02 — Infrastructure and Environments

PRD Document · Savoy Signature Hotels — Multi-Site Headless Platform
Version: 1.0 · Date: 2026-03-04
Related docs: 01_General_Architecture.md, A05_Environment_Config.md

1. Purpose

This document specifies the infrastructure services, environment topology, CI/CD pipelines, monitoring strategy, and operational procedures for the Savoy Signature multi-site platform.

2. Infrastructure Overview

All services are hosted on Microsoft Azure with Cloudflare as the edge/CDN layer.

2.1 Architecture Diagram

2.2 Azure Services

Service	SKU / Tier	Purpose	Notes
App Service (Next.js)	P1v3 or P2v3	Next.js SSR application	Auto-scale based on CPU/memory; Node.js 20.9+ LTS
App Service (Umbraco)	P1v3 or P2v3	Umbraco 17 CMS (headless)	.NET 10 LTS runtime; always-on enabled
Azure SQL Database	Standard S2 (50 DTU) or General Purpose	Umbraco content database	Geo-redundant backup; auto-tuning
Blob Storage	Standard GRS / Hot tier	Media files (images, PDFs, videos)	CDN-fronted; lifecycle policies for unused media
Application Insights	Pay-as-you-go	APM for both apps	Distributed tracing, custom metrics
Log Analytics	Pay-as-you-go	Centralized logging	KQL queries, alerts, dashboards
Key Vault	Standard	Secrets management	Connection strings, API keys, certificates
Virtual Network	—	Network isolation	Private endpoints for SQL and Blob

3. Environment Topology

The platform uses 4 environments following a promotion pipeline:

3.1 Environment Matrix

Note: DEV and STAGE are internal WYcreative environments hosted under wycreative.com. STAGE may be shared with the client team during initial phases for testing and validation.

Environment	Purpose	Domain Pattern	Azure Resource Group	Cloudflare	Auto-deploy
DEV	Active development, feature testing	`savoy-dev-*.wycreative.com`	`rg-savoy-dev`	Enabled (proxied, performance monitoring)	PR from `develop` → `deploy/dev` (CI + 1 approver)
STAGE	QA, client review, UAT	`savoy.stage-*.wycreative.com`	`rg-savoy-stage`	Enabled (test cache behavior)	On PR merge to `staging`
QA	Pre-production validation, performance testing	`qa-*.savoysignature.com`	`rg-savoy-qa`	Enabled (production-like)	Manual promotion
PROD	Live production sites	`*.savoysignature.com` / `hotelnext.pt`	`rg-savoy-prod`	Enabled (full caching)	Manual promotion with approval

DEV / STAGE Domain Examples

Site	DEV Domain	STAGE Domain
Savoy Signature	`savoy-dev-signature.wycreative.com`	`savoy-stage-signature.wycreative.com`
Savoy Palace	`savoy-dev-palace.wycreative.com`	`savoy-stage-palace.wycreative.com`
Royal Savoy	`savoy-dev-royal.wycreative.com`	`savoy-stage-royal.wycreative.com`
Saccharum	`savoy-dev-saccharum.wycreative.com`	`savoy-stage-saccharum.wycreative.com`
The Reserve	`savoy-dev-reserve.wycreative.com`	`savoy-stage-reserve.wycreative.com`
Calheta Beach	`savoy-dev-calheta.wycreative.com`	`savoy-stage-calheta.wycreative.com`
Gardens	`savoy-dev-gardens.wycreative.com`	`savoy-stage-gardens.wycreative.com`
Hotel Next	`savoy-dev-next.wycreative.com`	`savoy-stage-next.wycreative.com`
Umbraco CMS	`savoy-dev-cms.wycreative.com`	`savoy-stage-cms.wycreative.com`

Note: DEV domains use 1-level subdomains (savoy-dev-* not savoy.dev-*) because Cloudflare Universal SSL only covers *.wycreative.com (one level). All DEV domains are proxied via Cloudflare for performance monitoring (Observatory + GraphQL Analytics).

3.2 Environment Diagram

3.3 Environment-Specific Configuration

Variable	DEV	STAGE	QA	PROD
`UMBRACO_API_URL`	`https://savoy-dev-cms.wycreative.com`	`https://savoy.stage-cms.wycreative.com`	`https://qa-cms.savoysignature.com`	`https://cms.savoysignature.com`
`CLOUDFLARE_ZONE_ID`	Zone ID	Zone ID	Zone ID	Zone ID
`CLOUDFLARE_API_TOKEN`	Token	Token	Token	Token
`GATE_ENABLED`	`true`	`true`	`true`	`false`
`GATE_SECRET`	Secret	Secret	Secret	—
`GATE_COOKIE_DOMAIN`	`.wycreative.com`	`.wycreative.com`	—	—
`NODE_ENV`	`development`	`staging`	`production`	`production`
`REVALIDATE_SECRET`	dev-secret	stage-secret	qa-secret	prod-secret
`NEXT_PUBLIC_GA_ID`	—	—	—	`G-XXXXXXXXXX`
`APPINSIGHTS_KEY`	Key	Key	Key	Key

Full configuration reference in A05_Environment_Config.md

4. CI/CD Pipeline

4.1 Branch Strategy

main (PROD)
├── staging (STAGE / QA)
│   └── develop (DEV)
│       ├── feature/SAVOY-123-hero-module
│       ├── feature/SAVOY-456-booking-bar
│       └── fix/SAVOY-789-cache-headers

Branch	Environment	Trigger	Protection
`feature/`, `fix/`	Local / Preview	—	—
`develop`	Integration	PR merge (no CI, merge freely)	—
`deploy/dev`	DEV	PR from `develop`	1 approval, CI pass, squash merge
`staging`	STAGE → QA	PR merge from `develop`	2 approvals, CI pass
`main`	PROD	PR merge from `staging`	2 approvals, QA sign-off, CI pass

4.2 Pipeline Stages

The pipeline includes a unique AI QA Agent step between CI and CD. This agent runs on a local Mac using openClaw (Agentic AI) and performs comprehensive automated quality assurance before any deployment.

4.3 AI QA Agent (openClaw) — Detail

The openClaw AI QA Agent runs on a dedicated local Mac and acts as an automated quality gate between CI and CD:

Step	Description	Tools / Metrics
PR Pickup	Monitors the Git repository for new PRs targeting `develop`, `staging`, or `main`	GitHub/Azure DevOps API
Performance Tests	Runs Lighthouse CI on all changed pages, checks Core Web Vitals thresholds	Lighthouse CI (LCP < 2.5s, FID < 100ms, CLS < 0.1)
Accessibility Audit	Full WCAG 2.1 AA audit on all changed components and pages	axe-core, Playwright accessibility testing
Visual Regression	Pixel-perfect comparison against Figma designs and baseline screenshots	Chromatic / Percy / custom screenshot diffing
UI/UX Validation	Validates responsive behavior, interaction states, navigation flows	Playwright E2E tests across viewports
Comment & Report	Posts detailed review comments on the PR (GitHub/Azure DevOps) and updates the corresponding task in Zoho Project	API integrations
Gate Decision	If all checks pass → PR is approved for merge → CD proceeds. If any check fails → PR is blocked with detailed feedback	Automated approval/rejection

Important: The AI QA Agent does NOT replace human code review. It runs in parallel with human review, providing automated quality assurance feedback. The PR still requires human approval per branch protection rules.

Full testing strategy and AI QA Agent specification in 18_QA_and_Testing.md

4.4 CI Pipeline Detail

# Pseudo-pipeline definition (Azure DevOps / GitHub Actions)

name: CI Pipeline

on:
  pull_request:
    branches: [develop, staging, main]

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      - run: pnpm install --frozen-lockfile
      - run: pnpm lint
      - run: pnpm typecheck

  test:
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - run: pnpm test --coverage
      - run: pnpm test:e2e  # Playwright

  build:
    runs-on: ubuntu-latest
    needs: test
    steps:
      - run: pnpm build
      - run: pnpm build:storybook

  # AI QA Agent (openClaw) picks up the PR after CI passes
  # Runs on local Mac — not part of the cloud CI/CD pipeline
  # See section 4.3 for details

  deploy:
    runs-on: ubuntu-latest
    needs: build
    if: github.event_name == 'push' && ai_qa_approved == true
    steps:
      - run: # Deploy to target environment
      - run: # Purge Cloudflare cache (STAGE/PROD only)
      - run: # Run smoke tests

4.5 Umbraco Deployment

Umbraco deployments are separate from frontend deployments:

Aspect	Approach
Schema Changes	Umbraco Deploy or manual migration scripts
Content	Not deployed — lives in database, managed by editors
Code Changes	.NET build + deploy to App Service via CI/CD
Database Migrations	EF Core migrations, run automatically on startup

5. Monitoring and Observability

5.1 Monitoring Stack

Tool	Purpose	Scope
Azure Application Insights	APM, request tracing, exceptions, custom metrics	Next.js + Umbraco
Azure Log Analytics	Centralized log aggregation, KQL queries	All Azure resources
Cloudflare Analytics	Edge traffic, cache hit rate, WAF events	CDN layer
Azure Monitor Alerts	Proactive alerting on thresholds	All services
Uptime Robot / Azure Availability Tests	Uptime monitoring for all 8 sites	External

5.2 Key Metrics and Alerts

Metric	Threshold	Alert
Response Time (P95)	> 2s	Warning
Response Time (P95)	> 5s	Critical
Error Rate (5xx)	> 1%	Critical
Cache Hit Rate	< 80%	Warning
CPU Usage (App Service)	> 85% for 5min	Warning
Memory Usage	> 90%	Critical
SQL DTU Usage	> 80%	Warning
Blob Storage Size	> 80% capacity	Warning
SSL Certificate Expiry	< 30 days	Warning

5.3 Logging Strategy

Layer	Log Destination	Retention
Next.js	Application Insights + stdout	90 days
Umbraco	Application Insights + Umbraco logs	90 days
Cloudflare	Cloudflare Logs (Pro — via Logpush or API)	30 days
Azure SQL	Azure Diagnostics	30 days
CI/CD	Pipeline logs	90 days

6. Scaling Strategy

6.1 Horizontal Scaling

Component	Strategy
Next.js	Azure App Service auto-scale: min 2, max 6 instances based on CPU > 70%
Umbraco	Single instance (headless API, low traffic — most requests served from edge cache)
SQL	Elastic pool or scale up DTUs as needed

6.2 Vertical Scaling Triggers

Scenario	Action
Sustained CPU > 85%	Upgrade App Service plan tier
Frequent SQL timeouts	Upgrade SQL tier or add read replica
Blob throughput limits	Enable CDN for blob, premium tier

7. Disaster Recovery

Aspect	Strategy	RTO	RPO
Database	Azure SQL geo-replication + point-in-time restore	1h	5min
Blob Storage	GRS (Geo-Redundant Storage) — automatic failover	1h	0
App Services	Deploy from CI/CD to secondary region	2h	0 (code in Git)
Cloudflare	Global anycast — inherent redundancy	—	—
Configuration	Key Vault with backup enabled	1h	0

7.1 Backup Schedule

Resource	Frequency	Retention
Azure SQL	Continuous (PITR)	35 days
Blob Storage	GRS replication	Continuous
App Service Config	Key Vault snapshots	90 days
Git Repository	GitHub / Azure DevOps	Indefinite

8. Security Infrastructure

Measure	Implementation
Network Isolation	VNet integration for App Services; private endpoints for SQL and Blob
Secrets	Azure Key Vault for all secrets; no secrets in source code (local dev uses `.env.local`, CI uses GitHub Actions Secrets, Azure uses Key Vault)
SSL/TLS	Cloudflare Full (Strict); TLS 1.2 minimum
Backoffice Access	IP whitelist + Azure AD / MFA
WAF	Cloudflare managed rules + custom rules for bot protection
DDoS	Cloudflare DDoS protection (included)

Full security specification in 15_Security.md

9. Cost Estimation

Service	Monthly Estimate (EUR)	Notes
App Service (Next.js) × 4 envs	~€200–400	P1v3 for PROD, B1 for DEV/STAGE
App Service (Umbraco) × 4 envs	~€200–400	P1v3 for PROD, B1 for DEV/STAGE
Azure SQL × 4 envs	~€150–300	S2 for PROD, Basic for DEV
Blob Storage	~€20–50	Depends on media volume
Application Insights	~€50–100	Based on data ingestion
Key Vault	~€5	Minimal
Cloudflare	~€0–200	Pro or Business plan
Total	~€625–1,450/mo	Varies by tier selection

These are estimates. Actual costs depend on traffic, media volume, and scaling.

10. Acceptance Criteria

All 4 environments (DEV/STAGE/QA/PROD) are provisioned and accessible
CI/CD pipeline deploys successfully to DEV on develop branch merge
Cloudflare is configured with DNS, SSL, and cache rules for all domains
Application Insights captures telemetry from both Next.js and Umbraco
Alerts fire correctly when thresholds are breached
Key Vault stores all secrets; no secrets in application config
Database backup/restore tested successfully
Auto-scaling triggers verified under load

Next document: 03_MultiSite_and_Domains.md