A Production Checklist for a Small Node.js App
Prepare a Node.js service with validated configuration, safe logging, health checks and graceful shutdown.
Introduction
A Node.js app that works on a laptop is not automatically ready for continuous operation. Production readiness means the service starts predictably, fails clearly, protects trust boundaries and gives operators enough information to understand its health. A checklist creates a repeatable release decision.
How the topic works
Validate required environment variables before accepting traffic. Use structured logs with timestamps, severity and request identifiers while excluding secrets. A health endpoint should show whether the process can serve requests without leaking internal configuration. On termination, stop accepting new traffic, finish bounded in-flight work and close database connections.
Practical workflow
- Pin supported runtime and dependency versions and run automated tests.
- Validate configuration at startup with clear names for missing values.
- Add request validation, centralized errors and security headers.
- Implement structured logs, request IDs and separate liveness and readiness checks.
- Test termination, dependency failure, restart and rollback in a staging environment.
Tools and technologies
- Node.js 20
- A validation library or explicit schema
- Process manager or hosting health checks
Example
If DATABASE_URL is missing, the service exits before opening its port and logs a configuration error without printing credentials. During shutdown it marks readiness false, rejects new work, closes the connection pool and exits after a defined timeout.
Common mistakes
- Starting with undefined configuration
- Logging request bodies that contain sensitive data
- Using a health route that always returns success
Security and best practice
Keep secrets outside source code, patch dependencies, restrict request size, apply rate limits and run the process with only the permissions it needs. Document the supported runtime and rollback version.
Portfolio task
Key takeaways
- Fail fast on invalid configuration.
- Operational signals must answer useful questions.
- Graceful shutdown protects users and data during deployment.