Problem
Every project had its own server setup, its own deployment script and its own logging conventions. Each release briefly took the site down, and when an error came up, tracking down which server and which request it came from took hours.
PLATFORM
- Role
- DevOps architect
- Company
- Jekirdek Teknoloji
- Scope
- All products · test and production
- Infrastructure
- Hetzner · Docker · Traefik
- Observability
- Metrics · logs · traces
01Overview
Platform is the common ground under Jekirdek Teknoloji’s products. Every product starts from the same project template, is built and deployed by the same central workflows, and sends metrics, logs and traces to the same monitoring server. Connecting a project to the infrastructure takes nothing more than a two-line workflow file.
Solution
Hardened server types provisioned with a single command; centralized CI/CD that every project calls the same way; blue-green deployment where a new version takes no traffic until it passes its health check. A single agent on each server collects metrics, logs and traces and ships them to the central server; alerts are grouped and routed to Slack by severity.
02When something goes wrong
- 01
Slack
An alert arrives: the problem, the server and the first thing to do, all in one message.
- 02
Status
Which app, which server, since when; error rate and response time.
- 03
Logs
Error lines are filtered by level, project, service and environment.
- 04
Trace
Shows the step where the request got stuck, with timings layer by layer.
- 05
Fix
The fix ships through the same pipeline, or the previous version is restored without a rebuild.
- 06
Resolved
A resolution message lands in Slack, with how long the problem lasted filled in automatically.
03Highlights
01
Centralized CI/CD
Pre-releases go to the test environment automatically; promoting to production takes a deliberate approval. Images are stored by version, so rolling back needs no rebuild.
02
Zero-downtime releases
The new version starts up alongside the old one. If it passes the health check, traffic switches to it; if not, it’s removed and the old version keeps serving.
03
Three signals, one hub
A Grafana Alloy agent on every server collects metrics, logs and traces and sends them, encrypted and labeled by server, environment and project, to the monitoring server.
04
One click from log to trace
Requests are recorded with OpenTelemetry. From the trace ID in a log line you jump to the request’s entire journey, and from there to the metrics at that same moment.
05
The right alert, the right channel
Prometheus and Loki rules are grouped in Alertmanager; side effects are suppressed while the root cause is firing, and critical alerts and warnings go to separate channels.
06
Servers in one command
Application and monitoring servers are set up with a single re-runnable script, including key-based SSH, fail2ban, a firewall, automatic updates and encrypted backups.
04Screens and architecture
Grafana dashboards and diagrams of the infrastructure. Domain names, server names and database names on the status screen are hidden.
05Architecture
01Delivery and traffic
- CloudflareDNS · proxy · TLS
- Centralized CI/CDShared build and deploy workflows
- GHCRAn image for every release
02Application server
- TraefikLet’s Encrypt · health checks
- Product containersBlue and green copies
- DatabasesMySQL, PostgreSQL · schema per project
- CollectorLogs, metrics and traces
- BackupsEncrypted database dumps
03Monitoring and external services
- SentryApplication errors
- Monitoring serverPrometheus · Loki · Tempo · Grafana
- AlertmanagerRule-based alerts
- SlackAlert, resolution and deployment messages
- AWS S3Encrypted backups
A new version comes up next to the old one as the second color; Traefik sends it no traffic until it passes the health check, and once it does, the old color shuts down. Rolling back is just a redeploy with the old tag, no build needed. The collector on each server sends logs, metrics and traces to a separate monitoring server.
External service- Cloudflare → Traefik (HTTPS)
- Centralized CI/CD → GHCR (build)
- Centralized CI/CD → Product containers (deploy)
- GHCR → Product containers (image)
- Traefik → Product containers
- Product containers → Databases
- Product containers → Sentry
- Collector → Monitoring server (push)
- Monitoring server → Alertmanager
- Alertmanager → Slack
- Backups → AWS S3
06Technology
Infrastructure
Servers, networking and certificates
- Hetzner
Ubuntu
Docker
Traefik
Cloudflare- Let’s Encrypt
CI/CD
Central workflows and versioned images
GitHub Actions- GHCRContainer registry
- Blue-greenZero-downtime deployment
- SlackDeployment notifications
Observability
Metrics, logs, traces and alerts
Grafana
Prometheus- Loki
- Tempo
- Alloy
OpenTelemetry- Alertmanager
Sentry
Data & backup
Shared databases and encrypted backups
MySQL
PostgreSQL- resticEncrypted backups
AWS S3