DevOps & Cloud Infrastructure
Deploys that stop being an event
We build the pipelines, environments and monitoring that let a small team release without a ceremony, including taking over infrastructure another team set up and no longer maintains.
Talk to us about your projectThe part of the work nobody demos
Infrastructure only gets attention when it breaks. The rest of the time it is a deploy script one person understands, a staging environment that drifted from production long ago, and a monthly bill nobody can explain. None of it shows up in a feature review.
The work is unglamorous and mostly one-off. Once the pipeline runs, the environments are defined in code and the alerts point at real failures, it stays fixed — which is why we sell this as a project with an end rather than a permanent seat on your team.
Capabilities
What we set up
Picked per system. A five-person team running one service and a company running forty need different answers, and applying the same platform template to both is how a simple deploy ends up needing a specialist.
CI/CD pipelines
A single pipeline in GitHub Actions or GitLab CI that runs the tests, builds the image and deploys, with one approval step before production.
Cloud environment setup
Separate development, staging and production accounts on AWS, GCP or Azure, defined in Terraform so a new environment is a file change rather than a week.
Containerisation
Your application packaged as a Docker image that runs the same on a laptop and in production, orchestrated with ECS, Kubernetes or plain Compose depending on scale.
Monitoring and observability
Metrics, logs and traces in one place, on Grafana, Datadog or CloudWatch, with a dashboard that answers whether the last deploy made things worse.
Alerting and on-call
Alerts tied to something a user would notice, routed to PagerDuty or Slack, with the noisy ones deleted rather than muted.
Cloud cost reduction
We read the bill line by line, then do the unglamorous fixes — right-sized instances, orphaned volumes deleted, and a budget alert that fires before the invoice does.
Secrets and access control
Credentials out of the repository and into Secrets Manager or Vault, with a written list of who can reach production and how that access is revoked.
Backups and recovery
Automated backups are the easy half. We restore one into a scratch environment and time it, because an untested backup is a belief, not a plan.
Taking over existing infrastructure
We document what is actually running before changing anything, including the server nobody can account for, then hand you a diagram that matches reality.
What you get
What you own at the end
Every engagement ends with things you can hand to another team, including the parts that are only useful during an incident.
- PIPELINE
- A deploy anyone can run
- The CI/CD configuration lives in your repository, in your accounts, under your version control. If we stopped tomorrow your team runs the same command, and nothing about the release changes.
- INFRASTRUCTURE AS CODE
- Environments defined in files
- Terraform or Pulumi describing every resource, so rebuilding staging is a command rather than an archaeology project. It doubles as the honest inventory of what you are paying for each month.
- RUNBOOK
- What to do when it breaks
- Written steps for a failed deploy, a full disk, or a database refusing connections. Named owners, the rollback command, and what to check first before anyone starts guessing.
- COST BASELINE
- Where the money goes
- A breakdown of the bill by service and environment, the changes we made, and the ones we recommended against because the saving was not worth the added fragility.
How we work
From audit to a system you can run
Timelines below are typical. If the audit says the sensible fix is smaller than the project you asked for, we will tell you that before you sign anything.
Audit
3–5 daysWe map what is running now, how a change reaches production today, and what the bill is actually spent on. Read-only access is enough for this.
Plan and prioritise
1 weekA written plan ordered so the most risk comes off first. Sometimes this ends in a short fix rather than a project, and we would rather say so here.
Build
3–6 weeksPipelines, environments, containers, monitoring and the cost work, shipped in reviewable pieces. Nothing cuts over to production until the rollback has been tested.
Handover
1–2 weeksWe walk your team through the pipeline, the runbook and the alerts, then either step back entirely or stay available at an agreed level.
Is this the right service for you?
Worth reading before you get in touch — it saves both of us a call.
A good fit if…
- Deploys are manual, or only one person knows how to do them
- You inherited infrastructure from a previous team, contractor or agency
- The cloud bill keeps growing and nobody can explain the line items
- You hear about outages from customers rather than from an alert
Probably not, if…
- The application itself still needs building — see Web & SaaS Platform Development
- You want a managed service with a signed uptime SLA and 24/7 cover
- The real problem is reporting and data flow — see Data Engineering & Analytics
- You are pre-launch with no users yet, where MVP Development for Startups fits better
Frequently Asked
Questions
Common questions about pipelines, environments, monitoring, and what a cloud bill is actually spent on.
Mostly the number of environments and services, and how much of the current setup is documented. One application deploying to one cloud account is straightforward work. Twelve services across two providers, with credentials in a spreadsheet and a server nobody can account for, is a different project entirely. Compliance requirements add time, because access control and audit logging have to be designed rather than switched on. We audit first and quote against what we actually find, not against what the brief assumed was there.
The audit takes a few days and usually surfaces something worth fixing in the first week, often a cost item or an alert that has never fired. A working pipeline for one service typically lands within the first two to three weeks. The full build runs three to six weeks after planning, depending on how many environments and services are involved. We ship in pieces rather than switching everything over on a single day, so you see progress continuously instead of at the end.
You do, throughout. Everything is built in your cloud accounts under your billing, and the Terraform, pipeline configuration and runbooks live in your repositories. We work through access you grant and can revoke at any point, and we hold nothing in an account of ours that you would later have to ask us for. At the end there is a walkthrough with your team so the knowledge does not leave when we do. If you change vendors, nothing about the setup has to change.
We assume it will happen at some point, so the rollback is tested before the first cut-over rather than during the incident. Changes reach staging first and go to production behind an approval step, which means a bad release is reverted with the same command every time. When something does break you get the timeline, the cause and the specific fix in writing. We would rather tell you we caused an outage than let you work it out from a dashboard.
We will not put a number on it before reading the bill, because anyone who does is guessing. What we can say is where the savings usually come from: idle and oversized instances, storage and snapshots nobody deletes, data transfer between regions, and on-demand pricing where a commitment would do. Some of it is a one-off cleanup, and some of it changes how you deploy. We also flag the savings we advise against, where the cheaper option makes an outage more likely.
That is a large part of this service. We start by documenting what is genuinely running, which is rarely what the previous team's diagram says, and we change nothing until that is done. Where the existing setup is reasonable we keep it and fix the gaps around it. Where it is not, we say so and price the rebuild separately rather than folding it in quietly. Handovers from an agency that has already left are common, and the missing credentials are usually the slow part.
Have a project in mind?
Fixed price after a paid discovery — no hourly billing. A real engineer reads every enquiry, and we reply within 24 hours.