> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/pocketbase/pocketbase/llms.txt
> Use this file to discover all available pages before exploring further.

# Going to production

> Production deployment checklist and best practices for PocketBase

Before deploying PocketBase to production, you need to configure several settings and follow best practices to ensure security, reliability, and performance.

## Pre-deployment checklist

<Steps>
  <Step title="Enable encryption">
    Set an encryption key to protect sensitive settings like SMTP passwords and S3 secrets.

    ```bash theme={null}
    export PB_ENCRYPTION_KEY="your-random-32-character-key"
    ```

    Generate a secure key:

    ```bash theme={null}
    openssl rand -hex 16
    ```

    <Warning>
      Store this encryption key securely. If you lose it, you won't be able to decrypt your settings.
    </Warning>
  </Step>

  <Step title="Configure HTTPS">
    Never run PocketBase in production without HTTPS. Use a reverse proxy like nginx or Caddy to handle SSL/TLS termination.

    PocketBase also has built-in autocert support:

    ```bash theme={null}
    ./pocketbase serve --https="example.com:443"
    ```

    This automatically obtains and renews Let's Encrypt certificates.
  </Step>

  <Step title="Set up automated backups">
    Configure automatic backups using the cron expression in your settings:

    ```json theme={null}
    {
      "backups": {
        "cron": "0 2 * * *",
        "cronMaxKeep": 7
      }
    }
    ```

    This runs backups daily at 2 AM and keeps the last 7 backups.

    See the [backups documentation](/deployment/backups) for more details.
  </Step>

  <Step title="Configure trusted proxy">
    If running behind a reverse proxy, configure the trusted proxy settings to correctly identify client IPs:

    ```json theme={null}
    {
      "trustedProxy": {
        "headers": ["X-Forwarded-For", "X-Real-IP"],
        "ips": ["127.0.0.1", "192.168.1.0/24"]
      }
    }
    ```
  </Step>

  <Step title="Enable rate limiting">
    Configure rate limits to protect against abuse:

    ```json theme={null}
    {
      "rateLimits": {
        "enabled": true,
        "rules": [
          {
            "label": "auth:signin",
            "maxRequests": 10,
            "duration": 60
          }
        ]
      }
    }
    ```
  </Step>

  <Step title="Set up monitoring">
    Enable request logging to monitor your application:

    ```json theme={null}
    {
      "logs": {
        "maxDays": 7,
        "minLevel": "info"
      }
    }
    ```

    Logs are stored in `pb_data/logs.db`.
  </Step>
</Steps>

## Security considerations

### Change default admin credentials

After first deployment, immediately:

1. Log in to the admin UI at `/_/`
2. Create a new superuser account
3. Delete or disable the default account

### Restrict API access

Use collection rules to control data access:

```javascript theme={null}
// List rule - only authenticated users
@request.auth.id != ""

// View rule - owner only
@request.auth.id = id

// Create rule - authenticated users with email verification
@request.auth.id != "" && @request.auth.verified = true
```

### Secure file uploads

Configure file upload restrictions:

```json theme={null}
{
  "maxSize": 5242880,
  "mimeTypes": ["image/jpeg", "image/png", "image/gif"],
  "thumbs": ["100x100"]
}
```

### Environment-specific settings

Never commit sensitive values to version control. Use environment variables:

```bash theme={null}
# .env file (add to .gitignore)
export PB_ENCRYPTION_KEY="..."
export SMTP_PASSWORD="..."
export S3_SECRET="..."
```

## Performance optimization

### Database optimization

PocketBase uses SQLite with WAL (Write-Ahead Logging) mode enabled by default for better concurrency.

For high-traffic applications:

1. **Ensure adequate disk I/O**: Use SSDs for better performance
2. **Monitor database size**: Large databases (>100GB) may benefit from external storage solutions
3. **Use indexes**: Add indexes to frequently queried fields

### File storage

For production applications with many file uploads, consider using S3-compatible storage:

```json theme={null}
{
  "s3": {
    "enabled": true,
    "bucket": "my-app-files",
    "region": "us-east-1",
    "endpoint": "s3.amazonaws.com",
    "accessKey": "...",
    "secret": "...",
    "forcePathStyle": false
  }
}
```

<Note>
  When using S3 for collection files, backups don't include S3 files. You must back up S3 separately using your cloud provider's backup tools.
</Note>

### Connection limits

PocketBase handles concurrent connections efficiently. For very high traffic:

1. Use a reverse proxy with connection pooling
2. Deploy multiple PocketBase instances behind a load balancer (read-only replicas)
3. Use CDN for static assets

## Scaling strategies

### Vertical scaling

PocketBase scales well vertically:

* **Small apps**: 1 CPU, 512MB RAM
* **Medium apps**: 2 CPUs, 2GB RAM
* **Large apps**: 4+ CPUs, 4GB+ RAM

### Horizontal scaling

For read-heavy workloads, you can set up read replicas:

1. Run a primary PocketBase instance for writes
2. Replicate the database to read-only instances
3. Route read traffic to replicas

<Warning>
  PocketBase doesn't have built-in cluster support. Horizontal scaling requires custom replication setup.
</Warning>

## Monitoring and maintenance

### Health checks

Implement health check endpoints:

```bash theme={null}
curl -f http://localhost:8090/api/health || exit 1
```

### Log monitoring

Query logs programmatically:

```javascript theme={null}
const logs = await pb.logs.getList(1, 50, {
  filter: 'level >= 400',
  sort: '-created'
});
```

### Backup verification

Regularly test backup restoration:

1. Download a recent backup
2. Restore to a test environment
3. Verify data integrity
4. Test critical functionality

### Update strategy

<Steps>
  <Step title="Review changelog">
    Check the PocketBase release notes for breaking changes.
  </Step>

  <Step title="Test in staging">
    Deploy the new version to a staging environment first.
  </Step>

  <Step title="Create backup">
    Always create a backup before updating.

    ```bash theme={null}
    ./pocketbase backup
    ```
  </Step>

  <Step title="Update binary">
    Replace the PocketBase executable with the new version.

    ```bash theme={null}
    wget https://github.com/pocketbase/pocketbase/releases/download/v0.x.x/pocketbase_0.x.x_linux_amd64.zip
    unzip pocketbase_0.x.x_linux_amd64.zip
    chmod +x pocketbase
    ```
  </Step>

  <Step title="Run migrations">
    PocketBase automatically runs migrations on startup.

    ```bash theme={null}
    ./pocketbase serve
    ```
  </Step>

  <Step title="Verify deployment">
    Test critical functionality after the update.
  </Step>
</Steps>

## Disaster recovery

### Backup strategy

Implement a 3-2-1 backup strategy:

* **3** copies of your data
* **2** different storage media
* **1** off-site backup

Example:

1. Live data in `pb_data`
2. Local backups in `pb_data/backups`
3. Remote backups in S3

### Recovery procedures

Document and test your recovery procedures:

```bash theme={null}
# 1. Stop PocketBase
sudo systemctl stop pocketbase

# 2. Backup current state (if corrupted)
mv pb_data pb_data.corrupted

# 3. Restore from backup
./pocketbase backup restore backup_name.zip

# 4. Restart PocketBase
sudo systemctl start pocketbase
```

<Warning>
  The restore operation requires a Unix-based system (Linux or macOS). It's not supported on Windows.
</Warning>

## Next steps

<CardGroup cols={2}>
  <Card title="Backups" icon="database" href="/deployment/backups">
    Learn how to configure and manage backups
  </Card>

  <Card title="Migrations" icon="code" href="/deployment/migrations">
    Understand the migration system for schema changes
  </Card>
</CardGroup>