Goal
Prepare where the product will live: domain, certificates, CDN, containers, monitoring and backups — reproducible from code.
Inputs → outputs
Inputs
- Deployment view from the SDD
- Availability NFRs, SLOs, RPO / RTO
- Approved infrastructure budget
Deliverables
- Infrastructure & network diagram
- Deployment scripts / IaC, operations runbook
- Monitoring dashboard + alert channel
- Backup plan & restore-test record
Teams & roles
- DevOps / SREpipeline, containers, monitoring, backups
- Infrastructure & NetworkDNS, TLS, CDN, network, firewall
- Application Security (AppSec)secure configuration, headers, access
- Engineering (FE · BE · Mobile)health checks, app configuration
- Client (Product Owner / sponsor)owns accounts, approves cost
RACI matrix
R — does the work · A — accountable, final sign-off (exactly one A per activity) · C — consulted before · I — informed after.
| Activity | Dev | Sec | Ops | Infra | Data | Client |
|---|---|---|---|---|---|---|
| Domain, DNS, email authentication | · | · | · | A | · | C |
| TLS, CDN / WAF, reverse proxy | · | C | C | A | · | · |
| Containers & deployment pipeline | C | · | A | · | · | · |
| Infrastructure as Code | · | · | A | R | · | · |
| Monitoring, alerting, SLOs | C | · | A | · | · | C |
| Backups & restore test | · | · | A | R | C | · |
Dev = Engineering (FE · BE · Mobile); Sec = Application Security (AppSec); Ops = DevOps / SRE; Infra = Infrastructure & Network; Data = Data & AI; Client = Client (Product Owner / sponsor)
Quality gate
Staging mirrors production; a restore from backup has succeeded.
Entry criteria
- Deployment view and infrastructure budget approved
- Cloud accounts and domain in the client’s name
Exit criteria
- Staging equivalent to production (same image, different data)
- Automated deploy with post-deploy smoke tests
- Monitoring and alerts reach the right people
- Automated backups + a recorded successful restore
- Operations runbook complete
Activities
- 1.Register / point the domain, DNS records, email auth (SPF/DKIM/DMARC)
- 2.Auto-renewing HTTPS, CDN + WAF, reverse proxy
- 3.Containerise, deployment pipeline with post-deploy smoke tests
- 4.Infrastructure as Code for quick rebuilds
- 5.Monitoring: logs, metrics, alerts; 3-2-1 backups with a real restore test
Checklist
Tick to self-review — 0/6. Ticks stay in this browser only and are not sent anywhere.
Document templates
Markdown (.md) files: open in any editor, or paste into Word / Google Docs. Each states its purpose, who fills it in and when.
Client involvement
- Own the domain and cloud accounts in their name
- Approve monthly infrastructure cost
Tools
- Cloudflare (DNS, CDN, R2)
- Docker · Nginx
- Let’s Encrypt
- GitHub Actions
- Terraform / Ansible
- Grafana · Sentry
Reference standards
- RFC 8555 (ACME)
- Automatic TLS certificate issuance
- Google SRE — SLI / SLO
- Measurable service level objectives
- DORA metrics
- Deploy frequency, lead time, change failure rate, time to restore
Common pitfalls
- Backups never restore-tested
- Building on the production server and filling its disk
- Bind-mounted config lives outside the image, so deploying the image never updates it
- Cloud accounts in the contractor’s name instead of the client’s
Real example
cuongthai.com: images are built on a separate machine and pushed to a registry; the VPS only pulls and swaps — building on the VPS once filled the disk holding PostgreSQL. Every swap is smoke-tested. The nginx config is overwritten in place and its sha256 checked from INSIDE the container, because replacing it with mv left the container reading the old file (single-file bind mounts follow the inode).Where to learn
Subjects and courses on cuongthai.com that teach this stage’s work.