The club’s server administration

Context

The club’s applications used to live on shared hosting and managed platforms. I set up a virtual private server (VPS), managed with Coolify, which now hosts the website, the tournament app, the volunteer schedule, the match predictions and a few personal projects.

Everything is versioned in a private repository, and I publish no address, no credential and no network detail here.

What I did

• Deployments described as code. The Coolify resources are declared in the repository, which is the source of truth. The sync tool deletes nothing and reads no secret.
• A hardened server. While installing it, I found that Docker bypassed the host firewall, IPv6 included. I fixed it the next day with dedicated rules, backed by a firewall on the hosting provider’s side.
• Encrypted backups, kept off the server. Archives are encrypted with age, and the private key doesn’t stay on the server: even if it were compromised, it couldn’t read them. I keep them for 30 days, and I tested a restore, which worked.
• Nightly checks: DNS, drift between Coolify and the repository, site status, certificates, disk, backup freshness. Alerts arrive by email, with a weekly report.
• External monitoring on top of the server’s own alerts: a server that is down can’t tell you it’s down.

What I take from it

The day I switched the website to the new server, I changed the DNS before the proxy knew the domain: about ten minutes of downtime. Since then, the order is written into the procedure: proxy first, DNS after.