Service Provisioning Checlist

Purpose

This checklist is to ensure that all aspects of a new service are provisioned properly, completely, and in the correct order to prevent potential failures elsewhere in the system.

Steps

• Determine any potential impact to any other services; see things to look out for below
  • Is this service going to be running on app-01 or a different host?
  • Is it going to utilize SSO auth?
  • Is it going to need a database? Service files folder in /mnt/data/services on app-01?
  • Is it going to need any other secrets?
  • Does this service need to be monitored?
  • Exposed to the public internet?
  • Utilizing a mailserver or ntfy to send notifications?
• Determine the most feasible deployment method
  • Docker container
  • nixOS module (preferred for reproducibility and programmatic configuration)

Check on repology.org to verify if the nixOS module is up to date with upstream

• If this service has a MariaDB, PostgreSQL or otherwise database, remove its entry from the nixOS borgmatic config to prevent backup failure
• If this service is running in a Docker container, tear down its compose project. Otherwise stop the service and disable/remove its nixOS config. Push configuration change to staging branch

Do not push this change to main until testing that the configuration builds successfully

If this service isuses a docker-compose project, move its folder to ~/Containers/.retired-services

database

• IfCreate thisand servicestore isdatabase publiclysecrets exposedunder withBitwarden aSecrets TLSManager, cert, remove its entry from traefik's acme.json file to prevent unwanted cert renewals
• If remaining data is unwanted, clear all relevant files fromusing the filesystemfollowing i.e.naming convention: /srv/webservices.<servicenameservice name>.db_pass and any relevant databases and secrets
• Push

changes fromstaging to main 

If any related monitoring systems were temporarily put into maintenance mode, re-enable them in Uptime Kuma and Healthchecks

Vikunja Copy-Paste Version

• Shutdown/disable needed monitoring services
• Remove/disable borgmatic database backup entry from nixOS to prevent borgmatic failure
• Teardown compose project/remove nixOS service config, push change to staging
  • If docker-compose project, move to ~/Containers/.retired-services
• Remove service's entry from traefik's acme.json file to prevent unwanted cert renewals
• If unneeded, clear all remaining files from the filesystem i.e. /srv/<servicename> and any relevant databases and secrets
• Push changes fromstaging to main 
• Re-enable monitoring systems as needed