Infrastructure & DevOps Fundamentals

Infrastructure & DevOps Fundamentals

You do not need to configure Kubernetes or write Terraform scripts. But you do need to understand, at a conceptual level, what your infrastructure does, what can go wrong with it, and how to make decisions about it with your technical team. Ignorance here is expensive — not just in downtime, but in the security incidents and client trust damage that follow.

The Infrastructure Stack (Simplified)

Every web application has essentially the same layers:

1. Code repository: Where the code lives (GitHub). The source of truth for everything.

2. Build process: Transforming code into something that can run (compilation, bundling). Automated in modern pipelines.

3. Hosting: Where the running application lives. Vercel serves your Next.js apps; Railway runs your background services; Supabase hosts your database.

4. Domain / DNS: How users find your application. Namecheap holds your domains; DNS records point them at your hosting.

5. Monitoring: How you know when something is broken before clients tell you.

Each layer can fail independently. Your infrastructure strategy is managing the failure risk at each layer.

Deployment: What Actually Happens

When a developer pushes code to GitHub and Vercel auto-deploys it, here is what is happening:

1. GitHub receives the new code
2. Vercel detects the push and triggers a build
3. The build compiles your Next.js application and runs any build-time checks
4. If the build passes, Vercel deploys to a new instance and switches traffic to it
5. The old instance is kept briefly for rollback, then retired

This automation means a developer can deploy to production in minutes without touching a server. The risk: bad code also reaches production quickly. This is why CI/CD should include automated tests that catch obvious regressions before deployment.

What Uptime Actually Costs You

When your clients' sites go down, here is the real business cost:

• Direct: Any transactional revenue that cannot happen during downtime
• Trust: Every incident that clients discover before you tell them damages the relationship
• Time: Incident response time is your most expensive engineering time

For most of your client platforms, 99.9% uptime (8.7 hours of downtime per year) is the realistic target on current infrastructure. To promise 99.99%, you would need redundant hosting regions, automatic failover, and a dedicated on-call rotation — infrastructure investment that is only justified at significant scale.

The practical guidance: do not promise uptime in contracts beyond what your infrastructure setup can actually deliver. 99.9% is an honest commitment for a Vercel-hosted Next.js application. Put this in your client agreements explicitly so there is no ambiguity when incidents occur.

Security Fundamentals Every Tech Founder Must Know

1. Secrets in repositories: Never commit API keys, database passwords, or tokens to Git. Use Vercel's environment variable system, Railway's env vars, or Doppler. Rotate immediately if a key is accidentally committed — assume it was already scraped.

2. SQL injection: If your application takes user input and uses it in database queries without sanitization, attackers can extract or modify your database. Supabase's parameterized queries and Row Level Security policies protect against this — use them correctly.

3. Authentication: Do not build authentication from scratch. Clerk, Supabase Auth, and NextAuth exist because authentication done wrong creates catastrophic security vulnerabilities. The time saved by using these tools is trivial compared to the risk of rolling your own.

4. Data exposure: Every API endpoint in your application is a potential attack surface. Ensure that authenticated endpoints verify the requesting user has permission to access the specific data they are requesting — not just that they are logged in, but that they are authorized for that specific resource.

5. Dependency vulnerabilities: Libraries you depend on have bugs and security vulnerabilities. Run npm audit regularly and maintain a process for upgrading critical dependencies. Outdated dependencies are one of the most common sources of security breaches.

Monitoring: Knowing Before Your Clients Do

The most important infrastructure investment for a client-services tech company is monitoring that tells you something is broken before a client calls you. At minimum:

• Uptime monitoring: A service that pings your URLs every minute and alerts you if they return errors. UptimeRobot has a free tier that covers basic uptime checks.
• Error logging: Sentry or LogRocket in your application code surfaces errors with stack traces, so when something breaks you have context to fix it.
• Performance monitoring: Vercel Analytics shows you if page load times are degrading — a leading indicator of infrastructure problems.

The goal is a 5-minute or faster time-to-aware — meaning you know about an incident within 5 minutes of it starting, not when a client emails you an hour later.