The Thirteen Full-Stack Layers
Complete · 14 parts
in engineering
From the browser tab to the 3am backup — one post per layer of a production web stack, and the gap between a vibe-coded demo and a real product.
- 0 Vibe-Coded vs Production-Ready: 3 Layers or 13? An AI can spin up a working demo in an afternoon — frontend, a bit of backend, a database. That's three layers. Shipping it to real users needs ten more. Here's the gap between a demo that works and a product that survives contact with the world.
- 1 Frontend Foundations: The Layer Users Actually Touch The first layer of any stack is the one the user sees and feels. HTML structure, CSS systems, the JavaScript you can afford, and the build step that ties them together — what a senior values, and what I reach for.
- 2 APIs and Backend Logic: Where the Rules Live The backend is where your business rules are enforced and your data is shaped before it ever reaches a screen. REST design, validation, the fat-controller trap, and how I structure a Laravel API so it survives growth.
- 3 Database and Storage: Where Data Comes to Rest The database outlives your code. Schema design, indexes, the N+1 query that quietly kills performance, migrations, and where files actually belong — the storage layer done with MySQL and Eloquent.
- 4 Auth and Permissions: Who Are You, and What Can You Do? Authentication answers who you are; authorization answers what you're allowed to do. Sessions vs tokens, password hashing, roles vs policies, and the mistakes that turn into breach reports — built with Laravel.
- 5 Hosting and Deployment: Getting It Online Without Fear Code on your laptop helps no one. Hosting is where it runs; deployment is how it gets there — repeatably, reversibly, without 'works on my machine'. The path from localhost to a URL the world can hit.
- 6 Cloud and Compute: What Your Code Actually Runs On 'The cloud' is someone else's computer, rented by the hour. VMs, containers, and serverless; vCPU and RAM; the bill that surprises you. Demystifying the machine your app lives on — and when self-hosting wins.
- 7 CI/CD and Version Control: The Conveyor Belt for Code Version control is the source of truth; CI/CD is the automated belt that carries a commit to production with the tests run and the build checked. How to wire a pipeline that makes shipping safe and boring.
- 8 Security and Row-Level Security: Can User A Read User B's Data? Security is a layer, not a feature you add at the end. The OWASP basics, and the bug that quietly ships in real apps: broken object-level authorization — when changing an ID in the URL loads someone else's data.
- 9 Rate Limiting: What Stops One Client From Melting Your App An endpoint with no rate limit is a door anyone can hold open forever. Throttling protects against brute force, scrapers, runaway clients, and bill shock. The algorithms, and how to wire it in Laravel.
- 10 Caching and CDN: Don't Compute What You Already Know The fastest query is the one you never run. Caching stores expensive results so you reuse them; a CDN moves content close to users. The layers of cache, the hard part (invalidation), and how to apply both.
- 11 Load Balancing and Scaling: Surviving Success One server has a ceiling. Scaling up buys a bigger box; scaling out adds more boxes behind a load balancer. The catch is statelessness — and why your app has to be designed for it before the traffic arrives.
- 12 Error Tracking and Logs: Knowing Before Your Users Tell You If you find out about bugs from angry tweets, you're flying blind. Logs are the flight recorder; error tracking is the alarm; metrics are the dashboard. The three pillars of observability, made practical.
- 13 Availability and Recovery: When It Breaks, How Fast Do You Come Back? Everything fails eventually. Availability is staying up despite failure; recovery is getting back fast when you can't. Backups you've actually restored, redundancy, RTO/RPO, and the runbook you'll be glad you wrote.