Hosting costs cut 80%

Production moved off managed cloud onto one self-hosted server, with deploys that verify themselves.

WellPrepped, an international tutoring company, ran production on managed cloud: container services, a registry, a build pipeline, each billed separately. For two products with modest traffic, the bill was out of proportion to the load.

I moved production to a single self-hosted server and rebuilt the delivery pipeline around it.

Hosting costs fell 80%. Both products run on the same machine, with staging beside production.

What replaced the cloud console

• The server is code: one idempotent script takes a blank machine to a hardened Docker Swarm node. Key-only SSH, firewall deny-by-default, fail2ban, unattended upgrades.
• Traefik terminates TLS with certificates issued over DNS, so nothing has to be publicly reachable to renew them.
• Metrics, logs and error tracking are reachable only over a private Tailscale network. The public internet sees the products and nothing else.
• App repositories build an image and ask for a rolling update. They hold no infrastructure.

Deploys that verify themselves

A rolling update only replaces a container once the new one is healthy. On top of that, the pipeline fails unless the commit being served matches the commit that was pushed. That check exists because the previous one lied.

Built for a second tenant

The platform layer is shared and product-agnostic; each product is a namespaced stack on top. When the company's second product came off managed cloud, it moved onto the same server without changes to the platform.

What it gives up

One server is one failure domain. At this size, a server that can be rebuilt from code is a better trade than paying for redundancy every month. The stacks are standard Swarm files, so adding nodes is a configuration change when the load calls for it.