production-readiness-review

name	production-readiness-review
description	Use this skill to evaluate whether VoxBento is ready for production deployment. Combines security, deployment, and operational readiness checks.

Skill: Production Readiness Review

Use this skill to evaluate whether VoxBento is ready for production deployment. Combines security, deployment, and operational readiness checks.

---

Security Hardening

• SECRET_KEY ≠ change-me (raises no error but is insecure).
• API_KEY_ENCRYPTION_KEY is set and ≥32 chars (raises RuntimeError if default).
• ADMIN_PASSWORD is set (empty = admin login disabled — decide deliberately).
• DEBUG=false in production settings (portal/config.py debug: bool).
• TLS termination configured (Caddy via Caddyfile or nginx).
• Strict-Transport-Security header set by reverse proxy.
• secure=True on session cookies when served over HTTPS (reverse proxy may handle this via X-Forwarded-Proto).
• JVB_AUTH_PASSWORD and JICOFO_AUTH_PASSWORD changed from changeme.
• Rate limiting on /login and /register (see TD-08 — NOT YET IMPLEMENTED).

---

Infrastructure

• DATABASE_URL is PostgreSQL (postgresql+asyncpg://...), not SQLite.
• Database is backed up (automated snapshots).
• portal-data volume is NOT used (SQLite), or DB is external PostgreSQL.
• MEDIAMTX_WHIP_BASE is the public HTTPS URL, not localhost.
• DOCKER_HOST_ADDRESS is set to host's public/LAN IP (required for JVB ICE candidates).
• MediaMTX UDP ICE port (8189) is open and reachable from browser clients.
• JVB UDP port (10000) is open for Jitsi media.

---

Observability

• Portal logs are captured and retained (Docker logging driver or external).
• /healthz endpoint monitored (returns mediamtx_ok: true).
• Alerting on portal restart or MediaMTX unreachability.
• Transcription worker failure logging monitored (portal logs).

---

Functional Validation

Run the full test suite:

uv sync --python 3.13 --dev
uv run pytest tests/ -v
node --check static/js/interpreter-booth.js
node --check static/js/whep-listener.js
uv run alembic upgrade head

Manual browser check:

1. Admin login + create event + room + booth + invite token.
2. Open invite link → booth page → Jitsi iframe loads → mic test works → go live → WHIP connects.
3. Open listener page → WHEP connects → audio plays.
4. Open second interpreter tab (backup) → coordinator reassigns → first tab becomes backup.
5. Transcription enabled → captions appear on listener page.

---

Known Production Gaps (from TECHNICAL_DEBT_REPORT.md)

Item	Impact	Status
In-memory booth state lost on restart	Active sessions dropped on deploy	Not fixed — deploy in low-traffic window
No rate limiting on /login	Brute-force risk	Not fixed
No CSRF on admin forms	Low risk with lax cookies	Not fixed
Single shared ADMIN_PASSWORD	Weaker than per-user admin	Partially mitigated by is_admin user flag
_created_paths cache not invalidated on MTX restart	WHIP may fail	Mitigated by PATCH fallback

---

Capacity Planning

Component	Limitation
Transcription workers	MAX_TOTAL_WORKERS = 10 — hard limit
Booth state	Single-process; no horizontal scaling
MediaMTX streams	One per language channel; limited by server resources
Jitsi participants	Limited by JVB server capacity
DB connections	SQLAlchemy async pool (default settings)

For events with >10 simultaneous transcribed booths: increase MAX_TOTAL_WORKERS in worker.py or add a settings override.