Production deployment and operations planning

Deployment philosophy

Deployment is treated as an engineering control plane decision, not a one-time action. Every environment should be reproducible from declared configuration, protected secrets, migration checks, and explicit runbooks for Okta, SAML, FreeIPA/LDAP, SCIM, and database operations.

Deployment topology

LB/TLS -> Reverse Proxy -> Gunicorn/Flask -> PostgreSQL + Connectors -> Okta / FreeIPA

/health -> /health/db -> /health/ipa -> /health/okta -> /readyz -> metrics

Readiness sequence

1. Validate Python runtime, PostgreSQL connectivity, migrations, service account permissions, SELinux context, and network reachability.
2. Deploy the systemd service, Gunicorn configuration, protected environment file, TLS or reverse proxy path, and Okta/SAML public base URL.
3. Run endpoint smoke checks for SCIM discovery, SAML metadata/login initiation, health, readiness, and database diagnostics.
4. Harden logs, metrics, alerts, and rollback commands before enabling provisioning writes.

Deployment entry points

Launch readiness controls

• Validate host, proxy, service, database, SAML, SCIM, FreeIPA, and Okta checks before enabling write scopes.
• Run scripted smoke checks from one trusted operator identity and one production-like SCIM client profile.
• Confirm backup, migration rollback, token rotation, and service restart runbooks before release-day change windows.