Zero‑downtime deployment
Ship updates without dropping a single connection. This recipe covers blue‑green deploys, health‑check gating, and instant rollback so your users never see a 502.
1. Blue‑green topology
Run two identical environments — blue (live) and green (staging). Deploy to green, validate, then swap the load‑balancer target. Keep blue warm for instant rollback.
2. Health‑check gating
Expose a /health endpoint that returns 200 only when the app is warm, DB is reachable, and migrations are complete. The load balancer must not promote green until health passes three consecutive probes.
3. Drain & swap
Set a 30‑second connection‑drain timeout on blue before cutting traffic. Once green is live, monitor error rates for 60 seconds. If the error budget is exceeded, flip back to blue automatically.
4. Database migrations
Expand‑and‑contract: add columns and tables in a backward‑compatible way first, deploy, then remove old schema in a follow‑up release. Never run destructive migrations while both environments share a database.
Pro tip: Pair this with Meridian’s canary‑release workflow to shift a small percentage of traffic to green before the full swap.