Production Readiness

The Staff Panel includes a Launch Readiness tab that reports which systems are configured and which remain pending.

Domain and Cloudflare

• projectxora.com must resolve through Railway with valid HTTPS.
• Add www.projectxora.com separately if desired.
• Set PUBLIC_URL and DOMAIN to https://projectxora.com.
• After Cloudflare proxy/WAF is active, set CLOUDFLARE_ENABLED=true.

PostgreSQL backups

Enable daily and weekly backups in Railway's Postgres Backups tab. Perform at least one restore drill. Only after verifying recovery should BACKUPS_CONFIRMED=true be set.

Model storage

Paid archives must use private R2/S3 storage. Configure all S3_* variables and never place a paid archive under public/.

Stripe

Before enabling a product:

• create its Stripe Product and Price;
• add the Price ID to config/products.js through a Railway variable;
• configure STRIPE_SECRET_KEY and STRIPE_WEBHOOK_SECRET;
• subscribe the webhook to checkout, refund, and dispute events;
• complete a test purchase and verify the order ledger, entitlement, certificate, email, library, and re-download.

Email

Configure SMTP and send test receipts before accepting payment.

Discord

Confirm command visibility, owner/moderator role IDs, join roles, blacklist roles, moderator audit channels, robot-search channels, and Server Members Intent. Verify the bot has Kick Members below its role so it can enforce the Storefront prerequisite for XORA's Lab. Test role additions and removals while the account page is open, and confirm the website privilege badge updates without a manual role switch.

Static release 2026-08-15-static-v5-workshops-creations-security refreshes the bot's own managed messages once, including the Blender, Builds, UI, and Visual Effects workshop channels. It does not delete unrelated member messages.