Bastion: a hardened self-hosted app fleet

The problem

The default answer to “where do we run this” has become a stack of cloud subscriptions, each billing monthly, each holding a slice of your data, each a separate security story. For a fleet of internal tools and products, that is rented complexity. The alternative everyone warns you about, self-hosting, fails in practice for one reason: it is usually done as a hobby, not as operations.

What we built

A production-grade platform on owned hardware, operated like it matters. Every application deploys the same way and inherits the same security and observability baseline:

• One front door. A Traefik reverse proxy terminates TLS for every app with automatic Let’s Encrypt issuance and renewal, HSTS, security headers and rate limiting applied fleet-wide by middleware, not per-app goodwill.
• Defense in depth. Key-only SSH with fail2ban jails, a Telegram-code 2FA gateway in front of admin surfaces, per-app network isolation so databases are never reachable from the proxy network, and secrets confined to per-app env files.
• Monitoring that assumes failure. Three independent layers: host metrics with alerting, black-box uptime checks on every service, and a security monitor sweeping for brute-force attempts, resource exhaustion and dead containers every five minutes. Everything escalates to Telegram within moments.
• Deploys as a pattern, not an art. Each app is a git repo with a compose file and a production overlay. Deployment is pull, build, up. The pattern is documented well enough that an AI agent executes it unassisted.

Outcome

Measured 99.9% uptime, monthly hosting cost near the electricity bill, and a compounding asset: every new product launches into an environment where TLS, auth, monitoring and backups already exist. This fleet is also our proof of competence: when we say “we will deploy and operate it”, this is what operation means.