Delivery and infrastructure

Recommended

• Use Git on GitHub for version control and code hosting

  Recommended Free tier

  Keep every repository in Git, hosted on GitHub, with the default branch protected.

• Use GitHub Actions for continuous integration

  Recommended Free tier

  Run every build, test and deploy in GitHub Actions workflows stored in the repository, with each step a plain shell command.

• Use Docker and Docker Compose for containers

  Recommended Open source

  Package each service as a Docker image built from a Dockerfile, and describe the local stack in one Compose file.

• Use OpenTofu for infrastructure as code

  Recommended Open source

  Describe all cloud resources in OpenTofu files kept in the repository, and apply them only from CI.

• Use Ubuntu LTS or Debian stable on servers

  Recommended Open source

  Run servers and container base images on a Ubuntu LTS release or Debian stable that is inside its standard security support.

• Use nginx or Caddy as the web server and reverse proxy

  Recommended Open source

  Put nginx or Caddy in front of every app server to serve TLS, static files, compression and redirects.

• Use Let's Encrypt for TLS certificates

  Recommended Free service

  Get every public certificate from Let's Encrypt through an ACME client that renews it by itself, such as certbot or Caddy.

• Use a managed DNS and CDN that exports your zone

  Recommended Free tier

  Host DNS and the CDN with a managed provider that exports the zone as a standard zone file, such as Cloudflare.

• Use SOPS for secrets

  Recommended Open source

  Keep runtime secrets in the repository encrypted with SOPS, and decrypt them only on the server or in CI.

Avoid

• Avoid HashiCorp tools under the Business Source License for new work

  Avoid

  Do not start new projects on Terraform or Vault releases under the Business Source License. Use OpenTofu and OpenBao, their open source forks.