Hands-on guide series
CI/CD on a Single VM: A Hands-On Guide
A five-part, hands-on guide to real CI/CD on one VPS: push-to-deploy with a git hook, a self-hosted webhook runner, a build to test to deploy pipeline where a red test blocks the release, secrets kept out of the repo and the logs, and a health-gated zero-downtime release with one-command rollback. Every command tested on a live Ubuntu 24.04 server.
What you will build
Security is layers, not a switch. Each part closes a different category of attack, from the automated sweep that finds a brand-new server, to the day one gets in anyway. Read them in order, or jump to what you need.
- 1
Push-to-Deploy with a Git HookSet up push to deploy on one slice with a bare git repo and a post-receive hook that checks out your code and restarts the app on every push.12 min - 2
A Self-Hosted CI RunnerRun a self-hosted runner on one slice: install webhook, register a build hook, and trigger a real build and deploy with a single authenticated POST.9 min - 3
A Build, Test and Deploy PipelineWire build, test and deploy into one pipeline where a failing test blocks the release, then watch a green run deploy the new version.8 min - 4
Secrets in CIHandle secrets in CI the safe way: a 600 env file outside the repo, a build that uses a token without printing it, and a scan proving nothing leaked.9 min - 5
Zero-Downtime Release and RollbackShip a zero-downtime release with symlinked releases, a health gate before the switch, and a one-command rollback that restores the previous version.10 min