# Environments and deployments
Source: https://docs.infraista.com/en/developer-tools/pipelines/environments-and-deployments



An **environment** is where a pipeline deploys, such as `staging` or `production`. A job deploys to
one when it names it:

```yaml
- name: production
  environment: production
  if: branch == main
  steps: [...]
```

Environments are created the first time a job names them, with no rules. Add rules on the pipeline's
**Environments** tab.

<Shot name="developer-tools/pipelines/environments" alt="The Environments tab with production (protected, one approval needed) and staging" />

## Protection rules [#protection-rules]

Rules are checked when a job for the environment is ready to start. A job that isn't allowed fails,
with the reason shown on the job; one that needs approval or must wait shows as waiting.

| Rule                      | What it does                                                                                                                          |
| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
| **Required approvals**    | How many people must approve. 0 deploys straight away                                                                                 |
| **Approvers**             | Who may approve. Nobody ticked: anyone who can manage pipelines                                                                       |
| **Prevent self-approval** | The person who started the run can't approve it                                                                                       |
| **Allowed branches**      | Only runs from these branches deploy here (`*` and `**` work). Pull request runs never deploy to an environment with allowed branches |
| **Wait timer**            | Wait this many minutes (after approval, if any) before the job starts, so a deploy can still be cancelled                             |
| **Deploy window**         | Deploys only start inside these hours; runs that are ready outside the window wait for it                                             |

An environment can also have a **URL**, shown on the environment and on runs that deploy there.

## Approve a deployment [#approve-a-deployment]

Approvers get a notification in the console (and on the pipeline's notification channels). Open the
run and approve or reject the waiting job, with an optional comment. Once enough people approve, the
job starts (after the wait timer). One rejection fails the job.

Pull requests from forks can't deploy to an environment that has any protection rule.

## Deployments and rollbacks [#deployments-and-rollbacks]

The **Deployments** tab lists every deploy job, newest first, with its environment, commit and result.

<Shot name="developer-tools/pipelines/deployments" alt="The Deployments tab listing two successful deployments to production" />

To roll an environment back, select an earlier deployment and confirm. Infraista starts a new run with
that deployment's commit and pipeline file. Only that environment's jobs run again; every other job
is reused as it ended in that run. Protection rules still apply.

## Related [#related]

* [Secrets and variables](/en/developer-tools/pipelines/secrets-and-variables)
* [Deploy targets](/en/developer-tools/pipelines/deploy-targets)