CI/CD & Production Infrastructure for a Social App

Mon, 01 Jan 0001 00:00:00 +0000

Client

Puzzle Master — a social matching platform

Challenge

The startup had a production-ready Nest.js backend and Angular frontend, but zero infrastructure: deployments were manual, there was no CI/CD, no monitoring, no backups, and no separation between dev and prod environments. The goal was to build a complete DevOps stack from scratch before the public launch.

Solution

1. Application Containerization

Multi-stage Dockerfile for backend (Nest.js + Prisma, non-root user)
Multi-stage Dockerfile for frontend (Angular 12, legacy OpenSSL, Nginx for static assets)
Docker Compose full stack: PostgreSQL 15, Redis 7, imgproxy, Nginx
Healthchecks and depends_on for correct startup ordering
Isolated dev and prod environments in /opt/dev and /opt/prod

2. GitLab CI/CD

Migration of repository from Bitbucket to GitLab
Pipeline for backend and frontend: build → push → deploy
GitLab Container Registry for Docker image storage
Automatic deploy to dev on every push; manual trigger for prod
SSH deployment to VPS via SSH_PRIVATE_KEY

3. Nginx Reverse Proxy

Environment-agnostic config via envsubst for dev/prod parity
SSL/TLS (TLSv1.2, TLSv1.3) with Cloudflare certificates
Routing: /api/* → backend:4000, /* → frontend:80
www → root domain redirect (301)
Separate imgproxy stack with SSL termination

4. Security (Ansible)

Server hardening via Ansible: SSH key-only auth, root login disabled
UFW Firewall: only ports 80, 443, and custom SSH open
Database accessible only via SSH tunnel
All secrets stored in GitLab CI/CD variables

5. Monitoring

Prometheus + Grafana with automated dashboard provisioning
Exporters: Node, cAdvisor, Postgres, Redis, Nginx, Blackbox
5 Grafana dashboards: server, Docker containers, PostgreSQL, Redis, Nginx
Alertmanager with Slack/webhook integration; alerts on CPU/RAM/Disk/API/SSL

6. Database Backups

Automated pg_dump every hour
gzip compression and upload to S3-compatible object storage (Cloudflare R2)
Prometheus backup metrics: success status, size, timestamp
Alerts: DatabaseBackupMissing, DatabaseBackupFailed, DatabaseBackupSizeAnomaly

Technologies

GitLab CI

Docker

Ansible

Prometheus

Nginx

PostgreSQL

Results

✅ Deploy: git push to main → automatic build and deploy to server
✅ Environments: full dev/prod isolation on a single VPS
✅ Monitoring: 5 dashboards, alerts across 6 categories
✅ Backups: automated hourly pg_dump to Cloudflare R2
✅ Security: UFW, key-based SSH, database inaccessible from outside
✅ Scalability: architecture ready for database extraction to a dedicated server

WireGuard VPN Infrastructure

Mon, 01 Jan 0001 00:00:00 +0000

WireGuard VPN Infrastructure

Challenge

A distributed team of 15+ engineers working across multiple locations needed secure, low-latency access to internal corporate infrastructure — without relying on heavyweight legacy VPN appliances. The existing setup introduced significant overhead, was difficult to maintain, and caused frequent connectivity issues for remote employees. The goal was to replace it with a lightweight, self-hosted solution that is fast, auditable, and easy to scale.

Solution

1. Technology Selection

Protocol evaluation: OpenVPN, WireGuard, Outline
WireGuard chosen for its speed, simplicity, and modern cryptography
Docker for isolation and portability
Ansible for automated provisioning

2. Infrastructure

VPS hosted in a neutral jurisdiction (Netherlands)
Docker Compose for service orchestration
WireGuard running in a container
Nginx for the web management panel
Prometheus + Grafana for monitoring

3. Automation

# Ansible playbook for deployment
- name: Deploy WireGuard VPN
 hosts: vpn_servers
 roles:
 - docker
 - wireguard
 - monitoring
 - backup

4. Security

Automatic key rotation
Firewall rules (UFW)
Fail2ban for brute-force protection
ChaCha20-Poly1305 traffic encryption

5. Monitoring

Bandwidth and throughput metrics
Downtime alerts
Connection logging
Automatic restart on failure

Technologies

WireGuard

Docker

Ansible

Prometheus

Results

✅ Uptime: 99.8% over 6+ months of operation
✅ Speed: stable 100+ Mbps
✅ Access: OpenAI API, ChatGPT, GitHub Copilot, npm registry
✅ Deployment time: ~20 minutes per new server
✅ Users: 15+ developers with zero connectivity issues

Ansible on DevOps Engineer & CloudAdmin

CI/CD & Production Infrastructure for a Social App

Production Infrastructure & CI/CD for a Social App Launch

Client

Challenge

Solution

1. Application Containerization

2. GitLab CI/CD

3. Nginx Reverse Proxy

4. Security (Ansible)

5. Monitoring

6. Database Backups

Technologies

Results

WireGuard VPN Infrastructure

WireGuard VPN Infrastructure

Challenge

Solution

1. Technology Selection

2. Infrastructure

3. Automation

4. Security

5. Monitoring

Technologies

Results