From shared server passwords to new projects live in 30 minutes

access & security

Replaced password logins with key-based (PEM) SSH, allowed only from approved IP addresses. Defined roles and permissions for admins and developers, down to who could see PM2 processes. Added UFW, security groups, fail2ban, closed unused ports and a regular patching schedule. When someone left, credentials were rotated immediately.

standard setups

Reusable templates for Apache sites and subdomains, PM2 apps and Go binary deployments, all behind Let's Encrypt SSL with DNS on Cloudflare. Separate PM2 run modes for development and production builds, and servers tuned so RAM and disk were used efficiently.

client infrastructure

Provisioned AWS EC2 and GCP VMs to each client's requirements, with separate read and write database roles, read replicas and a Redis/Valkey caching layer. Docker for many of the services.

automation & visibility

CI/CD pipelines in GitHub Actions, GitLab CI and Jenkins for dev, staging and production, plus a scripted release process for PM2 apps. Make-based recipes and Bash scripts for setup, and backup/restore templates storing to local disk or AWS/GCP buckets. Loki and Grafana for logs, metrics and analytics.

Marketing newsletters and product campaigns were sent straight from the application, which talked directly to the database. During large sends, the database or the Apache server regularly went down.

Debugging showed it wasn't a bug but volume: every send created load the database couldn't absorb. That traffic had to be moved off the database.

Redirected the high-volume traffic to a Redis/Valkey caching layer and built a queue with worker processes in front of SendGrid, with batching, rate limiting and automatic retries for failed sends.

10,000 emails sent in about 5 minutes. The servers stayed up through campaigns, and email tracking kept working.