Infrastructure & Monitoring
The part nobody sees until it fails: servers, backups, monitoring. Set up, hardened and kept an eye on.
Where it usually goes wrong
It runs. Until it does not — and then the question is who notices, how fast, and whether anyone knows how to get it back up. Usually nobody ever commissioned that part, because nobody missed it.
What you get out of it
- Fixed costs instead of a bill that grows with usage
- Someone notices when something breaks at night
How we do it
Why run your own server
Because platforms change prices and discontinue services. A dozen containers run on our production server for nine euros a month — on usage-based hosting that would be a multiple. The price: you have to look after it. For load spikes, rules about where data may live, or a team that does not want to run a server, the opposite is right — then we build it in the cloud, on AWS for instance. The question is not what is more modern, but what runs cheaper and quieter in your case.
Every service with hard limits
Memory and CPU are capped per container. When one process runs away, it does not take everything else with it. You learn that once the hard way and do it that way from then on.
Building and running belong apart
Since July 2026 a second server handles builds and background work only. The reason was an outage: compute-heavy processes had slowed the production machine down. Since then what interferes with each other is separated — and the build machine no longer depends on a CI provider's billing model.
Monitoring nobody mutes
Tools that alert constantly get silenced within two weeks. So we built our own that only shows what matters right now: who got banned, which certificate expires when, where traffic comes from. Both servers report into it without either needing access to the other. Where more comes together than a handful of services, a ready-made tool is the better answer — we work with Datadog daily and set it up so it sends exactly the alerts someone will actually read.
Hardening belongs to setup, not afterwards
Key-only login, no root access, seven ban rules against automated attacks, nightly audit runs, automatic security updates. None of it is expensive. It is usually just missing, because nobody orders it and nobody misses it — until it is too late.
What we work with
- Docker
- nginx
- Linux
- Datadog
- AWS
- fail2ban
Demonstrated by
The first step
A stocktake: what runs where, who has access, what happens during an outage. After that you know where you stand — even if you change nothing.