Infrastructure Scaffold

Step 2: Gather Context

1. Cloud provider — Firebase + GCP (default), Vercel, AWS, or hybrid?
2. Project type — web app (Next.js), mobile (Android/iOS), API backend, full stack?
3. Expected scale — users, requests/sec, storage volume, geographic regions?
4. Compliance requirements — HIPAA, SOC 2, GDPR, data residency?
5. Team size — solo dev, small team (2-5), or larger org with role separation?

Step 3: Firebase Infrastructure

firebase.json

{
  "hosting": {
    "public": "out",
    "ignore": ["firebase.json", "**/.*", "**/node_modules/**"],
    "rewrites": [
      { "source": "/api/**", "function": "api" },
      { "source": "**", "destination": "/index.html" }
    ],
    "headers": [
      {
        "source": "**/*.@(js|css|map)",
        "headers": [{ "key": "Cache-Control", "value": "public, max-age=31536000, immutable" }]
      },
      {
        "source": "**/*.@(jpg|jpeg|gif|png|svg|webp|avif)",
        "headers": [{ "key": "Cache-Control", "value": "public, max-age=86400, stale-while-revalidate=3600" }]
      }
    ]
  },
  "functions": [
    {
      "source": "functions",
      "codebase": "default",
      "ignore": ["node_modules", ".git", "firebase-debug.log", "firebase-debug.*.log", "*.local"],
      "predeploy": ["npm --prefix \"$RESOURCE_DIR\" run lint", "npm --prefix \"$RESOURCE_DIR\" run build"]
    }
  ],
  "firestore": {
    "rules": "firestore.rules",
    "indexes": "firestore.indexes.json"
  },
  "storage": {
    "rules": "storage.rules"
  },
  "emulators": {
    "auth": { "port": 9099 },
    "functions": { "port": 5001 },
    "firestore": { "port": 8080 },
    "storage": { "port": 9199 },
    "hosting": { "port": 5000 },
    "pubsub": { "port": 8085 },
    "ui": { "enabled": true, "port": 4000 }
  }
}

.firebaserc (Multi-Environment)

{
  "projects": {
    "default": "PROJECT_NAME-dev",
    "dev": "PROJECT_NAME-dev",
    "staging": "PROJECT_NAME-staging",
    "production": "PROJECT_NAME-prod"
  },
  "targets": {
    "PROJECT_NAME-prod": {
      "hosting": {
        "app": ["PROJECT_NAME-prod"]
      }
    }
  }
}

Switch environments: firebase use dev | staging | production

firestore.indexes.json

{
  "indexes": [
    {
      "collectionGroup": "orders",
      "queryScope": "COLLECTION",
      "fields": [
        { "fieldPath": "userId", "order": "ASCENDING" },
        { "fieldPath": "createdAt", "order": "DESCENDING" }
      ]
    }
  ],
  "fieldOverrides": []
}

Security Rules (Firestore)

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {

    // Deny all by default
    match /{document=**} {
      allow read, write: if false;
    }

    // Users — own data only
    match /users/{userId} {
      allow read: if request.auth != null && request.auth.uid == userId;
      allow create: if request.auth != null && request.auth.uid == userId;
      allow update: if request.auth != null && request.auth.uid == userId
                    && !request.resource.data.diff(resource.data).affectedKeys().hasAny(['role', 'createdAt']);
    }

    // Admin access
    match /{path=**} {
      allow read, write: if request.auth != null
                         && get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'admin';
    }
  }
}

Security Rules (Storage)

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read, write: if false;
    }

    match /users/{userId}/{allPaths=**} {
      allow read: if request.auth != null && request.auth.uid == userId;
      allow write: if request.auth != null && request.auth.uid == userId
                   && request.resource.size < 10 * 1024 * 1024
                   && request.resource.contentType.matches('image/.*');
    }
  }
}

Cloud Functions Deployment Config

// functions/src/index.ts
import { onRequest } from "firebase-functions/v2/https";
import { setGlobalOptions } from "firebase-functions/v2";

setGlobalOptions({
  region: "us-central1",
  memory: "256MiB",
  timeoutSeconds: 60,
  minInstances: 0,
  maxInstances: 100,
  concurrency: 80,
});

export const api = onRequest({ cors: true }, async (req, res) => {
  // API handler
});

Firebase Emulator Suite Setup

# Install and start emulators
firebase init emulators
firebase emulators:start

# Start with data import/export for persistence
firebase emulators:start --import=./emulator-data --export-on-exit=./emulator-data

# Run tests against emulators
firebase emulators:exec "npm test"

Step 4: GCP Infrastructure

Cloud Run (Containerized Services)

# cloud-run-service.yaml
apiVersion: serving.knative.dev/v1