Deploying Angle applications to production requires more than pushing code to a server. Production environments demand fault tolerance, security hardening, observability, and performance optimization that development setups skip. This guide covers opinionated best practices for running Angle apps in 2026 hosting environments, the rationale behind each decision, and the anti-patterns that create late-night incidents.
Configuration Management
Environment Variables Over Hardcoded Values
Store all environment-specific configuration in environment variables, never in source code. Database credentials, API keys, service endpoints, and feature flags belong in the environment, not committed to version control.
# .env.production (never commit this file)
DATABASE_URL=postgresql://user:pass@localhost:5432/proddb
API_SECRET_KEY=your-secret-key-here
REDIS_HOST=127.0.0.1
LOG_LEVEL=info
Load these at application startup. Most hosting platforms provide secure environment variable storage through control panels or CLI tools. For cPanel environments, use .htaccess SetEnv directives or PHP-FPM pool configurations. For VPS deployments, systemd service files or Docker environment files work well.
Anti-pattern: Maintaining separate config files for each environment and switching between them with conditional logic. This creates deployment complexity and increases the risk of production secrets leaking into logs or error messages.
Configuration Validation at Startup
Validate all required configuration before accepting traffic. If a critical environment variable is missing or malformed, the application should fail fast with a clear error message rather than starting in a degraded state.
const requiredEnvVars = [
'DATABASE_URL',
'API_SECRET_KEY',
'REDIS_HOST'
];
for (const envVar of requiredEnvVars) {
if (!process.env[envVar]) {
console.error(`Missing required environment variable: ${envVar}`);
process.exit(1);
}
}
This prevents silent failures where the application runs but critical features fail intermittently because configuration wasn't loaded correctly.
Error Handling and Logging
Structured Logging
Use structured logging with JSON output rather than plain text. Structured logs are machine-parsable, making it easier to search, filter, and aggregate logs across distributed systems.
logger.info({
event: 'user_login',
userId: user.id,
ipAddress: req.ip,
timestamp: new Date().toISOString()
});
Set log levels appropriately: debug for development, info for production events, warn for recoverable issues, error for failures. Configure log rotation to prevent disk exhaustion. Most Linux distributions include logrotate; configure it to compress and archive logs after they reach a certain size or age.
Anti-pattern: Logging sensitive data like passwords, API keys, or credit card numbers. Implement log scrubbing to automatically redact sensitive fields before writing to disk or sending to log aggregation services.
Global Error Handlers
Implement global error handlers to catch unhandled exceptions and promise rejections. Without these, uncaught errors can crash the application or leave it in an undefined state.
process.on('uncaughtException', (error) => {
logger.error({ event: 'uncaught_exception', error: error.message, stack: error.stack });
// Perform graceful shutdown
process.exit(1);
});
process.on('unhandledRejection', (reason, promise) => {
logger.error({ event: 'unhandled_rejection', reason, promise });
});
For HTTP servers, implement middleware that catches route handler errors and returns appropriate status codes without leaking internal details to clients.
Error Responses Without Information Leakage
Return generic error messages to clients while logging detailed errors server-side. Stack traces, database errors, and internal paths should never appear in API responses.
app.use((err, req, res, next) => {
logger.error({
event: 'request_error',
path: req.path,
method: req.method,
error: err.message,
stack: err.stack
});
res.status(500).json({
error: 'Internal server error',
requestId: req.id
});
});
Provide a request ID that clients can reference when reporting issues. This lets you correlate user-reported problems with server logs without exposing sensitive information.
Security Hardening
Input Validation and Sanitization
Validate and sanitize all user input before processing. Use validation libraries rather than writing custom regex patterns. Define schemas for expected input and reject anything that doesn't conform.
const schema = {
email: { type: 'string', format: 'email', maxLength: 255 },
age: { type: 'integer', minimum: 0, maximum: 150 }
};
Never trust client-side validation alone. Always validate on the server. Client-side validation improves user experience but provides no security benefit since it can be bypassed.
Anti-pattern: Using string concatenation to build SQL queries or shell commands with user input. Always use parameterized queries or prepared statements for database operations and avoid shell execution when possible.
Rate Limiting and Request Throttling
Implement rate limiting to prevent abuse and resource exhaustion. Apply different limits to different endpoints based on their resource cost: stricter limits for authentication endpoints, more generous limits for read-only operations.
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
limit_req_zone $binary_remote_addr zone=auth:10m rate=5r/m;
location /api/ {
limit_req zone=api burst=20 nodelay;
}
location /auth/ {
limit_req zone=auth burst=5;
}
For application-level rate limiting, use Redis-backed implementations that work across multiple application instances. Store rate limit counters with expiring keys to automatically clean up old data.
Security Headers
Configure security headers to protect against common web vulnerabilities. At minimum, set Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Strict-Transport-Security headers.
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
Disable server version disclosure in HTTP headers. Attackers use version information to identify known vulnerabilities.
Performance Optimization
Connection Pooling
Use connection pooling for database and cache connections. Creating new connections for each request adds significant latency. Connection pools maintain a set of reusable connections that can be shared across requests.
const pool = new Pool({
host: process.env.DB_HOST,
database: process.env.DB_NAME,
max: 20,
idleTimeoutMillis: 30000,
connectionTimeoutMillis: 2000
});
Size the pool based on your database server's max connections and the number of application instances. A common starting point is 10-20 connections per instance, adjusted based on monitoring data.
Anti-pattern: Setting pool size to an arbitrarily high number. Too many connections can exhaust database resources and degrade performance. Monitor connection usage and tune based on actual demand.
Caching Strategy
Implement multi-layer caching: application-level memory cache for hot data, Redis or Memcached for shared cache across instances, and HTTP caching for static assets.
// In-memory cache for reference data
const cache = new Map();
async function getConfig() {
if (cache.has('config')) {
return cache.get('config');
}
const config = await db.query('SELECT * FROM config');
cache.set('config', config);
setTimeout(() => cache.delete('config'), 300000); // 5 min TTL
return config;
}
Set appropriate Cache-Control headers for static assets. Use ETags for conditional requests to reduce bandwidth usage. Configure CDN caching for geographically distributed users.
Compression
Enable compression for HTTP responses. Gzip or Brotli compression typically reduces text response sizes by 70-80%, significantly improving load times over slower connections.
gzip on;
gzip_vary on;
gzip_types text/plain text/css application/json application/javascript text/xml application/xml;
gzip_min_length 1000;
Don't compress already-compressed formats like images or video. The CPU overhead outweighs any minor size reduction.
Database Best Practices
Query Optimization
Analyze slow queries and add appropriate indexes. Use database query analyzers to identify full table scans and missing indexes. Monitor query execution time and optimize queries that exceed acceptable thresholds.
EXPLAIN ANALYZE SELECT * FROM users WHERE email = '[email protected]';
Avoid SELECT * in production code. Request only the columns you need to reduce data transfer and memory usage. Use pagination for queries that return many rows.
Connection Management
Always close database connections in error paths. Use try-finally blocks or language-specific resource management patterns to ensure connections are released even when errors occur.
let client;
try {
client = await pool.connect();
const result = await client.query('SELECT * FROM users');
return result.rows;
} catch (error) {
logger.error({ event: 'db_error', error: error.message });
throw error;
} finally {
if (client) client.release();
}
Anti-pattern: Holding database transactions open during external API calls or long-running operations. Keep transactions as short as possible to avoid blocking other queries and exhausting connection pools.
Monitoring and Observability
Health Check Endpoints
Implement health check endpoints that load balancers and monitoring systems can query. Distinguish between liveness checks (is the process running?) and readiness checks (can it handle traffic?).
app.get('/health/live', (req, res) => {
res.status(200).json({ status: 'ok' });
});
app.get('/health/ready', async (req, res) => {
try {
await db.query('SELECT 1');
await redis.ping();
res.status(200).json({ status: 'ready' });
} catch (error) {
res.status(503).json({ status: 'unavailable' });
}
});
Configure load balancers to remove instances that fail readiness checks. This prevents routing traffic to instances that can't serve requests successfully.
Application Metrics
Expose application metrics for monitoring: request count, response time, error rate, and business metrics specific to your application. Use histogram metrics for latency rather than averages, which hide outliers.
const requestDuration = new Histogram({
name: 'http_request_duration_seconds',
help: 'HTTP request duration in seconds',
labelNames: ['method', 'route', 'status_code']
});
Set up alerts for critical metrics: error rate spikes, response time degradation, and resource exhaustion. Alert thresholds should reflect your service level objectives.
Deployment Best Practices
Graceful Shutdown
Implement graceful shutdown to handle SIGTERM signals from process managers. Stop accepting new requests, finish processing in-flight requests, close database connections, and then exit.
process.on('SIGTERM', async () => {
logger.info('SIGTERM received, starting graceful shutdown');
server.close(() => {
logger.info('HTTP server closed');
});
await pool.end();
await redis.quit();
process.exit(0);
});
Configure adequate shutdown timeout in your process manager. Thirty seconds is a reasonable starting point for most applications.
Zero-Downtime Deployments
Deploy new versions without service interruption using rolling updates or blue-green deployments. With rolling updates, deploy to a subset of instances, verify health, then continue. With blue-green, deploy to a parallel environment and switch traffic after verification.
Avoid breaking changes to APIs or database schemas in a single deployment. Use feature flags to decouple code deployment from feature activation. For schema changes, use multi-phase migrations: add new columns in one release, migrate data, then remove old columns in a subsequent release.
Anti-pattern: Deploying during peak traffic hours. Schedule deployments during low-traffic periods and have a tested rollback procedure ready.
Conclusion
Production-grade Angle applications require deliberate attention to configuration, error handling, security, performance, and observability. The patterns in this guide represent battle-tested approaches that prevent common production issues: start with proper configuration management and error handling, layer in security hardening and performance optimization, then add comprehensive monitoring. Avoid the anti-patterns that create incidents: hardcoded credentials, information leakage in errors, unbounded resource usage, and deployments without rollback plans. Production readiness isn't a checklist you complete once—it's an ongoing process of monitoring, learning from incidents, and incrementally improving your operational practices.