Production checklist
Network and security
Section titled “Network and security”- Terminate TLS and expose signaling only through
wss://. - Configure TURN and test from mobile and restrictive enterprise networks.
- Keep API keys in a secret manager and rotate them periodically.
- Restrict access to the Docker socket, worker network and capture devices.
- Run application input agents with minimum privileges.
Capacity
Section titled “Capacity”- Set CPU, memory and concurrent-session limits.
- Measure session startup p50/p95 rather than publishing assumed numbers.
- Stop empty sessions after a defined idle period.
- Track TURN bandwidth and cost separately from direct peer connections.
Observability
Section titled “Observability”- Monitor container exits and restart causes.
- Record session status transitions and startup latency.
- Alert on worker saturation and repeated signaling failures.
- Never log API keys, host tokens or player access tokens.
Scaling boundary
Section titled “Scaling boundary”The developer-preview control plane stores leases in memory. Before running multiple replicas, add a shared lease store and worker scheduler while preserving the existing HTTP, SDK and WebRTC contracts.
Launch readiness
Section titled “Launch readiness”For a public cloud preview, define hard free-session limits, abuse controls, quota visibility and a support path before opening capacity broadly.