Click-to-deploy: SSH-less Ansible delivery across 5 servers
I designed Riverbit's deployment platform: a GitLab pipeline where each environment tier (demo → dev → UAT → mini-prod → prod) is a column of one-click verify/deploy jobs. Ansible runs on each target server's own GitLab runner through a mounted Docker socket — so no SSH key ever lives in CI. Bootstrap (the only step that needs SSH) is deliberately laptop-only.
Deploys across 5 servers are on-demand, tag-pinned via committed per-host state files, serialized per host, and capture migration and smoke-test logs both on-host and as CI artifacts. A .NET terminal UI fronts every operation with confirmation gates on production hosts. The same repo bootstraps new hosts, registers runners, and installs monitoring agents — a new environment is a one-command affair.
Observability is self-hosted: Prometheus, Alertmanager, Grafana and Loki on a dedicated host, fed by agents on every server, reachable only through a secure tunnel with zero exposed ports, alerting to Slack. The database layer is a versioned TimescaleDB image whose configuration was tuned from a real production IO incident, with restore tooling that never touches the production database.
Project information
- Technology used: Ansible, GitLab CI/CD, Docker, Prometheus + Grafana + Loki, Cloudflare Tunnel, TimescaleDB
- Project goal: One-click, auditable deploys with no SSH keys in CI
- Date: 2025–2026
- Role: Engineering Manager / CTO