Who it is for
A startup or agency that deploys by SSH, FTP or a script on one person's laptop: no tests before a deploy, no rollback plan, and nobody wants to deploy on a Friday.
The problem
- Manual deploys are slow, inconsistent and depend on one person being available.
- With no scan or signature, nobody can say exactly what is running in production.
- A broken release means downtime until someone notices and fixes it by hand.
What I do
- Dockerfiles and a docker compose setup for local development.
- GitHub Actions: tests, lint, image build, vulnerability scan, SBOM and a keyless cosign signature.
- Terraform for ECS Fargate (or EC2), the load balancer, the database and alarms, with AWS access through OIDC.
- Rolling deployments with health checks and the ECS circuit breaker, plus a one-command rollback.
How it works
- 1git push
- 2CI: tests and scans
- 3Build, scan, SBOM, sign
- 4Verify signature, deploy by digest
- 5Health checks, automatic rollback
- 6Alarms and runbook
Day by day
- Day 1-2Dockerfiles and local compose; the app runs the same everywhere.
- Day 3-4CI on every pull request: tests, lint, build, scans.
- Day 5-7Terraform for the infrastructure in your account; OIDC deploy role.
- Day 8-9Deploy pipeline with signature check; we break a release on purpose and watch it roll back.
- Day 10README, runbook and a recorded handover.
Evidence from the demo
The evidence below comes from my own demo project with synthetic data. It shows exactly what you receive; it is not a story about a client.
- ShipIt (a link shortener: Go API, Python worker, PostgreSQL, Redis) runs on ECS Fargate for about $0.10 an hour, only during demos.
- break-it deploys a release that fails its health checks: the circuit breaker rolls it back while a probe shows users saw no errors.
- Images are built only in CI, scanned with Trivy, signed with cosign and verified before every deploy.
Demo project: ShipIt Platform
What you keep
- Dockerfiles and compose
- CI/CD workflows
- Terraform for your infrastructure
- Runbook and a handover video
Not included
- Changes to application code beyond what containerising needs
- 24/7 support
Questions
Do you need access to my production systems?
No passwords, ever. Audits use a read-only role you create and can delete at any time; changes arrive as a pull request you review and merge yourself.
How long does a project take?
2 to 10 working days depending on the package. You get the timeline and the fixed price before we start.
What if you find nothing worth fixing?
Then you hear that early, with the evidence. For the AWS Bill Doctor on accounts above $1,000 a month: if I don't find at least my fee in yearly savings, you don't pay.
What happens to my data?
Reports stay between us. When the project ends I delete your data and confirm it in writing.
How do I pay?
Upwork, international bank transfer, or UPI / bank transfer in India. Direct clients pay 50% upfront and 50% on delivery.