Production Readiness Review

Skill: Production Readiness Review

Use this skill to evaluate whether VoxBento is ready for production deployment. Combines security, deployment, and operational readiness checks.

Security Hardening

• SECRET_KEY ≠ change-me (raises no error but is insecure).
• API_KEY_ENCRYPTION_KEY is set and ≥32 chars (raises RuntimeError if default).
• ADMIN_PASSWORD is set (empty = admin login disabled — decide deliberately).
• DEBUG=false in production settings (portal/config.py debug: bool).
• TLS termination configured (Caddy via Caddyfile or nginx).
• Strict-Transport-Security header set by reverse proxy.
• secure=True on session cookies when served over HTTPS (reverse proxy may handle this via X-Forwarded-Proto).
• JVB_AUTH_PASSWORD and JICOFO_AUTH_PASSWORD changed from changeme.
• Rate limiting on /login and /register (see TD-08 — NOT YET IMPLEMENTED).

Infrastructure

• DATABASE_URL is PostgreSQL (postgresql+asyncpg://...), not SQLite.
• Database is backed up (automated snapshots).
• portal-data volume is NOT used (SQLite), or DB is external PostgreSQL.
• MEDIAMTX_WHIP_BASE is the public HTTPS URL, not localhost.
• DOCKER_HOST_ADDRESS is set to host's public/LAN IP (required for JVB ICE candidates).
• MediaMTX UDP ICE port (8189) is open and reachable from browser clients.
• JVB UDP port (10000) is open for Jitsi media.

Observability

• Portal logs are captured and retained (Docker logging driver or external).
• /healthz endpoint monitored (returns mediamtx_ok: true).
• Alerting on portal restart or MediaMTX unreachability.
• Transcription worker failure logging monitored (portal logs).

Functional Validation

Run the full test suite:

uv sync --python 3.13 --dev
uv run pytest tests/ -v
node --check static/js/interpreter-booth.js
node --check static/js/whep-listener.js
uv run alembic upgrade head

Manual browser check:

1. Admin login + create event + room + booth + invite token.
2. Open invite link → booth page → Jitsi iframe loads → mic test works → go live → WHIP connects.
3. Open listener page → WHEP connects → audio plays.
4. Open second interpreter tab (backup) → coordinator reassigns → first tab becomes backup.
5. Transcription enabled → captions appear on listener page.

Known Production Gaps (from TECHNICAL_DEBT_REPORT.md)

Capacity Planning

For events with >10 simultaneous transcribed booths: increase MAX_TOTAL_WORKERS in worker.py or add a settings override.