The story
CapRover on Docker Swarm with every product, every client site and every internal tool behind one proxy, each with its own subdomain and certificate. There is no separate ops team: I picked the provider, set up every app, own the DNS and certificates, and wrote the deploy rules my team and my agents follow.
Hard parts cleared
- Three kinds of workload behind one proxy: Swarm services, a self-hosted Supabase stack under systemd, and hand-started containers.
- The Docker engine is pinned and Swarm never silently re-pulls floating tags, so a database version cannot change under a running app.
- Audited 67 apps against what was really running and fixed 16 definitions so the stored config matched reality.
- Nightly verified database dumps, and weekly image pruning so 776 builds of one app do not fill the disk.
