// case study 04
From hand-built servers to multi-country infrastructure, entirely as code
The situation
A fintech company ran its platform on servers built by hand. Changes were made over SSH from a terminal and files were copied up with scp, so nobody could say exactly how a server was configured or rebuild one with confidence. On top of that, different countries had their own data-residency requirements, which meant running the same platform in more than one place.
Build, then configure
The same code builds every environment. Only the variables change.
What changed
everything as code
Replaced hand-built servers with OpenTofu for cloud resources and Ansible for configuration, all in Git. Every change is previewed and reviewed before it's applied, and either phase can be re-run safely.
one role per server
Each environment runs four VMs: a Caddy gateway, the Go app, PostgreSQL and a monitoring server. A failure in one doesn't cascade, and each is sized for its own job.
data residency
Met different countries' data-residency requirements by running the platform both on GCP and on on-premises servers, configured by the same Ansible playbooks, so every location behaves the same.
security built in
SSH only over a Tailscale mesh VPN, explicit firewall allow-lists at both cloud and server level, Cloudflare in front with strict TLS, secrets in GCP Secret Manager and least-privilege service accounts.
release engineering
Every release is built once, versioned and published immutably, and the exact same artifact goes to dev and production. Quality gates and vulnerability scans run first, database migrations are tested before they ship, and a failed health check rolls the deploy back.
backups & visibility
Two independent database backups: continuous WAL-G backups with 30-day point-in-time recovery, plus daily pg_dump. Prometheus, Loki and Grafana on every environment, so nobody needs to SSH in to know what's happening.
Results
- Faster deployments, run with one command instead of SSH and scp
- Confident releases: what was tested is exactly what ships
- Improved uptime, with problems visible on dashboards before customers notice
- Passed compliance requirements, including data residency across countries
Stack
Client details are anonymized to protect confidentiality.