Choose the production topology
The reference boundary deploys Next.js surfaces separately from the Go API and PostgreSQL. Buyers may adapt providers, but browser requests should continue through the approved application boundary and server-only credentials must remain server-side.
Record canonical public, transaction, API, and callback origins explicitly. Domain aliases and environment fallbacks are not a substitute for production configuration.
Isolate identities and secrets
Use distinct deployment identities with the minimum permissions needed for frontend delivery, backend release, artifacts, and database migration. Store OAuth, email, payment, database, and cloud credentials in the environment’s secret system.
Production secrets must not enter build logs, browser bundles, screenshots, test fixtures, or repository history.
Release immutable artifacts
Build from a reviewed commit, identify the artifact with that revision, verify integrity before activation, and keep the previous release available for rollback.
Database migrations require an explicit compatibility and rollback plan. Application rollback cannot undo an incompatible data change by itself.
Own health, recovery, and evidence
Monitor frontend availability, API health, worker health, database capacity, provider webhooks, queues, and product-level failures. Backups are only useful after a restore exercise proves they can recover the system.
Document alert ownership, incident response, credential rotation, maintenance windows, and rollback verification before accepting production traffic.