Services

Infrastructure and DevSecOps

APIs, CI/CD, observability, security, migrations with a rollback plan.

This is the part a client never sees and notices on exactly the day it breaks: the server, the deploy, backups, access, logs, monitoring. The real request is almost never "set up Kubernetes" — it is "we do not know where production actually lives or who can take it down". So the work starts with an inventory: what is deployed, by whom, where the data physically sits, and what happens if it stops answering tomorrow. A frequent separate task is moving personal-data storage into a perimeter that satisfies Russian law 152-ФЗ.

What the work covers

Inventory: a map of what is deployed, where the data lives and who holds access
CI/CD: build, test and ship on commit, roll back with one command
Observability: logs, metrics, alerts — so an outage reaches you before it reaches your customers
Backups with a restore drill: a backup nobody has ever restored is not a backup, it is an assumption
Security: HTTPS and headers, CSP, access separation, secret rotation, closing direct database access
API design and implementation: contract, versioning, documentation that does not drift from the code
Migrations: changing hosting, moving data into a Russian-jurisdiction perimeter for 152-ФЗ, splitting a monolith that has fused — onto any platform that offers Linux and root, a self-managed VPS included

Who this fits

A fit: the product is in production and earning, while its infrastructure survives in one person's memory
A fit: you need an audit before taking a project over from the previous contractor — before signing, not after
A fit: you process Russian citizens' personal data and are not certain the storage satisfies 152-ФЗ
Not a fit: you need round-the-clock duty with a guaranteed night-time response window. The studio is one person; that guarantee cannot honestly be given
Not a fit: you need a formal compliance certificate. I put the system right technically; attestation and legal opinions belong to specialist firms
Not a fit: the brief is "make it cheaper" with no permission to touch the architecture that makes it expensive

Stack

Linux
Docker
Nginx
PostgreSQL
GitHub Actions
Prometheus
Grafana

What moves the price

Whether documentation and access exist — or the system has to be reconstructed from logs and someone else's code
How many environments are needed: production only, or production, staging and a preview per branch
The acceptable downtime window for a migration: a night-time pause costs materially less than a zero-downtime cutover
Data volume and coupling: moving a database under active writes is a project, not a checklist item
Compliance scope: 152-ФЗ, your internal security policy, the requirements your own client imposes on you
Whether an SLA is required: the contract commits to a two-hour response during working hours (Mon–Fri, 10:00–19:00 Moscow time). A round-the-clock window is not something a one-person studio will guarantee at any price

What you keep

An infrastructure diagram and a runbook: how to deploy, how to roll back, what to do during an incident — without calling me
Infrastructure as code in your repository: reproducible, not hand-assembled over SSH and forgotten
All access on your own accounts; mine is revoked in front of you when the work ends
A restore from backup performed together with you at least once, rather than ticked off as "configured"
Dashboards and alerts routed to your channels — email, Telegram

Packages

Bastion

DevSecOps

Infrastructure and hardening: deployment, backups, monitoring, a risk review.

from $10,000

Timeline: 3–6 weeks
Payment by stage: 40 / 40 / 20

Included

Containerised, reproducible deployment from a single command
CI/CD that runs the checks before anything reaches production
Backups, with restores actually tested rather than assumed
Monitoring, logs and incident alerting
A configuration and vulnerability review, reported in priority order

Not included

Round-the-clock on-call — that is Retainer
The cost of servers, licences and third-party services
Formal certification of a personal-data system and correspondence with the regulator
Application development itself

Discuss this package

Retainer

Ongoing

Ongoing support: a block of hours every month and an agreed response window.

from $2,000/mo

Timeline: minimum 3 months

Included

Twenty hours a month for fixes and development
Incident response within two working hours — weekdays, 10:00 to 19:00 Moscow time
Dependency updates and triage of new vulnerabilities
Backups watched, and restores tested
A monthly report: what was done and where the hours went

Not included

Rolling unused hours into the next month — the fee reserves capacity rather than buying a pack of hours; for one-off work there is Hour
Round-the-clock on-call
A new product from scratch — that is a project of its own
Hosting, licences and third-party services

Discuss this package

Hour

Ongoing

Hourly work: one task, a consultation, a review of someone else's code.

$120/hr

Timeline: minimum block 4 hours

Included

A four-hour minimum block
A time report describing what the hours went on
A review of existing code and infrastructure, with written findings
A consultation on architecture, on the stack, or on someone else's quote

Not included

A whole project — past a few days of work a package costs less
Scheduled on-call — that is Retainer
Availability on a given day without booking it in advance
Work that starts before the task is written down

Discuss this package

Discuss a project All services