HitDirector & WebHostNOC

Underneath it: containers and reverse-proxy routing on one tier, a traditional control-panel host on another, a CDN and web application firewall at the edge. Certificates renew themselves under a guardian that re-asserts them and starts complaining long before anything is close to expiring. Every site has its own uptime monitoring, with metrics, dashboards, and somewhere for an alert to actually go. And the self-healing responder and change protocol written up elsewhere on this site.

Backups are append-only to isolated offsite storage, with freshness, immutability and “the watchers are alive” as continuously asserted invariants rather than as a calendar reminder. Restore drills export metrics; a drill that stops running goes red.

Adding a site is a written, ordered procedure: placement, bootstrap, secret custody, DNS and edge configuration, monitoring registration, backup enrolment, and a security baseline. Every step has an assertion attached to it, so a half-onboarded site is visible rather than merely unlucky.

Patching is scheduled and automated with a canary, a captured baseline and a verify-no-change step, and the board that reports patch state links to the runbook it is actually governed by. Both under version control, because a script in git whose schedule lives only on disk is a rebuild that silently loses the automation.