Repository navigation
HintKeep@next Azure Container Instances Infrastructure
HintKeep aims to deliver secure, scalable, and production-grade hosting—without pricing out indie developers, startups, or personal projects. The core principles driving this are:
- 🧪 Simplicity: Caddy handles HTTPS and cert renewal seamlessly. No complex load balancers or managed gateways required.
- 📦 Lightweight Infra: Only essential services are provisioned—backend, TLS, DNS—avoiding costly extras.
- 🛠️ Reuse and Modularity: The same container, deploy, and DNS pipeline scales from local dev to production.
-
💸 Cost-Conscious Choices:
- ACR Basic tier keeps container registry costs below ~€5/month
- Free Netlify hosting (or extremely low cost) for static frontend deployments
- Azure Blob Storage for cert persistence—cheap, durable, and secure
By blending modern infrastructure best practices with a lean, open-core mindset, HintKeep ensures developers can ship fast, sleep well, and stay on budget—whether they’re crafting a side project or scaling a business.
| Container | Role |
|---|---|
| Caddy (Sidecar) | Handles HTTPS termination with automatic TLS via Let’s Encrypt |
| HintKeep Backend | Your main API/service logic—runs on an internal port, proxied by Caddy |
🛡️ TLS Storage:
- Caddy uses Azure Blob Storage as a persistent cert store
- Certs survive container restarts, enable multi-instance resilience
📁 Config Highlights:
- Caddy reads domain (e.g.
api.hintkeep.com) from environment config - Certificates automatically issued and renewed
- Managed with Bicep templates
-
.bicepparamfiles define environment-specific configuration - New or changed
.bicepparamtriggers environment provisioning (infra as code + GitOps)
| Trigger Type | Environment(s) | Behavior |
|---|---|---|
Push to main |
dev |
Auto-deploy latest build |
| Create GitHub Release | prod |
Triggers deployment using release tag (immutable) |
| Manual Dispatch |
preview, qa, etc |
Deploy any SHA/branch/tag via workflow input |
📦 Image Tagging:
- SHA-based:
hintkeep:<git-sha>for all builds - Env-tagged:
hintkeep:prod,hintkeep:devfor deployed versions
- Frontend deployed per environment, auto-assigned to:
-
dev.hintkeep.com,prod.hintkeep.com, etc.
-
- Custom domains assigned via Netlify CLI (
netlify domains:add) - Uses Netlify DNS for seamless SSL + subdomain config
- ACR Basic tier for storing backend images
- Tags: SHA + environment
- No versioned tags needed (SHA is source of truth)
- Automatically discovers which image is deployed (via
:dev,:prodtags) - Rotates secrets and pushes updated values to GitHub Secrets
- Deletes images that:
- Are only tagged with a SHA
- Are older than 90 days
- Retains environment-tagged images for rollback safety
| Capability | Benefit |
|---|---|
| Immutable Deploys | Every image and deploy is tied to a Git SHA |
| Semantic Rollbacks | Easy to redeploy a known-good version by SHA or release tag |
| TLS with Zero Effort | Caddy sidecar + Azure Blob equals stress-free HTTPS |
| Lean Registry Hygiene | Smart pruning keeps ACR tidy and low-cost |
| Declarative Infra | Add .bicepparam, get a new self-contained environment |
Heh, I hear you. 😅 You meant the previous full summary we crafted—not just the hosting philosophy one. Got it.
Let me stitch everything together—infra, DevOps, container strategy, hosting philosophy, and cost model—into one clean, comprehensive snapshot for HintKeep:
A high-quality, Git-powered hosting platform that’s lean, secure, and developer-budget friendly.
| Component | Role |
|---|---|
| HintKeep Backend | The core API app, internal-only port |
| Caddy (sidecar) | HTTPS reverse proxy with automated TLS via Let’s Encrypt |
🔐 Certificates:
- Managed by Caddy using Azure Blob Storage as a persistent backend
- Survive container restarts and scale events
- Configured via environment variables:
CADDY_STORAGE=azure AZURE_STORAGE_ACCOUNT=... AZURE_STORAGE_KEY=...
| Env | Trigger | Behavior |
|---|---|---|
dev |
Push to main
|
Automatic deployment |
prod |
GitHub Release created | Deploys tagged commit as immutable release |
preview, qa, etc |
workflow_dispatch |
Manual deploy with custom git ref |
- Each build is tagged with commit SHA
- Deployed image also tagged with its environment (e.g.
hintkeep:prod) - Enables traceability + environment lookup at any time
Included in a monthly scheduled pipeline:
-
🔐 SAS Tokens:
- Rotate per environment
- Uses the deployed environment image tag to map tokens precisely to the active version
-
🧼 ACR Cleanup:
- Deletes any image only tagged with a SHA that’s older than 90 days
- Keeps env-tagged and recently used images for rollbacks
- Hosted on
hintkeep.comwith env subdomains like:-
dev.hintkeep.com,preview.hintkeep.com, etc.
-
- Uses Netlify CLI for DNS + domain assignment
- Let’s Encrypt TLS auto-enabled by Netlify DNS
- Deployments are commit-anchored
- No version tags needed—SHA is source of truth
- Rollbacks are just new workflow runs with the target commit
| Service | Plan / Usage (North Europe region) | Estimated Cost (€/month) |
|---|---|---|
| Azure Container Registry | Basic Tier, 10 GB included | ~€5.00–6.50 |
| Azure Blob Storage | Hot Tier, for Caddy certs (<1 GB) | ~€0.02 |
| Azure Table Storage | 1–2 GB with moderate operations | ~€0.10–0.15 |
| Azure Container Instances | 1 vCPU + 1 GB RAM, running 24/7 | ~€23–25 |
| GitHub | Free Plan (Actions + Packages limits) | €0 |
| Netlify Hosting | Free Tier | €0 |
| Total | — | ~€28.50–31.70/month |
📅 Estimate captured on: July 5th, 2025, using Azure Pricing Calculator with default public pricing for North Europe and pay-as-you-go rates. Actual costs may vary based on usage patterns, currency fluctuations, or discounts.