Production checklist
The shipped layouts are already hardened; this page lists what they do for you and what is left to decide before users arrive. ./liberty doctor (or liberty-ops doctor) checks most of it — run it last.
Already done by the Docker layouts
| Protection | Detail |
|---|---|
| The server does not run as root | The container fixes the ownership of its volumes, then runs as liberty (uid 1000). LIBERTY_RUN_AS_ROOT=1 turns this off. |
| PostgreSQL is not on the network | Published on 127.0.0.1 only. POSTGRES_BIND=0.0.0.0 in .env opens it — then protect it with a firewall. |
| Random secrets per install | Master key, JWT secret, PostgreSQL, pgAdmin and Traefik dashboard passwords are generated by the installation. |
| HTTPS done properly | With ./liberty ssl …, HTTP is redirected to HTTPS and security headers are sent. |
| Health that means something | The healthcheck asks the database (/ready), not just the process. |
| Sign-in throttle | After 10 failed sign-ins for a user within 5 minutes (50 from one address), sign-in answers 429 for a while. See Sign-in. |
| No SQL in error messages | Regular users get the database error line and an error id; the statement itself goes to the log only when the pool's debug_sql is on. |
| Known images | Every image is pinned to a version, and each release is scanned for known vulnerabilities before publication. |
Before going live
- Pin the release:
./liberty upgrade --tag <version>— neverlatestin production. See Upgrade and rollback. - HTTPS on:
./liberty ssl letsencrypt …orprovided …, or your own proxy in front. See HTTPS and Traefik. - Passwords changed and stored: the
adminpassword (liberty-admin set-password admin), the pgAdmin and Traefik dashboard passwords printed by the installation. - Secrets kept off the server: a copy of
release/.env(orsecrets.env) in your vault. Without the master key, a restored configuration cannot decrypt its passwords. For Docker or Kubernetes secrets, giveLIBERTY_MASTER_KEY_FILE=/run/secrets/…instead of the value. - Licence pasted in Liberty Next → Administer → App → License, and its expiry date noted.
- Sign-in: OpenID Connect set up if the company has an identity provider (Sign-in); a second superuser so that one lost password does not lock the install.
- Roles reviewed: who sees which menus, and which rows (Roles and permissions).
- Backups scheduled and copied off the server (Operations), and one restore tested.
- Tools: Portainer and pgAdmin are reachable on the same address as the application. Remove them from the stack, or restrict them in Traefik, if nobody needs them.
- Notifications: the SMTP account in Liberty Next → Administer → App → Notifications (email) and a rule for failed jobs (Notifications).
- Monitoring: an external probe on
/ready(Health endpoints). -
./liberty doctoranswers no problems found.
Logs
- Every response carries an
X-Request-IDheader, and every log line written for that request carries the same id: give it when reporting a problem. - The container log is rotated by Docker for PostgreSQL (3 × 100 MB). For the other containers, set a rotation in the Docker daemon (
/etc/docker/daemon.json).
Install it as an app
Over HTTPS, users can install Liberty Next as an application on their computer: Install in Chrome or Edge, Add to Dock in Safari. It then opens in its own window, with its own icon, under the name given in the theme — and under the sub-path when the install has one. Nothing is kept on the device: each opening loads the running version.
Keep one replica
Live updates (the notification bell, record locks, the assistant's answers) are held in the server process, and the sign-in throttle counts per process. Run one liberty-next instance: several replicas would show users different states.