The story
My apps used to run on a hand-built server: an unsupported OS, processes started one by one, nginx configs edited file by file and no backups at all. A first attempt, MultisiteConfig, already put them behind a Docker proxy. Infra takes the idea all the way.
Each project declares what it needs in a manifest. The server decides what it grants. A reconciler written in Python compares the desired state, kept in Git, with what is actually running, and fixes the gap every two minutes.
What I did
- Bootstrapping and hardening a Debian 13 server with Ansible: key-only SSH, nftables firewall, fail2ban, automated compliance checks
- Traefik v3 with automatic TLS certificates
- Encrypted restic backups to Backblaze B2, checked weekly and actually restored
- Continuous deployment: image built by GitHub Actions, deployed by digest, automatic rollback when it does not answer
- One isolated network per project, a shared MariaDB with one account per project, secrets never written to a repository
- Monitoring, phone alerts, an event log and a public app portal