Launch checklist

Tick in order. Each item names the file or screen where it happens.

Before the domain moves

• Commit the code. Backend, frontend, worker, infra and docs in one repository. Nothing below is safe while the only copy is a laptop.
• Rotate the tokens pasted into chat on 2026-09-09: Hangar, Neon, Cloudflare. Create replacements in each dashboard, put them in a password manager, delete the old ones.
• Decide the search box’s RAM. 3.7 GB serves a 25 GB index with ~1.5 s semantic queries. 8 GB makes them sub-second. Hetzner resize, five minutes of downtime.
• Restore test. Pull yesterday’s dump from the Hangar box and restore it into a scratch database once. A backup nobody has restored is a hope.

Domains and edge

• Real hostnames. In Cloudflare add A records for the site and API pointing at the Hangar box, then attach them in Hangar: POST /api/v1/domains {"domain": "...", "site": "kalelm"} and the same for kalelm-api. Certificates issue on first request.
• Search box hostnames. search., embed., db. on your domain, pointing at 49.12.78.95, with Cloudflare proxy off (grey cloud). Update infra/search-vps/Caddyfile and the Hangar env values MEILI_HOST, OLLAMA_URL, DATABASE_URL.
• Move the Cloudflare rules to the new host. The cache rule and the rate limit rule match http.host eq "kalelm.mohanad.xyz"; edit the expression in Rules → Cache Rules and Security → WAF → Rate limiting.
• Bot Fight Mode on, Security → Bots. The API could not set it.
• Traffic anomaly notification on, Notifications → Add. Free.
• Rebuild both apps with the new URLs. NEXT_PUBLIC_SERVER_URL and PUBLIC_API_URL are baked at build time; edit them at the top of scripts/deploy-hangar.sh and run it for backend and frontend.

Content and crawling

• Robots. Replace the disallow-all block in frontend/public/robots.txt with the LAUNCH block already in the file: allow pages, disallow /search and any URL with a query string, point at the sitemap.
• Sitemap URL. frontend/src/pages/sitemap.xml.ts uses SITE; confirm it renders the production domain.
• Old WordPress URLs. The redirects from oldSlugs are in the gate’s routes section; run pnpm verify routes against production once.

Pipeline

• Where workers run. For the 19,000-hour backlog, a rented GPU for about a week (see Transcription pipeline); afterwards the Mac or a Mac mini from the panel.
• Post-edit on or off for the backlog, in the panel. Off is three times the throughput; on adds ta-marbuta and punctuation fixes.
• CRON_SECRET in every worker’s environment matches Hangar’s.

After launch

• Watch Cloudflare analytics and top-queries.sql for the first week.
• Delete the Neon project.
• Delete the alsirat/laqta test sites on Hangar if they were only experiments (they are not Kalelm’s; check first).