- Applications and DBs run in docker containers. Deploying is basically git pull && docker-compose up --build -d

- Apt auto-upgrades, other software updates are handled in docker. The only software on the machine is haproxy, git and docker for deploys, newrelic and vector for monitoring.

- Haproxy runs on the server to route requests to docker containers. Cloudflare loadbalancing routes to servers.

- Scaling is avoided through over-provisioning cheap Hetzner machines. Adding new machines is done so rarely that a bash script is fine.

- DB backups are done in docker.

- Ufw locks down to ports 22, 80, 443, and DB ports. Because docker can interact with firewalls in surprising ways, I also replicate the rules in the Hetzner filewall.