Environment structure

Ideally, there should be 3 separate environments: Production, Staging and Development for different purposes:

  • Production: Final product goes here
  • Staging: UAT
  • Development: For dev team and QA

Depending on the project, Staging can be skipped; UAT will be on Development.

Environment infrastructure

AWS should be the best option to host environments; specifically AWS Elasticbeanstalk which allows to programmatically deploy source code by provided command line.

Each product / service should be associated with only one application on AWS Elasticbeanstalk with 3 environments described in the previous section.

If the infrastructure is provided or defined by the client, follow their deployment reference.

Source code repository hosting

Bitbucket and Github should be prioritized as they enable CI / CD in projects (Bitbucket Pipeline and Github Actions) with strong build machines.

AWS CodeCommit and GitLab could be good options in case Bitbucket and Github cannot be chosen.

Credentials to repositories will be provided by project managers or tech leads.

Repository structure

Identical to environment structure, there should be 3 separate branches for 3 different environments:

  • master: For Production
  • staging: For Staging
  • dev: For Development

Deploying right branch to right environment infrastructure MUST be 100% accurate. Otherwise, crashes will likely happen and degrade end users' experience.

Project members

Ideally, each member in the dev team should be invited to the repository with their Offspring Digital email for security and audit purposes.

There will be a case that the client's budget is not able to afford the cost for source code hosting. Therefore, Offspring Digital main account will be used to commit changes.

Branch permissions

master, staging and dev cannot be rewritten history. No force push can be pushed to those branches.

Only the team lead has permission to merge pull requests into branch master and staging after code review.

Branching and merging strategy

Devs checkout new branches from master to work on new tickets / issues. Name for new branches can be the ID number of the tickets / issues.

After QA, devs create pull requests into master and staging. Team lead is responsible for merging pull requests.

Security

Turn on 2FA for all accounts.

Implement ssh access restrictions with whitelist IP address (Offspring IP: 27.72.98.177)

Create IAM for each of the users instead of sharing the root account.

Store passwords in 1 password account, don't store in a word doc or similar.

If share passwords to external persons, use https://onetimesecret.com/, never send directly in email/ chat.