Immutable Production Platform
The production host behind a freight operator's core stack, defined entirely in Terraform and brought up by cloud-init with no manual configuration step. Compute is treated as replaceable, state lives on a volume of its own, ingress is accepted only from a CDN edge, and disaster recovery is a single rehearsed command.
Production
The host is disposable by design. Postgres and application state live on a separately provisioned volume that automounts on boot, so the instance can be destroyed and rebuilt without putting data at risk.
First boot is entirely declarative. cloud-init writes the backup script and the gateway compose file onto the machine, creates the shared proxy network, starts the reverse proxy, provisions swap as an out-of-memory buffer, and enables unattended security upgrades — a rebuilt host comes up already serving.
Provider image backups are deliberately switched off in favour of Restic snapshots pushed to offsite storage: encrypted, pruned to seven daily, four weekly, and six monthly, and fired at a webhook the moment a dump or a push fails.
Disaster recovery is a rehearsed path rather than a plan. One command pauses upstream services, pulls the latest snapshot, and restores both production databases together.
Ingress is edge-only. The cloud firewall accepts ports 80 and 443 solely from the CDN's published edge ranges, so no direct public route to the origin exists.
Day-two operations run through one task interface over Terraform and the remote host — plan, apply, shell, logs, backup, snapshot listing, rollback — so routine work never depends on remembering provider-specific commands.