Choose the smallest architecture that works
A static publication does not need a database or an always-running application server. Generate pages from version-controlled source and serve the resulting files. Add a runtime only when a concrete feature requires it.
Each new service brings operational responsibilities: updates, credentials, monitoring, data handling and recovery. Keep that cost visible when comparing options.
Separate source, build and deployment
Source control records what changed. A build transforms reviewed source into a deployable artifact. Hosting makes that artifact accessible. Treat these as distinct stages with their own evidence and permissions.
A preview should not silently become production. Know which branch deploys where, restrict who can publish and keep the previous working release available.
Document decisions and trade-offs
Record the problem, alternatives, decision and consequences. Revisit the decision when requirements change rather than accumulating infrastructure because it once seemed convenient.
An architecture diagram should explain relationships and trust boundaries. A public diagram should not expose internal addresses, credentials, private topology or routes into management systems.