Every game, web app, and SaaS prototype on this site is deployed by one person to a self-operated production cluster. This page describes the platform that makes that sustainable.
Production runs on a single Hetzner VPS with K3s + Traefik + cert-manager. A second mirrored K3s cluster on a staging laptop, reachable over WireGuard, is a true pre-production environment — same container images, same Kubernetes manifests, same observability stack. Differs only in hostnames and certificates.
manage.sh deploy <service> builds, pushes, digest-pins, and rolls out to both clusters. The git manifest, the server manifest, and the running pod always show the same SHA.
manage.sh sync diffs every deployment, ConfigMap, secret, and ingress between staging and production. Zero-drift is the default state, not the goal.
Self-hosted Docker registry with htpasswd auth. Every push is content-addressed; rollbacks are a single kubectl set image away.
Encrypted, round-trip-tested backups synced nightly to a second machine. Bootstrap from bare metal is two commands.
The cost of solo-operating this many services is paid by automation: end-to-end tests run nightly inside the cluster against production, results land in my inbox before 7am.
Playwright suite runs from inside each cluster every night at 04:00 UTC. Sidesteps every dev-machine networking limitation. Reports upload to in-cluster object storage; summary emails go out automatically.
Every deployed web app gets a smoke probe against production every morning. Failures email me a paste-block with enough context to triage without opening a browser.
A single email at 06:30 UTC summarizes cluster health, last night's E2E pass/fail, alert state, cluster-parity drift, and overdue credentials.
Lint, unit tests, security audits, and YAGNI dead-code checks all run via shared local infrastructure with a feedback loop — no commit is shipped without them green.
Prometheus + Grafana + Loki stack, deployed via the standard kube-prometheus-stack chart. Dashboards are provisioned from version-controlled ConfigMaps — including custom ones for E2E canary activity, cluster-parity diffs, and the live cron schedule.
canary_http_requests_total counter lets dashboards exclude E2E noise from SLO panels.A YAML credential inventory tracks every secret in the stack — DB passwords, API keys, Keycloak admin, NuGet publish tokens, mailbox passwords, infrastructure SSH. Each has a rotation cadence and an executable rotation command. A weekly cron emails when anything is overdue.
The platform is intentionally one person's responsibility. Every choice — single-command deploys, mirrored clusters, automated daily reports, executable runbooks — exists because there is no on-call rotation to absorb operational friction. Engineering decisions optimize for "future me, at 6am, with no context" rather than for a team that doesn't exist.
The result: prod uptime is high enough that I haven't been paged at night in months. New services ship in an afternoon. When something does break, the daily report tells me about it before I open my laptop.