Skip to main content

Monitoring, Logging, Backup, and Security Prerequisites

These are the minimum technical standards for production-bound systems.

Required Technical Standards​

Health​

  • A working /health endpoint must exist.
  • The health endpoint should verify the dependencies required for meaningful service health.
  • Authentication or network constraints for health checks must be documented.

Metrics​

  • A /metrics endpoint should exist when metrics are appropriate for the system.
  • If a metrics endpoint is not appropriate, the alternative telemetry method must be documented.

Logging​

  • Logs must be structured.
  • Logs must contain enough context to diagnose production failures.
  • Production log location and retention expectations must be documented.

Backups​

  • Stateful systems must have a backup requirement.
  • Backup frequency, retention, and restore responsibility must be documented.
  • Restore validation expectations must be defined.

Security Visibility​

  • Production security visibility and escalation path must be documented.
  • Secrets handling and admin placement must be documented.
  • Domain, DNS, and Cloudflare ownership or delegated admin model must be documented.

Ownership and Escalation​

  • Primary owner must be documented.
  • Anchor operational owner must be documented.
  • Escalation path must be documented.
  • Runbook link must be documented.

Capability Over Tooling​

These prerequisites describe required capabilities, not required vendors. Anchor currently fulfills these capabilities with tools such as Grafana, Prometheus, Loki, Alertmanager, Uptime Kuma, Wazuh, CrowdSec, Restic, Vault, Slack, Twilio, and PostHog, but the SOP requirement is the capability itself.