teammates can't sign in. See SMTP.

Next

• Configure · Authentication & Access Control.