Summary
A lean, maintainable infrastructure setup designed for small business web applications requiring high availability, strict isolation, and automated operations without the exorbitant cost of complex Kubernetes clusters.
Note: This is an illustrative reference case study demonstrating technical capabilities and architecture patterns. Real customer names and proprietary data are withheld.
The Problem
Traditional shared hosting environments often suffer from noisy-neighbour interference, opaque resource throttling, and cumbersome maintenance procedures. Conversely, managed enterprise cloud environments introduce excessive cognitive load, vendor lock-in, and unpredictable billing.
The requirements were clear:
- Predictable performance and resource boundaries for multiple small web applications.
- Automated SSL certificate issuance and renewal without downtime.
- Automated, verified daily backups shipped to secure off-site storage.
- Simple, reproducible server configuration managed via Git.
The Solution
We implemented a container-based Linux host architecture leveraging Docker Compose and an automated reverse proxy:
- Reverse Proxy & SSL: An Nginx reverse proxy container with automatic Let’s Encrypt ACME renewal managing ingress traffic, security headers, and HTTP/2 multiplexing.
- Container Isolation: Each application runs within dedicated Docker network namespaces with CPU and RAM quotas enforced at the container daemon level.
- Automated Backup Pipeline: A lightweight backup daemon dumps databases atomically, compresses assets, encrypts with AES-256-GCM, and syncs to remote S3-compatible cold storage.
Implementation Details
- Host Hardening: SSH key-only authentication, disabled root login, UFW firewall restrictions, and Fail2ban automated intrusion prevention.
- Log Rotation & Monitoring: Centralised systemd journald and Docker logging with automated log rotation to prevent disk exhaustion.
- Health Checks: Docker healthcheck directives coupled with external uptime probes ensuring immediate restart on container degradation.
Key Technologies
- Docker & Docker Compose: Container runtime, networking isolation, and declarative service manifests.
- Nginx: High-performance HTTP ingress, caching headers, and rate limiting.
- Linux (Debian/Ubuntu): Hardened kernel configuration, systemd service management.
- BorgBackup / Restic: Deduplicated and encrypted off-site backup storage.