US Pre-Launch Deployment Checklist Results

Issue: BUY-3090
Date: 2026-04-18 (Updated: 2026-04-20 18:30 UTC)
T-3 to Launch: April 23, 2026
Status: IN PROGRESS — SSL cert P0 blocked on DNS credentials, BUY-2057 backup blocked on Bolt
Heartbeat 2026-04-20 18:30: Attempted certbot --nginx (blocked: no root), certbot DNS-01 (blocked: no DNS API creds), installed acme.sh (also needs DNS API creds). DNS-01 challenge token generated and posted in issue comments. nginx vhost and ssl_renewal.sh correctly configured. BUY-2057 backup verification still needs Bolt action.

---

Checklist Results

---

Critical Findings

1. Database Backups — BUY-2057 (CRITICAL)

Status: BLOCKED — assigned to Bolt
Risk: After BUY-2006 WAL corruption incident (2.35M products lost), launching without verified backups is unacceptable.

Current state:

• Backup infrastructure IS configured in docker-compose.prod.yml:
  • backup-cron service: runs /app/scripts/backup.sh backup hourly every 1 hour
  • backup-verify-cron service: runs /app/scripts/verify_backup.sh verify all every 1 week
  • Volume: backup_data:/var/backups/buywhere
• backup.sh script exists at scripts/backup.sh with pg_dump and retention policies
• verify_backup.sh script exists at scripts/verify_backup.sh with integrity checks
• BUY-2057 (end-to-end restore testing) is BLOCKED and assigned to Bolt

2. us.buywhere.com Nginx Vhost — Configured, SSL Pending

Status: Vhost configured, SSL cert missing
Action: Run certbot --nginx -d us.buywhere.com on production server.

nginx.conf has:

• HTTP server for us.buywhere.com (redirects to HTTPS)
• HTTPS server on port 443 with SSL cert paths configured
• Proxy to buywhere_api upstream

3. No SSL Certificate for us.buywhere.com

Status: Missing — attempted but blocked by privilege constraints
Attempts made:

1. certbot --nginx -d us.buywhere.com — fails: container cannot reload nginx (needs root privileges)
2. certbot certonly --manual --preferred-challenges=dns — generates DNS-01 challenge token but cannot deploy TXT record without DNS provider API credentials

Required to resolve:

• DNS provider API credentials (Cloudflare, Route53, etc.) to set TXT record for _acme-challenge.us.buywhere.com
• OR root/sudo access to run certbot with nginx plugin

# Challenge value (already generated):
# _acme-challenge.us.buywhere.com TXT: Unyb9yiuA13-Va2w_b7tLaoday9ntLS422s0kK1spls

4. Env Vars Now Configured for US Region ✅

Status: Resolved
Action: Added to docker-compose.prod.yml api service:

• USD_DEFAULT: ${USD_DEFAULT:-true}
• US_REGION: ${US_REGION:-us}
• AFFILIATE_TAG: ${AFFILIATE_TAG:-buywhere-20}

5. /api/health Endpoint — Resolved ✅

Status: Resolved
Action: Added /api/health location block to nginx.conf for both api.buywhere.ai and us.buywhere.com vhosts.

{"status":"ok","ts":"2026-04-18T09:46:58.126Z","catalog":{"total_products":1341362}}

---

Passed Checks

DB Migrations — PASS

alembic_version: 036_add_bulk_ingestion_jobs

No pending migrations.

Failover via Docker Restart Policy — PASS

All services in docker-compose.prod.yml have restart: unless-stopped policy.

Catalog Health

API catalog contains 1,341,362 products from 64 sources.

---

Action Items (Blocking Launch)

---

References

• BUY-2057 — Set up pg_dump backup cron for catalog DB
• BUY-3082 — Build affiliate click tracking for US retailers (in-progress)
• BUY-2061 — Fix API Redis cache connection (degraded)
• Tech Readiness Memo — Full CTO assessment T-5
• US Launch Runbook

---

Document generated by Ops agent on 2026-04-18