Docs
Hardening checklist
Per-flag guarantees when shipping apps/api in production. Each row links
to the smoke-proof and a safe rollback path.
Required (0 / unset in production)
| Flag | Default | Smoke proof | Rollback |
|---|---|---|---|
ALLOW_DEV_SEED |
0 |
make smoke-prod (M20) fails if =1 |
unset env var; restart API |
LOCAL_OPS |
0 |
make smoke-prod (M20) fails if =1 |
unset env var; restart API |
POSTMTA_HOSTED_DNS_VERIFY_STUB |
unset | assertProductionProfile() throws if =1 and NODE_ENV=production; smoke-prod verifies .env.production.example has no =1 |
unset env var; restart API |
MIB_DNS_VERIFY_STUB |
unset | same | unset env var; restart API |
SMTP_ALLOW_INSECURE |
unset | assertProductionProfile() rejects when combined with NODE_ENV=production |
unset env var; restart SMTP |
BOOTSTRAP_CREDITS |
0 |
smoke-prod grants are admin-only; on-disk wallet starts at 0 | revert by setting =0 in .env |
Production-required (must be on)
| Flag | Recommended | Purpose | Rollback |
|---|---|---|---|
NODE_ENV |
production |
activates all assertProductionProfile() checks |
this is a build gate, not runtime; rollback = deploy with NODE_ENV=development and accept lab flag re-enables |
REQUIRE_VERIFIED_DOMAIN |
unset (= on) | refuses unverified From in runSend; matrix M27/M28 |
emergency opt-out: REQUIRE_VERIFIED_DOMAIN=0 for one-off lab ops; do not leave unset in .env.production.example |
MIB_WEB_SSR |
1 |
Astro SSR for /app; needed by middleware.ts (M27 redirect to /login) |
=0 disables /app SSR — keep at 1 |
SMTP_TLS_CERT / SMTP_TLS_KEY |
real PEM paths | STARTTLS row of docs/security-architecture.md | path round-trip: re-issue from your ACME / CA |
Optional
| Flag | When | Note |
|---|---|---|
REQUIRE_AAL2 |
if SSO/MFA rolled out (Release C) | current default is 0; M-AAL2 not yet shipped |
STRIPE_* |
air-gap = off; commercial = on | M12 honest SKIP without secrets |
MIB_INSTALL_SYSTEMD=1 |
on-site appliance | installs the four-pack service units |
INCUS_LIVE_PROBE=1 |
on-site with Incus socket | M10b green; SKIP otherwise |
Pre-release smoke proof
env -u ALLOW_DEV_SEED -u LOCAL_OPS make smoke-prod
make qa-matrixBoth must exit 0 the same day per the release checklist.
Related
- PRODUCTION.md — fresh-host runbook.
- docs/security-architecture.md
- docs/compliance-posture.md
Last verified: Sat Jul 11 2026 17:00:00 GMT-0700 (Pacific Daylight Time). Cross-link maintained byscripts/check-docs-drift.sh (M54).