Production Acceptance Criteria

This page is a checklist that lets installers and the operations team judge "ready for production" against the same standard. Installation being complete does not mean the service came up once — it means restart/backup/health/security/acceptance evidence have all been recorded.

1. Go / No-Go Criteria

Category	Go criteria	No-Go
Deployment mode	New installs use `container_mode=true`	`plantpulse.service` native operation on a new box
systemd	`plantpulse-edge.service` active + enabled	active but not enabled, or restart loop
Health	`/api/v1/system/health` HTTP 200 + components `UP`	HTTP 503, component `DOWN`, sustained response latency
Version	`image_tag` / `build_date` of `/api/v1/system/version` recorded	tag unverified, started from a previous image
Network	WAN, PLC NIC, DNS/NTP, and platform API reachability verified	PLC network holds the default route, NTP not synchronized
Security	`/etc/kopens/credentials.txt` root 0600, initial admin password change completed	Default/shared passwords retained, no record of credential handover
Backup	`backup.sh` succeeded once + `.sha256` present	Backup not run, backup exists only on the same disk
Recoverability	`doctor.sh` or acceptance log generated	No evidence to hand over in case of failure

If any item is No-Go, do not put the system into production; follow the escalation procedure in Installation Troubleshooting or the Container Mode Operations Guide.

2. Pre-Installation Approval Items

Values the operations team must confirm before installation:

Item	Example
`EDGE_ID`	`EDGE_00303`
`SITE_ID`	`SITE_00001`
Platform host / API key	`SERVER_HOST`, `SERVER_API_KEY`
PLC NIC / WAN NIC	`LAN1_IFACE`, `LAN2_IFACE`
static IP / gateway / DNS	`LAN1_IP`, `LAN2_IP`, `LAN2_GATEWAY`, `LAN2_DNS`
Image tag policy	latest or pinned `IMAGE_TAG=2026-YYYYMMDD`
Initial credential policy	Randomly generated or specified by the operations team
External backup location	NAS / S3 / operations backup server

Do not leave credentials in chat messages or email bodies; deliver them through a root-only file or the operations secret store.

3. Secret-Safe Installation env

To keep passwords and API keys out of shell history, use a root-only env file.

sudo -i
umask 077
install -m 600 /dev/null /root/pp-edge-install.env
${EDITOR:-vi} /root/pp-edge-install.env

Example file contents:

export EDGE_ID=EDGE_00303
export SITE_ID=SITE_00001
export SERVER_HOST=192.168.0.41
export SERVER_API_KEY='<platform-api-key>'
export LAN1_IFACE=enp1s0
export LAN1_IP=192.168.100.10/24
export LAN2_IFACE=enp2s0
export LAN2_IP=192.168.0.10/24
export LAN2_GATEWAY=192.168.0.1
export LAN2_DNS=192.168.0.1
# export IMAGE_TAG=2026-20260524

Run:

sudo -i
set -a
. /root/pp-edge-install.env
set +a
cd /opt/kopens/install
bash install.sh

Even when the operations team specifies the initial passwords directly, put ADMIN_PASS, API_KEY, MQTT_PASS, OPCUA_PASS, and CERT_PASS in the same file and keep chmod 600. The official cert password key is CERT_PASS only.

4. Collecting Acceptance Evidence

Once installation is complete, use the command below to produce an evidence file that excludes secret values.

sudo -i
OUT=/root/pp-edge-acceptance-$(date +%Y%m%d-%H%M%S).txt
{
  echo "# PlantPulse Edge acceptance"
  date -Is
  echo
  echo "## host"
  hostnamectl
  uname -a
  timedatectl
  echo
  echo "## service"
  systemctl is-enabled plantpulse-edge.service || true
  systemctl is-active plantpulse-edge.service || true
  systemctl status plantpulse-edge.service --no-pager | sed -n '1,40p'
  echo
  echo "## version"
  curl -ks https://127.0.0.1/api/v1/system/version | python3 -m json.tool
  echo
  echo "## health"
  curl -ks https://127.0.0.1/api/v1/system/health | python3 -m json.tool
  echo
  echo "## ports"
  ss -lntp | grep -E ':(80|443|1883|1884|6379|7799|9042|1880|12000|12443)([[:space:]]|$)' || true
  echo
  echo "## storage"
  df -h /opt /data1 2>/dev/null || df -h
  echo
  echo "## docker"
  docker ps --filter name=plantpulse-edge --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}'
} > "$OUT"
chmod 600 "$OUT"
sha256sum "$OUT" > "$OUT.sha256"
echo "$OUT"

Items to hand over to the operations team at acceptance:

Acceptance text file path and sha256
/data1/pp-backups/pe-backup-*.tar.zst and .sha256
/tmp/pe-doctor-*.tar.zst and .sha256 (if problems occur)
Gateway IP, EDGE_ID, SITE_ID, image tag, installation date and time
Whether credential handover is complete (plaintext passwords follow a separate security procedure)

5. Restart Verification

Before production use, restart the service once and confirm automatic recovery.

sudo systemctl restart plantpulse-edge.service
sleep 30
sudo bash /opt/kopens/install/bin/health.sh
curl -ks https://127.0.0.1/api/v1/system/health | python3 -m json.tool

At sites where PLC connections are already registered, also verify collection status and last-value updates after the restart.

6. Backup and Recovery Readiness

sudo bash /opt/kopens/install/bin/backup.sh
ls -lh /data1/pp-backups/
sha256sum /data1/pp-backups/pe-backup-*.tar.zst | tail -1

Copy the first backup to an external NAS/S3/operations backup server. A backup on the same disk alone will not restore service after a failure.

7. Lockdown After Handover to Operations

Verify that /etc/kopens/credentials.txt permissions are 0600 root
Initial admin password change completed
Decide the /root/pp-edge-install.env retention policy: migrate to the operations secret store and delete from the box, or keep it root 0600
Allow only the ports that must be exposed to the WAN in the firewall
Register operations team contacts and the escalation path
Schedule the next inspection date and backup verification date

1. Go / No-Go Criteria​

2. Pre-Installation Approval Items​

3. Secret-Safe Installation env​

4. Collecting Acceptance Evidence​

5. Restart Verification​

6. Backup and Recovery Readiness​

7. Lockdown After Handover to Operations​