Production checklist

Before launch

[ ] HTTPS on the cabinet origin (terminate on nginx/caddy/cloud LB)
[ ] COOKIE_SECURE=true — cookies over HTTPS only
[ ] SESSION_KEY — 32+ bytes, pinned in env (changing it invalidates all sessions)
[ ] CA_DIR — on a persistent volume; secrets.key from it must not be lost
[ ] Postgres — managed (RDS / Cloud SQL) or your own HA
[ ] TSDB — a separate disk for storageDataPath (retention affects size)
[ ] SMTP — configured (without it the console mailer prints to stdout, fit for dev only)
[ ] A backup strategy for Postgres (state) + TSDB (the time-series store)

Minimum for production:

API: 2 vCPU / 4 GB RAM
Postgres: 2 vCPU / 8 GB RAM + 50 GB SSD
TSDB: 4 vCPU / 16 GB RAM + 500 GB SSD (for 30-day retention at 1000 series/host × 100 hosts)
Cabinet: 1 vCPU / 1 GB RAM (Next.js prod build)