Mohamed Hosayni Web · DevOps · IoT

06 — Infrastructure

Infrastructure

From commit to browser: the exact path of a production release, and the choices that make it reversible.

Production architecture

  1. Edge

    • Caddy: automatic TLS, HTTP/2 and HTTP/3
    • 301 redirect from / to /fr/
    • Security headers and compression

  2. Static site

    • Astro 5, immutable build
    • nginx: files and 404 page
    • No application port exposed

  3. API

    • Flask + Gunicorn
    • Validation, honeypot, rate limiting
    • SMTP delivery and JSON responses

  4. Data and monitoring

    • PostgreSQL for messages
    • Backups and versioned migrations
    • Uptime Kuma and logs

Deployment pipeline

Every step is automated; a red CI blocks the production release.

  1. 01 CI

    Verify

    Lint, format, types and tests on every pull request.

    • ESLint
    • Prettier
    • astro check
    • Ruff
    • Pytest
  2. 02 CI

    Build

    Astro build and multi-stage Docker images, with no secret in the final layer.

    • Astro
    • Docker
    • Buildx
  3. 03 CI

    Publish

    SHA-tagged images pushed to the GitHub registry, never overwritten.

    • ghcr.io
    • SHA
    • SBOM
  4. 04 CD

    Deploy

    Key-based SSH, compose pull, restart and healthcheck before validation.

    • SSH
    • Compose
    • Healthcheck
  5. 05 CD

    Observe

    Uptime, logs and rollback to the previous tag in one command.

    • Uptime Kuma
    • Logs
    • Rollback

Full stack