Production

Stop, build, start meant a 30–60 second 502 window. Two slots removed it.

The first release process stopped the app, rebuilt it and started it again. Anyone visiting during the build received a 502.

Two slots, one switch

  • Build into the idle slot’s own directory — the live build is never touched
  • Start the candidate on the idle loopback port
  • Health-check it directly: key routes, sitemap, social image, a static asset
  • Switch the reverse proxy with a validated, graceful reload
  • Verify the public domain, then retire the old slot

Any failure before the switch leaves production untouched; a failed public check switches back automatically. During validation, 3,865 continuous public requests returned zero failures.

Start a project