feat: add production environment preflight

2026-09-10 02:30:45 -04:00
parent ea6a839b69
commit 96d3bf831e
4 changed files with 88 additions and 0 deletions
@@ -0,0 +1,54 @@
+#!/bin/sh
+set -eu
+
+require_value() {
+  variable_name=$1
+  eval "variable_value=\${$variable_name:-}"
+  if [ -z "$variable_value" ]; then
+    printf '%s\n' "${variable_name} is required for production deployment." >&2
+    exit 1
+  fi
+}
+
+for variable_name in \
+  POSTGRES_DB \
+  POSTGRES_USER \
+  POSTGRES_PASSWORD \
+  DATABASE_URL \
+  REDIS_URL \
+  SMTP_URL \
+  SMTP_FROM \
+  MFA_ENCRYPTION_KEY \
+  PRICING_HTTP_PROVIDER_ENDPOINT
+ do
+  require_value "$variable_name"
+done
+
+case "$DATABASE_URL" in
+  postgresql://*) ;;
+  *) printf '%s\n' 'DATABASE_URL must use the postgresql:// scheme.' >&2; exit 1 ;;
+esac
+
+case "$REDIS_URL" in
+  redis://*|rediss://*) ;;
+  *) printf '%s\n' 'REDIS_URL must use the redis:// or rediss:// scheme.' >&2; exit 1 ;;
+esac
+
+case "$PRICING_HTTP_PROVIDER_ENDPOINT" in
+  https://*) ;;
+  *) printf '%s\n' 'PRICING_HTTP_PROVIDER_ENDPOINT must use HTTPS.' >&2; exit 1 ;;
+esac
+
+if [ "${PRICING_FIXTURE_PROVIDER_ENABLED:-false}" = 'true' ]; then
+  printf '%s\n' 'PRICING_FIXTURE_PROVIDER_ENABLED must be false in production.' >&2
+  exit 1
+fi
+
+case "$POSTGRES_PASSWORD" in
+  change-me|password|secret|example*)
+    printf '%s\n' 'POSTGRES_PASSWORD must not use a development placeholder.' >&2
+    exit 1
+    ;;
+esac
+
+printf '%s\n' 'production environment validation passed'