Skip to content

Technical Prerequisites

Applies to: All subscriptions

Purpose

List every technical condition that must hold before installation starts, so the installation itself is uneventful. Each row is a thing that has caused a delay in a real project.

Audience

Infrastructure engineers, database administrators, network engineers, and the customer's ERP technical lead.

Prerequisites

Steps

1. Infrastructure

# Requirement Owner Verified by
T1 Hosts provisioned per the chosen topology Infrastructure Hosts reachable, named, and in the correct network segment
T2 Compute and memory meet the sizing tier Infrastructure Compare against Sizing and Capacity
T3 Storage allocated with headroom for growth Infrastructure Free space is a stated multiple of first-year projected growth, not a fixed figure
T4 Operating system patched and supported Infrastructure Patch level recorded
T5 Time synchronisation configured Infrastructure Clock drift under one second. Token validation and statutory windows both depend on correct time
T6 A process supervisor is available Infrastructure Restart on crash, start on boot, and log retention all demonstrated

2. Database

# Requirement Owner Verified by
T7 SQL Server instance available DBA Reachable from the application host on the database port
T8 Edition supports Row-Level Security DBA Confirmed against the edition's feature list. This is not optional — tenant isolation depends on it
T9 An empty database created for Complifly DBA Exists, with collation and recovery model agreed
T10 A dedicated least-privilege login created DBA Application connects with it; it is not an administrative account
T11 Encrypted connections configured DBA Connection succeeds with encryption on, and the certificate trust decision is deliberate
T12 Backup configured and a restore tested DBA A restore has actually been performed. An untested backup is not a backup

Verify: The minimum supported SQL Server version and edition are not stated in this portal. Confirm with Complifly before procuring a licence — the answer has a direct cost consequence. Recorded as assumption B2 in the Assumptions Register.

3. Runtime and dependencies

# Requirement Owner Verified by
T13 Node.js installed at the supported version Infrastructure Version recorded and matched against Complifly's tested matrix
T14 Redis available, if queue-backed jobs are used Infrastructure Reachable and authenticated. Its absence is a silent failure — jobs simply never run
T15 Dependencies installable Infrastructure Package installation completes on the host, including from behind any proxy
T16 Headless-browser rendering dependencies present Infrastructure A test PDF renders. On minimal server images this needs libraries that are not installed by default

Verify: The supported Node.js major version range is not stated here. Installing an unsupported runtime produces subtle failures under load rather than a clear refusal. Recorded as assumption B1.

4. Network

# Requirement Owner Verified by
T17 Outbound HTTPS to the GSP endpoints Network A test call from the application host succeeds
T18 Outbound HTTPS to Microsoft identity endpoints, if machine OAuth is used Network Token acquisition succeeds
T19 Outbound mail path — SMTP or vendor HTTPS API Network A test message is delivered
T20 Inbound HTTPS from the ERP to the API, if the ERP pushes Network ERP host reaches the ingest endpoint
T21 Application host reaches the database port Network Connection succeeds from the application host, not only from a workstation
T22 Any egress proxy configured for the application Network Outbound calls succeed through the proxy, with its certificate trusted
T23 Source-IP allow-listing satisfied where the GSP requires it Network and customer The egress address is fixed and registered with the provider

Item T23 is a frequent late failure. If the GSP restricts by source address, a change of egress address — a new NAT gateway, a failover path — silently breaks every government call.

5. TLS and certificates

# Requirement Owner Verified by
T24 Certificates issued for every published hostname Infrastructure Valid, trusted, not near expiry
T25 TLS version and cipher policy agreed Security Meets the customer's standard
T26 Certificate renewal is owned and automated Infrastructure A named owner and a renewal mechanism, not a calendar reminder

6. ERP readiness

# Requirement Owner Verified by
T27 The ERP can emit documents outbound ERP team A sample payload produced in the ERP's own format
T28 The ERP can consume compliance outcomes, if write-back is in scope ERP team An endpoint or polling job identified with a named developer
T29 ERP-side effort is allocated Customer Named developer, allocated days
T30 Document numbering is unique per GSTIN per financial year ERP team The numbering scheme is documented and shown not to restart
T31 A non-production ERP environment exists for testing ERP team Available, and connected to the Complifly sandbox rather than production

7. Access

# Requirement Owner Verified by
T32 Server access for the installer Customer IT Administrative access to the application host
T33 Database access for the installer Customer IT Sufficient rights to create objects and run migrations
T34 A change-control path exists Customer IT Approvals identified for firewall, DNS and certificate changes, with lead times known

Validation

Run this as a formal gate, with evidence, before the installation date is confirmed.

Gate Evidence
Every row above marked complete A signed checklist with owner names, not a verbal confirmation
Connectivity proven from the right host Every network test executed from the application host, not from an engineer's laptop. A workstation frequently has network access the server does not
Database reachable with the application's own credentials Connection succeeds using the least-privilege login, not an administrative one
Restore tested A backup has been restored into a scratch environment and opened
PDF rendering works A test render completes on the host, proving the browser dependencies are present
Certificates valid and owned Expiry dates recorded and a renewal owner named
Egress address fixed and registered Where the provider allow-lists, the address is confirmed on both sides

Troubleshooting

Symptom Cause Action
Network tests pass from a laptop but fail from the server Different network segment or proxy policy Re-test from the application host. Only that result counts
Provider calls fail with a connection reset, credentials confirmed correct Source-address allow-list, or an intercepting proxy Confirm the egress address with the provider; ensure the proxy certificate is trusted by the application
PDF generation fails with a browser launch error Headless-browser system libraries absent on a minimal image Install the required libraries; this is an operating-system dependency, not an application setting
Application starts but background jobs never run Redis unreachable while queue-backed jobs are enabled Check Redis reachability and authentication. This does not surface as an error in the interface
Database connection fails only from the application Least-privilege login lacks a required right, or encryption settings differ Test with the exact credentials and connection settings the application uses
Firewall change takes weeks Change control not identified during preparation Raise firewall requests at the start of preparation, with the destination list from Network and Firewall
ERP team unavailable when integration work begins ERP-side effort never allocated Escalate. No amount of Complifly configuration substitutes for the ERP emitting documents
Certificate expires shortly after go-live Renewal owned by nobody Assign an owner and automate renewal before go-live, not after the first outage