Best practices

Delivery

• Use meaningful application names and version tags.
• Tag important builds (e.g. --tag "v2.1-release") for easier rollback identification.
• Review rollback --list before restoring a build.
• Keep the proxy running for zero-downtime deployment and rollback.
• Check status <app> for version history before deciding to roll back.
• Use matrix dry runs before large multi-platform builds.

Observability

• Provide a real readiness endpoint for Tier 1 checks.
• Set a --mode that matches your app — http for servers, tcp-only for bare ports, none for daemons.
• Watch application logs and status during deployments.
• Monitor RAM and CPU across every registered server.
• Review rollback audit logs after recovery events.

Security

• Use encrypted environment variables for every credential.
• Never commit master keys, session files, or encrypted env artifacts.
• Rotate API keys and registry credentials regularly.
• Restrict permissions on the Phelix state directory.
• Registry credentials for dockerize --push are stored encrypted; if not logged in, Phelix tells you to run docker login.