Skip to main content

Platform Bootstrap Checklist

Copy this into your incident-tracker on day 1. Tick each box as you complete it.

Prerequisites​

  • Azure subscription assigned + Owner access verified
  • Region chosen (primary + DR)
  • Sizing approved
  • Local tooling installed (node, pnpm, az, psql, gh, docker)
  • DNS provider access for each brand apex you plan to enable (medsuite.com, millinmedical.ai, ...)
  • GitHub Actions admin access
  • PagerDuty / on-call configured
  • Cost alerts ($250/$500/$1000)

Infrastructure​

  • Resource group created
  • Master Postgres flexible server provisioned
  • First tenant DB server provisioned
  • Key Vault provisioned + admin RBAC assigned
  • Service Bus namespace provisioned
  • Storage account with SFTP enabled
  • Static Web Apps provisioned (3× docs + 2× apps)
  • DB firewall rule for bootstrap workstation
  • All credentials stashed in Key Vault

Services​

  • Self-hosted GH Actions runner up in dev VNet
  • Repo Actions variables (AZURE_SUBSCRIPTION_ID, AZURE_TENANT_ID, AZURE_RG_DEV, KEY_VAULT_NAME_DEV) configured
  • Initial deploy workflows run green (deploy-dev-rcm-core, -rcm-app, -edi-gateway, -edi-app, -docs)
  • App Service managed identities granted Key Vault Secrets User
  • Slot swaps complete; /health + /api/health endpoints return 200
  • /metrics endpoints expose Prometheus

Master DB​

  • rcm_master database created
  • All master migrations applied
  • Schemas verified: identity, security, rcm_master, reference
  • Reference data counts non-zero
  • First db_server row inserted

First platform admin​

  • Bootstrap script run (one-time password captured)
  • Admin can log in to the platform console at admin.<env>.medsuiteone.ai
  • TOTP enrolled + recovery codes saved (and/or WebAuthn enrolled)
  • Password changed on first login
  • Audit trail confirmed (BOOTSTRAP_PLATFORM_USER_CREATED, PLATFORM_MFA_ENROLLED, PLATFORM_LOGIN_SUCCESS)
  • Bootstrap firewall rule removed

DNS / TLS​

  • Wildcard or per-tenant strategy decided
  • DNS records created
  • Custom domains bound to SWAs
  • Front Door routes configured
  • All certs valid

Smoke​

  • Health, metrics, sampled-tenants endpoints all clean
  • Platform admin login works
  • /platform/tenants returns []
  • Reference-data endpoints return non-empty
  • Worker heartbeat current
  • EDI gateway reports parsers ready

Sign-off:

NameDate
Bootstrap completed by
Verified by