Which infrastructure do I need now and which later?

Use three tiers:

NOW (baseline for most public production apps)

• DNS, TLS and automated certificate renewal
• CDN and image optimisation for public media
• WAF/DDoS protection (it does not replace code-level authorization)
• Server-side input validation and authorization
• Rate limits and quotas per action, identity, tenant and IP
• Logs, metrics and tracing with secrets/PII redacted
• Encrypted backups plus a tested restore
• Relational database with transactions, indexing and query profiling

CONDITIONAL (needs observed demand)

• Redis/cache, queues and workers, read replicas, partitioning, a search engine, an API gateway, autoscaling

RARE / LAST RESORT (needs an ADR and a specialist team)

• Kubernetes, microservices, service mesh, multi-region active-active, and sharding — the last resort because cross-shard transactions get hard

Don't add expensive technology without a measured bottleneck and a trained owner.