Production Checklist

Remem’s Community Edition core runs as a single service, remem-server (port 4545), deployed via Docker Compose. This checklist covers remem-server, which holds all data; if you also run the remem-mcp stdio binary for local MCP clients, it’s stateless and holds nothing to back up or harden beyond its API key.

Production safety gate

• REMEM_ENV=production is set

With REMEM_ENV=production, remem-server refuses to start if REMEM_ALLOW_AUTH_DISABLED=true, REMEM_API_KEY is empty/short/a placeholder, or REMEM_CORS_ORIGINS is empty — catching exactly the defaults a freshly-copied .env.example ships with, before they reach production traffic.

Authentication

• REMEM_API_KEY is set to a secret value (minimum 32 characters, randomly generated)
• API key is not committed to version control
• API key is rotated if it has been exposed — set the new key as REMEM_API_KEY_SECONDARY first, roll out callers, then promote it to REMEM_API_KEY and drop the secondary

Generate a key:

openssl rand -hex 32

TLS

• Remem listens on 127.0.0.1, not 0.0.0.0
• Nginx, Caddy, or a load balancer handles TLS termination
• TLS certificate is valid and auto-renewed (Let’s Encrypt via Certbot or Caddy)

Minimal Nginx config:

server {
    listen 443 ssl;
    server_name remem.yourdomain.com;
    ssl_certificate /etc/letsencrypt/live/remem.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/remem.yourdomain.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:4545;
        proxy_set_header X-Request-ID $request_id;
    }
}

Persistence

• Data directory is on a volume that persists across container restarts
• Volume is backed up regularly (see below)

Backups

remem-server’s data directory (/var/lib/remem inside the container, holding the HNSW, CSR graph, BTree, inverted tag index, and LSM-tree indexes) contains all storage. Back it up:

docker exec remem-server sh -c 'tar czf - /var/lib/remem' > remem-backup-$(date +%Y%m%d).tar.gz

There is no backoffice UI in the Community Edition to drive backup/restore — a web-based Backoffice admin UI with built-in backup/restore is planned for the Business Edition (Coming soon). Until then, back up the volume directly as shown above.

Rate limiting

• REMEM_RATE_LIMIT_RPS / REMEM_RATE_LIMIT_BURST are tuned for your expected traffic (defaults: 100 rps, burst 50; keyed by client IP)
• If Remem sits behind a trusted reverse proxy, REMEM_TRUST_PROXY_HEADERS=true is set so limits key off X-Forwarded-For/Forwarded instead of the proxy’s own IP — only enable this if the proxy strips client-supplied values for those headers

Rate limiting is on by default; set REMEM_RATE_LIMIT_RPS=0 to disable it (e.g. if an upstream gateway already handles it).

Monitoring (Business — Coming soon)

Prometheus metrics scraping and pre-built Grafana dashboards are not part of the Community Edition. This observability tooling ships as part of the Business Edition and is not available today. In the meantime:

• GET /api/v1/ready and GET /api/v1/health/deep are polled by your own monitoring for liveness/readiness
• GET /api/v1/tasks is polled periodically to catch stalled background tasks (discovery queue depth, worker restarts)

Log management

• RUST_LOG is set appropriately (info in production; debug/trace only for troubleshooting) — this is the only logging-related environment variable
• Logs are forwarded to a log aggregation system (Loki, Datadog, CloudWatch, etc.)

Resource limits

• Docker container has memory limits set (--memory 2g minimum for 100K+ memories)
• CPU limits are appropriate for embedding generation and background task load