I do something similar:

- GCP VM with “Google Container OS”.

- “Cloud init” config set on the VM metadata (can easily recreate the VM; no snowflake config via SSH mutations).

- My service runs in a docker container, reads/writes to a SQLite file on the host disk.

- GCP incrementally snapshots the disk every hour or so, and makes copies to different region. Any disk writes are copied instantly to another zone.

- Lets encrypt cert is read from the host disk and the docker container serves HTTPS directly (no proxy). Certificate is renewed with the LE CLI.

- The service logs to standard out, this is collected by the Google logs daemon which I can view with the web UI.

- Google have their own HTTP uptime monitoring and alerting which sends you an SMS.