Infra Audit

/infra-audit -- Infrastructure Auditor

When to Use

• Before adding a new database, cache, or queue to a project
• When onboarding to an unfamiliar codebase and need to understand its infra
• Before planning a workspace campaign that spans multiple services
• When someone asks "what systems does this project talk to?"

Do not use when:

• The user already knows the infra and just wants to wire something up (use /architect)
• The question is about code architecture, not infrastructure (use /research)

Protocol

Step 1: DISCOVER

Scan the project for infrastructure configuration files. Check each category:

Container orchestration:

• docker-compose.yml, docker-compose.*.yml
• Dockerfile, *.dockerfile
• k8s/, kubernetes/, helm/, charts/

Environment and secrets:

• .env, .env.*, .env.example, .env.local
• *.env files in config directories

Database and ORM:

• Prisma: prisma/schema.prisma
• Drizzle: drizzle.config.ts, drizzle/
• TypeORM: ormconfig.*, data-source.ts
• Sequelize: .sequelizerc, config/database.*
• Knex: knexfile.*
• SQLAlchemy: alembic.ini, alembic/
• Django: settings.py (DATABASES section)
• Rails: config/database.yml
• Go: look for pgx, gorm, sqlx in go.mod

Message queues and event streaming:

• Redis: connection strings, ioredis, redis in package.json/requirements.txt/go.mod
• RabbitMQ: amqplib, pika, amqp imports
• Kafka: kafkajs, confluent-kafka, sarama imports
• NATS: nats, nats.go imports
• SQS/SNS: @aws-sdk/client-sqs, boto3 sqs references

Cache:

• Redis (dual-use -- note if used as cache vs. pub/sub vs. primary store)
• Memcached: memcached, pylibmc imports

Search:

• Elasticsearch: @elastic/elasticsearch, elasticsearch-py
• Meilisearch, Typesense, Algolia client libraries

Object storage:

• S3: @aws-sdk/client-s3, boto3 s3 references
• MinIO, GCS, Azure Blob client libraries

External APIs:

• Stripe, Twilio, SendGrid, Auth0, Firebase, Supabase client libraries
• Any NEXT_PUBLIC_* or VITE_* env vars pointing to external services

CI/CD:

• .github/workflows/, .gitlab-ci.yml, Jenkinsfile, bitbucket-pipelines.yml

For each discovered item, record:

• What: the system (e.g., "PostgreSQL 15")
• Where: config file path and line
• How: connection method (direct, pooled, ORM, SDK)
• Role: primary store, cache, queue, search, auth, etc.

Step 2: TRACE CONNECTIONS

For each discovered system, trace how the application connects:

1. Find connection strings in env files or config
2. Find the client initialization code (imports, new Client(), createPool())
3. Identify which modules/services use this connection
4. Note connection pooling, retry logic, health checks if present

Build a connection graph:

App --> [pool: 10] --> PostgreSQL (primary store)
App --> [ioredis]  --> Redis (cache + pub/sub)
App --> [SDK]      --> Stripe (payments)

Step 3: ANALYZE PATTERNS

Based on what's connected and how it's used, identify:

Access patterns:

• Read-heavy vs. write-heavy (look at query patterns in ORM usage)
• Real-time vs. batch (WebSocket/SSE presence, cron jobs)
• Request/response vs. event-driven (queue usage, webhook handlers)

Missing layers (flag only when evidence supports the need):

Do not flag something as missing unless the evidence is in the code.