Checklist Before Going Live

Area	Check
Config	all secrets from env vars / secret manager; `ddl-auto=validate`; Flyway migrations run
Security	HTTPS only, CORS limited to the real frontend origin, actuator not public, rate limit on login
Errors	consistent ProblemDetail responses, no stack traces to clients
Database	indexes on search/filter columns, pool sized for instances × pool size, backups tested
Performance	pagination everywhere, caches with TTL, load test passed at 2× expected traffic
Async work	thread pools named and bounded, scheduled jobs locked (ShedLock) across instances
Observability	health probes, Prometheus metrics, dashboards, alerts on errors and latency, logs with request id
Deployment	image tagged with commit SHA, graceful shutdown, rollback tested, CI runs tests on every PR

Example

Teams often script the checklist. This plain-Java checker validates a production config map and prints what to fix:

import java.util.*;
import java.util.function.*;

public class Main {
    record Rule(String description, Predicate<Map<String, String>> ok) {}

    public static void main(String[] args) {
        Map<String, String> prod = new TreeMap<>(Map.of(
            "spring.jpa.hibernate.ddl-auto", "update",
            "spring.jpa.open-in-view", "false",
            "server.shutdown", "graceful",
            "management.endpoints.web.exposure.include", "health,info,prometheus,env",
            "spring.datasource.password", "${DB_PASSWORD}",
            "spring.threads.virtual.enabled", "true"));

        List<Rule> rules = List.of(
            new Rule("ddl-auto must be validate or none", c -> Set.of("validate", "none").contains(c.get("spring.jpa.hibernate.ddl-auto"))),
            new Rule("open-in-view must be false", c -> "false".equals(c.get("spring.jpa.open-in-view"))),
            new Rule("graceful shutdown enabled", c -> "graceful".equals(c.get("server.shutdown"))),
            new Rule("env endpoint must not be exposed", c -> !c.getOrDefault("management.endpoints.web.exposure.include", "").contains("env")),
            new Rule("password comes from the environment", c -> c.getOrDefault("spring.datasource.password", "").startsWith("${")));

        int failed = 0;
        for (Rule r : rules) {
            boolean pass = r.ok().test(prod);
            if (!pass) failed++;
            System.out.println((pass ? "[PASS] " : "[FAIL] ") + r.description());
        }
        System.out.println(failed == 0 ? "Ready to go live" : failed + " issue(s) to fix before go-live");
    }
}

Output

[FAIL] ddl-auto must be validate or none
[PASS] open-in-view must be false
[PASS] graceful shutdown enabled
[FAIL] env endpoint must not be exposed
[PASS] password comes from the environment
2 issue(s) to fix before go-live

Go-Live Checklist

An Automated Pre-Flight Check

Example