Building a fairly large app, looking for suggestions on what I can do better with current setup/typical mistakes, etc

All: I'm building a fairly large applicaiton that allows people to upload and consume audio data. So far, I'm just using a cheap Linode box for development, but I'm thinking about this from a point of view knowing that it will scale. There are tons of people interested and even if I only convert 25% of them I think I'll still be doing really well. So I'm designing with scalability in mind.

First, everything is built using python and boto3 for storage and sending sms notifications for verification of a number. Supervisord manages and handles UWSGI emporer which runs all of my services.

Services in this instance can be broken down into cms (for employees/me), API (for the IOS/android app), static (hosts static files for cms/web which can be cached behind varnish or something) and docs (probably going to merge with static). For my data storage I use postgresql for user information and storage of s3 metadata. All of these services are stored in github in a private repo which is where I will be documenting release procedures. I use sqlalchemy so most of my database management is handled for me and I can easily have it update the tables on prod.

I am using sentry (not for prod), but for staging when I get to that point and for prod. This will agregate and report any errors. I've also set up a firewall that just blocks everything but http/ssh (so I can get in to do any work if I need to). When I release to prod I'll have a jump-box that is used for ssh and only allow that IP through. I'm also using Jenkins to nightly run unit tests on the individual services (so mostly just API for right now). I've got two main issues apart from whether or not anyone can recommend anything else that might make this better/easier to manage. I don't have any background in devops, but my biggest concern right now is making sure that this is secure (are there good ways to test this) and determining whether or not I need a WAF and how useful that would be to set up during dev just so I can tune it. My secondary issue is just that of migration. These are getting fairly complex and I'd like to be able to quickly role out new changes and deploy new servers. I've got everything documented and by following the instructions I can easily deploy a new server; all of the config files are also stored in another git, so that shouldn't be hard, I'm just trying to think ahead here. Also, when it comes to a DBA prospective, how do people generally handle things like sqlalchemy? If I add a new column it will just call an altar statement, but are there any pitfalls to be aware of there?

I appreciate any information/advice that might be offered. I graduate next semester and just want to have something cool under my belt. I've done a lot of QA work previously and my background before that was mostly in systems security/performance, so I think I've mostly got that covered. Ultimately I'd love to put each service in its own jail and have nginx in another jail that can connect to them and serve as hosts, but I'm not really sure how viable that is and I would lose the ability to use emporer.

Thanks for your time and I look forward to any responses.