ENGINEERING
The process, the standards, the tools and the controls. Written down, because a way of working that only lives in someone’s head cannot be reviewed.
The process
Eight stages. Product and infrastructure move together at every one of them.
- 01DISCOVER
PRODUCT
user journeys · goals · KPIs
INFRASTRUCTURE
traffic profile · compliance · budget
DONE
- 02ARCHITECT
PRODUCT
information architecture · data model
INFRASTRUCTURE
topology · failure domains · cost model
DONE
- 03DESIGN
PRODUCT
UI system · prototypes · usability
INFRASTRUCTURE
environments · IaC modules
DONE
- 04BUILD
PRODUCT
frontend · API · mobile
INFRASTRUCTURE
pipelines · clusters · databases
DONE
- 05SECURE
PRODUCT
auth · input validation · CSP
INFRASTRUCTURE
secrets · network policy · scanning
IN PROGRESS
- 06DEPLOY
PRODUCT
release notes · feature flags
INFRASTRUCTURE
canary · automated rollback
QUEUED
- 07MONITOR
PRODUCT
product analytics · errors
INFRASTRUCTURE
SLOs · alerts · dashboards
QUEUED
- 08SCALE
PRODUCT
new features · new markets
INFRASTRUCTURE
autoscaling · multi-region
QUEUED
Architecture standards
The decisions we make the same way on every project, so a new engineer can read one system and recognise the next.
- One system, one owner
- The interface, the API and the machines it runs on are designed in the same room. No handover, no gap for a defect to live in.
- Contracts before code
- The data model and the API shape are agreed and typed before a screen is built. Clients are generated from the contract, not written twice.
- Everything in code
- Application, infrastructure, pipeline and dashboards live in the repository and go through review. Nothing is configured by hand in a console.
- One build, several targets
- The same container image runs in staging and in production, on a VPS or on Kubernetes. Configuration is environment, never a separate build.
- Reversible releases
- Canary steps, health gates and automatic rollback. A release you cannot undo in a minute is a release we have not finished designing.
- Observable by default
- Every service ships with metrics, logs and an SLO on day one. An alert points at a runbook, and the runbook has been used.
- Boring where it counts
- PostgreSQL, Redis, S3-compatible storage. We spend the novelty budget on the product, not on the database.
The stack
Six groups, one connected system. Every tool here runs in production for someone.
DELIVERY
How a commit becomes a release.
- GitVersion control
- JenkinsBuild automation
- Argo CDGitOps delivery
APPLICATION
What the user touches.
- ReactComponent UI library
- Next.jsFull-stack framework
- Node.jsRuntime and services
AUTOMATION · IaC
Infrastructure described, not clicked.
- TerraformInfrastructure as code
- AnsibleConfiguration management
DATA
Where the product keeps its state.
- PostgreSQLRelational database
- MongoDBDocument database
- RedisCache and queues
- MinIOS3 object storage
INFRASTRUCTURE
What the services run on.
- DockerContainerization
- KubernetesOrchestration
- NginxReverse proxy
- LinuxServer operating system
CLOUD · AWS
When the workload lives in the client’s own account.
- AWSCloud platform
- S3Object storage
- LambdaServerless functions
OBSERVABILITY
How we know it is working.
- PrometheusMetrics and alerts
- GrafanaDashboards
Security posture
Six layers of controls, and the pipeline evidence that they hold.
- 01IDENTITYOIDC · MFA · RBAC
- 02APImTLS · rate-limited
- 03APPLICATIONinput validation · CSP
- 04CONTAINERnon-root · read-only fs
- 05DATABASEencrypted · PITR
- 06INFRASTRUCTUREhardened hosts · backups
CONTROLS
- Authentication
- OIDC · MFA
- Authorization
- RBAC · scoped JWT
- Secrets
- vault · rotation
- Network security
- mTLS · default-deny
- Access control
- least privilege
- Backups
- PITR · 3-2-1
- Monitoring
- audit · alerts
EVERY RELEASE RUNS
- SASTsemgrep 1,204 rules0 high
- SCAtrivy fs 318 deps0 critical
- IMAGEtrivy imagescanning
- SECRETSgitleaksclean
- SBOMsyft → cosign attestqueued
WEBSITE · APPLICATION · API · INFRASTRUCTURE · MONITORING
From your first idea to production infrastructure, Geekholic Solutions engineers the complete digital system.