All web projects share a common deployment setup. This isn't a separate project, it's just how everything below gets built and run.
Kubernetes
Every service has staging and production deployments with Kustomize overlays. Production runs 2+ replicas with horizontal pod autoscaling (up to 10). Liveness and readiness probes on all pods.
CI/CD
Reusable GitHub Actions workflows run tests, lint, spellcheck, and build Docker images on every PR. On merge, images are built for ARM64 + AMD64 and pushed to DockerHub. ArgoCD syncs the cluster.
Docker
All containers run as non-root users on Debian slim. Production dependencies only. Multi-platform builds (ARM64 for the Raspberry Pi, AMD64 for CI).
Monitoring
Sentry with performance tracing and profiling on all backends. Structured JSON logging via Winston with separate error/info/combined files, forwarded to BetterStack for centralized aggregation.
Security
Helmet, CORS restricted per domain, httpOnly/secure/SameSite session cookies, tiered rate limiting, environment secrets verified at startup, K8s secrets via secretRef.
TLS
All public endpoints served over HTTPS via cert-manager with Let's Encrypt certificates, auto-renewed on the cluster.