When we tell you we can be live this week, we mean the setup is scripted and the rest is talking. Here’s what launch day actually looks like.
One command, ten steps
A new project server is built by one script in our operations repository. An engineer runs it and, over roughly thirty minutes, this happens in order:
- A fresh dedicated server is ordered from Hetzner.
- DNS records go into Cloudflare, for the server (proxied) and for Fastmail (DNS-only MX, SPF, DKIM and DMARC).
- The operating system is updated and locked down: a deploy user is added, root SSH is turned off, password login is turned off.
- Tailscale is installed and the server joins the Shipped tailnet. From here on, all admin access goes through Tailscale and public port 22 is closed.
- UFW, fail2ban and automatic security updates are set to our written defaults.
- Docker is installed.
- Kamal Proxy starts up and takes ports 80 and 443.
- Your app is deployed with Kamal and passes its first health check.
- Monitoring and the status page are wired up, with alerts going to the crew on call.
- Restic starts hourly backups of the important volumes to Backblaze B2, on a systemd timer with 3-2-1 retention.
Then a smoke test visits every public URL and reports what came back.
Why it’s scripted
Ask most agencies how long setup takes and you’ll get “we’ll send a timeline.” That’s not because they’re slow. It’s because every setup is hand-built, and hand-built work is slow, easy to get wrong and hard to keep consistent.
We went the other way. Every project starts from the same baseline, and the script is the record of what that baseline is. That gives you:
- Speed. A working server in under an hour, not a few weeks.
- Consistency. The first project and the fiftieth get the same security, the same backups and the same patch schedule. Nobody has to remember which server got skipped.
- Transparency. If you ask exactly what happens at launch, we can show you the script. It’s our logbook, and you’re welcome to read it.
The parts that need a person
The script covers most of the technical work. It doesn’t cover everything, and we’d rather say so:
- Creating Fastmail mailboxes. Individual inboxes are set up by hand in the Fastmail admin panel.
- First admin accounts in your app and tools. These belong to real people on your team, so we create them together.
- Clicking through as a real user. We test the main flows from a clean browser, ideally with someone from your side watching.
- Agreeing the details. Names, branding, who can access what, and who gets paged at night. None of that is a technical question.
These aren’t loose ends. They’re the parts that deserve a human’s attention. We automate the rest so there’s time for them.