Skip to main content

Production Acceptance Criteria

This page is a checklist for installation personnel and the operations team to determine "readiness for production" based on the same set of criteria. Completion of installation does not simply mean the service has started once; it means that restart, backup, health, security, and acceptance evidence have all been recorded.

1. Go / No-Go Criteria​

CategoryGo CriteriaNo-Go
Deployment Modeplantpulse-edge.service manages containersService is not registered
systemdplantpulse-edge.service active + enabledactive but not enabled, or restart loop
Health/api/v1/system/health HTTP 200 + components UPHTTP 503, component DOWN, persistent response delay
Version/api/v1/system/version's image_tag / build_date recordedtag unverified, started with previous image
NetworkWAN, PLC NIC, DNS/NTP, Platform API reachability verifiedPLC network has default route, NTP not synchronized
Security/etc/kopens/credentials.txt root 0600, initial admin password change completedDefault/shared password maintained, no record of credential delivery
Backupbackup.sh 1 success + .sha256 existsBackup not executed, backup exists only on the same disk
Recoverabilitydoctor.sh or acceptance log generatedNo evidence to provide during failure

If any item is No-Go, do not deploy to production and follow the escalation procedure in Installation Troubleshooting or Container Mode Operation.

2. Pre-Installation Approval Items​

Values the operations team must verify before installation:

ItemExample
EDGE_IDEDGE_00303
SITE_IDSITE_00001
Platform host / API keySERVER_HOST, SERVER_API_KEY
PLC NIC / WAN NICNET1_IFACE, NET2_IFACE
static IP / gateway / DNSNET1_IP, NET2_IP, NET2_GATEWAY, NET2_DNS
image tag policylatest or fixed IMAGE_TAG=2026-YYYYMMDD
Initial credential policyrandom generation or specified by operations team
External backup locationNAS / S3 / Operations backup server

Credentials must not be left in chat or email bodies; they must be delivered via a root-only file or an operations secret store.

3. Secret-safe Installation env​

To prevent passwords and API keys from being left in the shell history, use a root-only env file.

sudo -i
umask 077
install -m 600 /dev/null /root/pp-edge-install.env
${EDITOR:-vi} /root/pp-edge-install.env

Example file content:

export EDGE_ID=EDGE_00303
export SITE_ID=SITE_00001
export SERVER_HOST=192.168.0.41
export SERVER_API_KEY='<platform-api-key>'
export NET1_IFACE=enp1s0
export NET1_IP=192.168.100.10/24
export NET2_IFACE=enp2s0
export NET2_IP=192.168.0.10/24
export NET2_GATEWAY=192.168.0.1
export NET2_DNS=192.168.0.1
# export IMAGE_TAG=2026.11-20261103-1006

Execution:

sudo -i
set -a
. /root/pp-edge-install.env
set +a
cd /opt/kopens/install
bash install.sh

Even if the operations team specifies the initial password, include ADMIN_PASS, API_KEY, MQTT_PASS, OPCUA_PASS, and CERT_PASS in the same file and maintain chmod 600. Use only CERT_PASS for the official cert password key.

4. Acceptance Evidence Collection​

After installation, save the evidence files (excluding secret values) using the following command.

sudo -i
OUT=/root/pp-edge-acceptance-$(date +%Y%m%d-%H%M%S).txt
{
  echo "# PlantPulse Edge acceptance"
  date -Is
  echo
  echo "## host"
  hostnamectl
  uname -a
  timedatectl
  echo
  echo "## service"
  systemctl is-enabled plantpulse-edge.service || true
  systemctl is-active plantpulse-edge.service || true
  systemctl status plantpulse-edge.service --no-pager | sed -n '1,40p'
  echo
  echo "## version"
  curl -ks https://127.0.0.1/api/v1/system/version | python3 -m json.tool
  echo
  echo "## health"
  curl -ks https://127.0.0.1/api/v1/system/health | python3 -m json.tool
  echo
  echo "## ports"
  ss -lntp | grep -E ':(80|443|1883|1884|6379|9042|1880|12000|12443)([[:space:]]|$)' || true
  echo
  echo "## storage"
  df -h /opt /data1 2>/dev/null || df -h
  echo
  echo "## docker"
  docker ps --filter name=plantpulse-edge --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}'
} > "$OUT"
chmod 600 "$OUT"
sha256sum "$OUT" > "$OUT.sha256"
echo "$OUT"

Items to be delivered to the operations team during acceptance:

  • Acceptance text file path and sha256
  • /data1/pp-backups/pe-backup-*.tar.zst and .sha256
  • /tmp/pe-doctor-*.tar.zst and .sha256 (in case of problems)
  • Gateway IP, EDGE_ID, SITE_ID, image tag, installation date/time
  • Confirmation of credential delivery (actual passwords follow separate security procedures)

5. Restart Verification​

Before production deployment, verify automatic recovery after a service restart at least once.

sudo systemctl restart plantpulse-edge.service
sleep 30
sudo bash /opt/kopens/install/bin/health.sh
curl -ks https://127.0.0.1/api/v1/system/health | python3 -m json.tool

For sites where PLC connections are already registered, verify the collection status and the last value update after the restart.

6. Backup and Recovery Preparation​

sudo bash /opt/kopens/install/bin/backup.sh
ls -lh /data1/pp-backups/
sha256sum /data1/pp-backups/pe-backup-*.tar.zst | tail -1

Copy the first backup to an external NAS, S3, or operations backup server. Backups existing only on the same disk are insufficient for disaster recovery.

7. Lock-down After Operations Acceptance​

  • Verify that /etc/kopens/credentials.txt permission is 0600 root
  • Complete initial admin password change
  • Decide on /root/pp-edge-install.env retention policy: delete from box after transferring to operations secret store or maintain root 0600
  • Allow only ports requiring WAN exposure in the firewall
  • Register operations team contact information and escalation paths
  • Schedule the next inspection date and backup verification date