#DevOps

The digital signature platform of the City Government of South Tangerang: signers prove who they are, sign PDFs to PAdES B-LTA with certificates from the platform's own authorities, and anyone can verify the result — version 2, which I designed, built and operate.

Release Workflow: Development to Production is the procedure every change of mine follows from my laptop to production — which steps I automated, which I deliberately left to a person, why each step sits where it does, how I diagnose a failed release, and how I recover from it.

cp -r drops owner, permissions and timestamps, producing copies that look right and fail in use. A 58-line rsync wrapper makes the destination truly equal to the source — and most of its lines are refusals, because making it equal means agreeing to delete.

A storage server that answers a connection only proves a process is listening. I check each capability separately — browser uploads via presigned URL, private buckets refusing strangers, large files through the proxy — before any application depends on it.

This Laravel app answers HTTP and runs long-lived queue workers, yet a container is meant for one program. A process manager, FrankenPHP worker mode and a cache-ordered build put both in one image, instead of building the same code twice.

Its software reached the end of support, and its records must outlive it. One component rewrote data as it read it, so the migration copies rather than converts — an operation with no rollback has to be survivable, not merely careful.

Staging and production shared 136 keys, but 21 had to stay different, including the one that decrypts years of data. Promoting a release's structure, not a file's contents, keeps that key in place and stops a schema migration from silently never running.

One rotation reaches seven services, and a value elsewhere can look exactly like one of their credentials, so search-and-replace could break an integration nobody watches. Working from an explicit list keeps the rotation inside its blast radius and away from the keys that only decrypt.

Three environments sharing one fixed domain name, separated at the socket rather than by name, with a banner on every environment except production — and live proxy config rendered from a template, never linked into a repository where a branch switch could rewrite it.

Point one environment's volumes at another's data and the restore succeeds, every health check passes, and the database is empty. Separating networks, state and runtime identity is what keeps three environments on one host from quietly erasing each other.