What server administration includes
We agree on the scope for your project. You can take a single item, say just monitoring, or all of it.
Server setup
I prepare a new server so it can be rebuilt: the configuration lives in Ansible, not in someone's head.
- ✓plan and distribution sized for the load
- ✓users, SSH keys, sudo
- ✓time zone, limits, swap, kernel parameters
- ✓automatic security updates
Web server administration
I tune the web server for your application and find where response time is lost.
- ✓nginx or Caddy, HTTPS with automatic certificate renewal
- ✓PHP-FPM, Node.js, Python, Go behind a reverse proxy
- ✓caching, compression, rate limits
- ✓slow responses traced through logs and metrics
Databases
I make sure the database doesn't eat the whole server and isn't lost in a failure.
- ✓PostgreSQL, MySQL, Redis, ClickHouse
- ✓memory and connection settings for your data size
- ✓slow query analysis
- ✓a replica or regular dump to external storage
Network and firewall
From outside, only what customers need should be visible. Everything else is reachable by the team over VPN.
- ✓nftables or iptables rules
- ✓IPv4 and IPv6, routing between servers
- ✓WireGuard for the team and site-to-site links
- ✓external open port checks
Monitoring and alerts
I keep a history of the load to catch problems before they become outages and to know when it's time to upgrade.
- ✓CPU, memory, disks, network, traffic
- ✓external availability of the site and API
- ✓certificate expiry and disk space
- ✓Telegram alerts written in plain language
Updates and security
Small projects are usually breached through outdated software and passwords. I close those doors first.
- ✓scheduled system and package updates
- ✓key-only login, no root over SSH
- ✓fail2ban against brute force
- ✓review of users and access
Backups
A backup that has never been restored can't be trusted. That's why I test restores regularly.
- ✓daily copies of databases and files
- ✓stored off the server, in S3 or another location
- ✓encryption and retention periods
- ✓scheduled restore tests
Migration
I move projects between providers so that users don't notice the move.
- ✓to another VPS or dedicated server
- ✓between clouds: AWS, Hetzner and others
- ✓data sync and DNS switchover
- ✓a rollback plan in case something goes wrong
Server administration pricing
Fixed rates. Work outside the support plan is estimated and agreed in advance.
| Format | Price | What's included |
|---|---|---|
| Server audit | from $230 | load, security, updates, backups; a report with a list of fixes |
| Support | $250/month | watching alerts, disks, certificates and backups, incident response |
| One-off tasks | $35/hour | setup, migration, speed-ups, incident investigation |
Example estimates
| Task | Estimate |
|---|---|
| Initial setup of a new VPS: hardening, firewall, monitoring, backups | 3-5 hours |
| Find out why the site is slow and fix it | 2-6 hours |
| Move a site with its database to another server | 3-8 hours |
| Upgrade the distribution to a new release | 2-4 hours |
How we work
- 1
Access
You add my public SSH key to the server with one command. No passwords to share, and access is revoked by removing a line from
~/.ssh/authorized_keys.curl -s https://manyahin.com/id_ed25519_manyahin.pub >> ~/.ssh/authorized_keys - 2
Inventory
I write down what runs, which ports are open, where the data lives and when the server was last updated.
- 3
Urgent fixes
First I close whatever can take the service down or leak data: backups, exposed databases, password logins.
- 4
Monitoring
I set up metrics and alerts. From then on decisions are based on graphs, not gut feeling.
- 5
Support
If needed, I stay on support: scheduled updates, alert response, reports on what was done.
Common problems
The site is slow, but the load is low
Usually it isn't the hardware but database or web server settings, or a single heavy query. I find the bottleneck from metrics, not by guessing.
The server went down at night and nobody noticed
Without monitoring, downtime lasts until the first customer complaint. A Telegram alert cuts it to minutes.
The server hasn't been updated in years
An old distribution, open ports, password logins. I update it on a plan, with a backup and a way back.
Only one person knew how it all worked
The developer who set up the server has left. I rebuild the picture and describe the configuration in code, so you no longer depend on one person.
What to do when a server goes down
A sequence that saves time in any outage, even if you fix it yourself:
- Check whether the server responds at all:
pingand SSH. If not, open the console in your provider's panel to see whether it hung or is powered off. - Check disk space:
df -h. A full disk is the most common reason why "everything broke by itself". - Check memory and processes (
free -m,top) and whether the kernel killed the database for lack of memory:dmesg | grep -i oom. - Look at failed services and recent errors:
systemctl --failedandjournalctl -p err -b. - Save the logs before rebooting: after a reboot the cause is much harder to find.
If the cause isn't obvious or the outage repeats, message me: I'll go through the logs and metrics and make sure it doesn't happen again.
Minimum server hardening on day one
This list stops most automated attacks that hit any public IP within hours:
- SSH login with keys only, passwords and root login disabled
- firewall: only 80, 443 and SSH open, everything else closed
- automatic security updates
- fail2ban or similar against brute force
- databases and admin panels not listening on the public interface
- backups configured before any data lands on the server
Technologies
- OS
- DebianUbuntuRHELRocky LinuxAstra Linux
- Web and databases
- nginxCaddyPostgreSQLMySQLRedisClickHouse
- Network
- nftablesiptablesWireGuardIPv6
- Monitoring
- PrometheusGrafanaLokisareBPF
- Automation
- AnsibleTerraformBash
- Backups
- resticS3pg_dump
Case studies
IPTV service: 100 TB of traffic a month
The service ran on oversized hardware, its configuration lived only on the servers, and subscribers were the ones reporting outages.
Picked a server for the actual load and moved the service, described the streaming nodes in Ansible, closed ports and switched to key-only login, set up daily backups and Telegram alerts.
ML platform: from home servers to the cloud
The platform ran on three home servers, and the client needed fault-tolerant infrastructure and updates delivered into their isolated network.
Moved the services to the cloud, set up delivery into the isolated network via VPN and a Git mirror, added metrics with alerts to the team chat and S3 backups with restore tests.
Why work with me
One engineer, no managers
You talk to the person who works on your server. No need to explain the task to three people.
Pay for work, not for headcount
A small project doesn't need a 24/7 on-call team. You pay for support and for specific tasks.
Everything stays with you
Access, configuration in Git and documentation belong to you. You can leave any day without losing anything.
I understand the application
I wrote code for many years, so I can tell whether the problem is in the server or in the application itself.
Frequently asked questions
What does server administration include? +
System and package updates, security and firewall, monitoring and alerts, backups, incident and performance investigation. We agree on the exact scope for your project.
How much does server support cost? +
Support is $250 a month: alerts, disks, certificates, backups and incident response. Work beyond that is billed at $35/hour. A one-off audit starts at $230.
Do you support on-premise office servers? +
No, I work remotely only: VPS, dedicated servers, clouds. Office infrastructure (Active Directory, printers, on-site visits) is better handled by a local IT technician.
Which distributions do you work with? +
Debian, Ubuntu, RHEL and compatible Rocky Linux and AlmaLinux, Astra Linux. Other popular distributions too.
Can a server be protected from DDoS attacks? +
A firewall, nginx rate limits and fail2ban handle simple attacks and brute force. Serious attacks need an external traffic filtering service; I'll help choose and connect one.
What access do you need? +
SSH access with a key and sudo rights. My public key is on this site, linked at the bottom of the page, so no passwords are shared. Access is revoked by removing the key at any time. I log every change so you can see what was done and why.
Send a request
Describe briefly where the server is, what runs on it and what worries you. I'll tell you where I would start.