Incident resolution #

Documentation does not load #

Markdown uses fetch. Serve file: python3 -m http.server 8000.

Understanding site error pages #

Code	Meaning	First check
400	incorrect query	URL, parameters and request size
401	authentication required	session, token expiration and MFA
403	access denied	server role, tenant and rule
404	resource not found	URL, published route and internal link
429	request limit reached	timing, automation and source address
500	internal error	logs, correlation and dependencies
503	service unavailable	health, maintenance, base, cache and workers

Static files at the root provide a secure message without displaying technical trace. Apache must preserve the original HTTP code via ErrorDocument; a browser that displays the 404 page with a status 200 produces a “soft 404” unfavorable for diagnosis and referencing.

curl -I https://riskpilot.site/route-inexistante
curl -I https://riskpilot.site/503.html

The first command should return 404. The second only allows to inspect static page headers and does not simulate a real outage 503.

A container is unhealthy #

docker compose ps
docker compose logs --tail=200 backend worker scheduler nginx
curl http://localhost:8080/api/health

Check PostgreSQL and Redis before backend, then backend before Nginx.

Migration, emails or data #

Check .env, then make migrate. For emails, check the provider, test send, worker and Mailpit locally. Back up database, Redis, documents and JWT keys together. Never use make reset to troubleshoot production: this target deletes volumes.

Structured diagnosis #

Start with docker compose ps, then /api/health. Identify the layer: browser/Nginx, frontend, backend, PostgreSQL, Redis, worker or external provider. Note time, user, tenant, and correlation before changing the state.

Check account activity, locking, TOTP device time and sessions. After resetting, reconnect all devices. Do not disable controls globally to resolve a single account.

Documents #

A refused download can come from the tenant, the ACL, the status or an expired share. A rejected upload may exceed 10 MB, have inconsistent MIME, or fail antivirus. Control volume space.

Performance #

Examine slow queries, PostgreSQL saturation, PHP memory, Redis file and export size. Correct the cause before arbitrarily increasing the limits.

Climbing #

Preserve logs and backups, describe reproduction and impact, then attach versions and commands executed without secrecy. After resolution, document cause and prevention.

Rapid production diagnosis #

If the application responds but email or notifications remain queued, inspect the worker healthcheck and Messenger queue depth, not Redis alone. If deployment fails, rerun environment checks, migrations and /api/health before changing data. If a PDF lacks detail, correct source registers and generate a new snapshot; never edit an immutable annual snapshot.