Deployment Checklist

Follow the list below as you deploy the software, to ensure it’s configured and monitored properly.

Disaster Recovery

When setting up a service that uses a Database Encryption Key (Email Key Manager) or a Master Key (Google Workspace Key Manager), you must ensure a safe backup of this key, otherwise, you’ll face a complete data loss of your encrypted content.
When setting up a service that requires a database to run Email Key Manager or FlowCrypt External Service, you must ensure proper regular backups and recovery testing of the database, otherwise, you’ll face a complete data loss of your encrypted emails.
In addition to the points mentioned above, it’s important to have regular backup mechanisms in place, such as a regular full-disk backup that allows for the service to be spun up again in a disaster scenario. Without such a comprehensive backup mechanism, it’s recommended to at least back up the entire properties file of each service that is set up, with clear steps taken to install and deploy the original service to make bringing up a replacement service easier.

Monitor node health

There are two endpoints for health checks, where you can issue an HTTP GET request:

The https://<service>/ request returns a code 200 status if the node is running, regardless if it can access the data store. This doesn’t apply to EAP, use /health when configuring the EAP.
The https://<service>/health request returns a code 200 status if the node is running and it can access the data store. If the node is functional but can’t access the store, it will return code 503 instead. If the service doesn’t support an external database, this will behave the same as the https://<service>/ request.

If a node consistently returns a code 200 on a / path but a code 503 on a /health path, it may indicate that the store properties are misconfigured or that the store isn’t reachable.

Monitor error logs

After you set up the logging, make sure to configure your existing logging infrastructure to alert you of errors.

Networking

See the Requirements: Networking guide.

OpenJDK JVM options tuning

The Enterprise Server services are written in Kotlin which runs on the JVM platform. You may apply any standard JVM arguments, such as:

A proxy for outbound HTTP traffic. This will proxy all outgoing HTTP requests. It shouldn’t affect backend connections over KMIP or PKCS#11 because they don’t use the HTTP protocol. Here is a sample command:

  java -jar flowcrypt-<service>.jar \
      -Dhttps.proxyHost=your-proxy-host \
      -Dhttps.proxyPort=443 \
      -Dhttps.proxyUser=your-user \ 
      -Dhttps.proxyPassword=your-password \
      -Dhttp.nonProxyHosts="localhost|127.0.0.1|[::1]|someotherhost.dontproxyme.com"

Alternatively, you can use http.proxyHost and http.proxyPort flags if your proxy doesn’t use SSL.

The JVM heap size. Setting the minimum and maximum heap size using the -Xms and -Xmx flags allows you to optimize the resources allocated to the JVM:
```
  java -jar flowcrypt-<service>.jar -Xms16G -Xmx16G 
```