Operations
GA readiness
Groundwork before calling Externa GA (post-beta): security walkthrough, light performance smoke, and support/upgrade expectations.
Related
Security checklist (staging pass)
Walk Security checklist and Threat model against a staging deploy before GA:
| Area | Expectation |
|---|---|
APP_DEBUG | false in production |
APP_KEY | Unique; never shared across envs |
| Headers / HTTPS | Prefer TLS; TRUSTED_PROXIES when behind a proxy |
| File downloads | AuthZ on private disks; denylist for dangerous uploads |
| Public CMS API | Keys + origin allowlist; no unintended public role grants |
| GraphQL | Depth / complexity limits as documented |
| AI tools | Permission gates (ChecksAiPermissions) on mutating tools |
Record findings in the milestone issue or fix before GA cut. Host reporting: repo SECURITY.md.
Performance smoke
Not a full load test. On a reference box (Compose prod or comparable VPS):
- Login
- List collections; open one item
- Public CMS API list + show (Bruno or curl)
- Optional GraphQL introspection / one query
Note rough p95 latency for those paths. Flag obvious N+1 or filter costs (especially MySQL vs Postgres) if seen. Optional helper: scripts/perf-smoke.sh in externa-core when present.
Support window (beta → GA)
| Topic | Expectation |
|---|---|
| Upgrade path | Follow Upgrade; backup first (Backup) |
| Install | Prefer Packagist create-project once published; Docker / Herd remain supported |
| Databases | Supported databases — Postgres recommended |
| Issues | GitHub Issues |
| Pre-1.0 | Breaking changes may still appear in beta notes; after 1.0.0, Public API follows API 1.x compatibility |
Evidence for this milestone
Beta.3 ships the Packagist/docs/upgrade/backup/security-CI groundwork. GA cut (1.0.0) still requires a fresh staging checklist pass with dated notes on the GA issue.