TL;DR: How much effort is required to self-manage a low-traffic SaaS app? Is PCI / SOC2 compliance too much of a hassle?
Currently we are using GCP. Our infrastructure is straightforward: A load-balanced SaaS, Postgres instance, and Memcache instance. We have two copies of this for our production and QA environments. Our site is very low traffic. We are also required to be PCI and SOC2 compliant.
Now, I have some gripes with GCP which I won't get into. I'm also the type of person who is always pushing for the simpler solution. I like to know how things work so that if it stops working I know exactly how to fix it.
With that, it shouldn't come as a surprise to know that I prefer to work with providers like Linode.
When I approached my boss with a plan to migrate to another provider it was immediately shot down. Also not a surprise; we are a small company and time spent improving infrastructure means time not spent on feature development. The main reasons cited were that it would take too long, there would be too much maintenance, it would be a disaster if I left the company, we would have to be audited again, etc.
I deemed that an uphill battle not worth fighting for, but it got me thinking how much maintenance effort is actually required.
My plan was to setup a small Docker Swarm cluster for each environment. Kubernetes is an option but I find it's way overkill for our use-case and has a steep learning curve.
Setting up the initial server(s) takes a day or two, but once you have a server image or setup script, adding new ones takes a matter of minutes. I wouldn't expect regular maintenance to be any more than upgrading system packages.
Are my expectations for maintenance effort realistic? No matter how I look at it this doesn't seem like a complicated endeavor.
it got me thinking how much maintenance effort is actually required.Apparently a lot. However in my experience, most of this "maintenance" is going back and redoing years of huge mistakes in implementation. Networking in particular is always the most problematic from a security perspective during any such transition.