Cloud & DevOps

Cloud and DevOps you never have to babysit.

Infrastructure described in a repository, deploys that take one command, a staging environment that actually mirrors production, and alerts that reach you before a customer does.

What we build

If a deploy is an event, something is wrong.

You can tell how a team’s infrastructure is set up by how it talks about releasing. Where deploys are scheduled for a quiet Friday and one person has to be awake for them, the problem is never the code — it is that the environment exists only in that person’s head and in a server nobody dares rebuild.

Infrastructure as code, meant literally

The whole environment described in a repository, so it can be destroyed and rebuilt from scratch. That is the test that matters: if you cannot recreate production from the repo, you do not have infrastructure, you have an artefact. It is also what makes a staging environment honest instead of an approximation that passes everything production would fail.

Pipelines that make releasing dull

Push to a branch, tests and type-checks run, an image is built, and it goes to staging. Merge, and the same artefact goes to production behind a health check with a rollback that is one click. Nothing manual in the path, because a manual step is a step somebody skips at 11pm.

Observability before the outage

Logs you can search, metrics with thresholds, uptime checks from outside your own network, and alerts routed to a person who can act. The goal is a specific one: you learn about a problem from your monitoring, not from a customer. We also set the thresholds deliberately — an alert channel everybody mutes is worse than no alerts.

Cost, deliberately

Cloud bills grow by accident: an oversized instance nobody resized, a snapshot schedule nobody reviewed, logs retained forever. We right-size at build time, put a budget alarm on the account, and tell you where the money goes. A right-sized VPS beats an over-provisioned cluster for most of the products we ship.

What you get

  • The whole environment rebuildable from a repository
  • One-command deploys, and a staging that mirrors production
  • CI that runs tests and type-checks before anything reaches a branch
  • Alerts that fire before your customers notice, routed to a human
  • Backups that have been restored at least once, not just scheduled
  • A cloud bill you understand, with a budget alarm on the account

Stack we use

  • AWS
  • Docker
  • Terraform
  • GitHub Actions
  • Nginx
  • Cloudflare
  • Grafana
  • Linux

How it runs

Three things that stop the 3am call.

None of them are exotic. All of them are usually missing.

01

Reproducible environments

Terraform and Docker, so production can be rebuilt from the repo and staging is a real mirror rather than a hopeful approximation.

02

Automated delivery

Tests, type-checks, build and deploy in one pipeline, with health-checked releases and a rollback that takes one click.

03

Monitoring that reaches you

Searchable logs, metrics with real thresholds, external uptime checks, and alert routing to somebody who can act on it.

Questions

Cloud & DevOps, answered.

Which cloud should we be on?

Whichever one your team can operate. AWS is our default because the tooling and the hiring pool are deepest, but for a great many products a right-sized VPS with Docker is cheaper, simpler and entirely sufficient. We would rather explain why you do not need Kubernetes than sell you a cluster.

Can you fix an existing setup rather than rebuild it?

Usually. We start with an audit: how it deploys, what is not in code, where the single points of failure are, and what the bill is going to. You get a written list of the risks in priority order and we work down it. Rebuilding from scratch is a last resort, not an opening position.

Do you offer ongoing support and on-call?

Yes, as a monthly arrangement. Realistically, though, the aim of the build is to need very little of it: most incidents we get called about are the predictable consequence of something that was never automated or never monitored.

How do you handle secrets and access?

Secrets live in a managed secret store or the CI provider’s encrypted variables, never in the repository and never in an environment file passed around. Access is least-privilege with per-person credentials, so revoking somebody takes one action rather than a password rotation.

Will we be locked into you?

No. Everything is in your accounts and your repository, using standard tools rather than anything of ours. The handover document is written during the build, not scrambled together at the end.

Deploys that keep you up at night?
Let’s automate them.