What runs where
Place concerns, not brand logos. Decide what kind of work lives in the browser, at the edge, in an API, in a worker, in data stores, or in a managed SaaS / OSS you don’t operate — then pick a compute host only for units you still run yourself.
Concerns to place
Section titled “Concerns to place”UI · auth · business logic · jobs / queues · storage · search · LLM calls · secrets · webhooks · admin / docs
Ask for each: Is this core differentiation, or undifferentiated plumbing? Plumbing often belongs in a vendor (see Maintain — buy/vendor/OSS).
Lean defaults (house stance)
Section titled “Lean defaults (house stance)”| Concern | Default lean placement |
|---|---|
| Product web UI + light full-stack | Next.js + React on Vercel |
| Docs / handbook | Astro Starlight (static host / Pages) |
| Auth / payments / email (undifferentiated) | Managed SaaS when exit is acceptable |
| Async / spiky / event work | Worker / serverless |
| Long-running or portable process | Docker → Fly / Cloud Run / etc. |
| Secrets | Pulumi ESC + OIDC — repos |
| Generative traces / evals | Langfuse (quality regime C) |
One primary language per deploy unit — Language selection.
Then choose a host
Section titled “Then choose a host”Only after placement: open the Compute catalog. Host shopping before placement is how you get three clouds and no ownership map.
Anti-patterns
Section titled “Anti-patterns”- Every concern a microservice “for scale”
- A second host “just in case”
- LLM glue sprawl with no owner and no traces
- Rebuilding undifferentiated SaaS in-house on a deadline
- Skipping Architecture and coding until the diagram appears by accident
Related
Section titled “Related”- Lifecycle: Deliver · Maintain · Operate
- Shape: Project shapes