Between shadow and light
The Client delivers two compiled React builds — a public site and a private administration panel. Around them, the Engineer raises a complete and living infrastructure: server, backend, database, DNS, VPN, and every thread that binds them. Nothing further is requested. Nothing less will be delivered.
The Client shall provide only the compiled artefacts — a production build of the website and a production build of the administration panel. No source code, no repository, and no design files shall be handed across.
Working blind to the source, the Engineer shall reconstruct a compatible backend from the observable behaviour of the build itself — its network calls, its routes, its data shapes. The engagement then provisions the Contabo VPS4, architects the DNS, forges the database, opens a private VPN tunnel, and binds every connection between the layers.
Upon completion, all credentials change hands. The Engineer retains nothing. No source crosses the table. No third party sees within.
Each layer carries its own duty, and the deployment succeeds only when every layer speaks to the next in its proper turn. The system is not the sum of its parts — it is the coherence between them.
The compiled React website and administration panel, served over HTTPS.
A compatible API, written to match the build's observable behaviour.
Schema, users, migrations, backups — the persistent truth.
Server, DNS, VPN, routing, and every operational service — wired as one.
Ten movements, played as one instrument. Each line below is a deliverable — itemised, priced, and upon completion, owned in full by the Client.
The Contabo VPS4 is commissioned. The operating system is installed and tuned; the firewall ruleset written; SSH access restricted to keys alone; intrusion prevention armed; and automatic security updates scheduled.
The root domain and all subdomains are mapped — public site, administration panel, API endpoint. Records are created, propagation verified, and TLS certificates issued and renewed without further intervention.
The compiled React build is served through a hardened reverse proxy — compressed, cached, and delivered over HTTPS with correct headers and secure fallback routing.
The administration build is placed upon its own restricted subdomain, shielded by authentication, IP-throttling, and rate limits — reachable only through the private tunnel.
A complete backend API is written to match the expectations of the compiled frontend — inferred endpoints, request shapes, session handling, token authentication, validation, and error contracts.
A schema is designed; the database and its least-privilege users created; migrations applied; indexes tuned; and encrypted backups scheduled with a documented path to restoration.
Frontend to backend, backend to database, administration to API, service to service — every connection is bound, secured, and monitored, so that nothing remains that hangs unsecured.
A private VPN is installed and configured upon the server. Keys are generated for the Client's devices, peer configurations delivered, and administrative surfaces locked behind the tunnel.
A deployment procedure is fixed; logs are aggregated; uptime and resource use are monitored; alerts are armed; and incident response is defined. The server is watched, not merely launched.
An encrypted secret store is commissioned; application and infrastructure keys are vaulted; a rotation policy is written; and the revocation procedure documented for the Client's team.
This engagement will lay bare credentials, databases, private endpoints, and operational knowledge. Every one of them is treated as confidential — held in confidence within this engagement, and beyond it, indefinitely.
All sums are stated in Euro (€). Each line is itemised without inflation and reflects labour genuinely performed. The reduction below is not a concealed markup — it is a reduction given freely.
| # | Deliverable | Scope note | Amount |
|---|---|---|---|
| 01 | Server Provisioning & Hardening | Contabo VPS4 · OS · firewall · SSH | €12.00 |
| 02 | DNS Architecture & Subdomain Routing | root · www · admin · api · TLS | €9.00 |
| 03 | Website Static Build Deployment | React build · proxy · HTTPS | €10.00 |
| 04 | Admin Panel Deployment | restricted subdomain · auth gate | €10.00 |
| 05 | Backend Construction & Setup | API · auth · endpoints · validation | €18.00 |
| 06 | Database Creation, Setup & Handling | schema · users · backups | €12.00 |
| 07 | Connections, Integration & Wiring | frontend ↔ backend ↔ database | €8.00 |
| 08 | VPN Setup on Server | tunnel · keys · peers · access | €10.00 |
| 09 | DevOps, Monitoring & Maintenance | deploys · logs · alerts · uptime | €9.44 |
| 10 | Secrets & Key Management | vault · rotation · revocation · audit | €5.00 |
| Subtotal — full rate | €103.44 | ||
| Applied discount Colleague · Associate · Returning client | − €35.00 | ||
Only compiled and static builds of the website and administration panel shall be provided. The original application source code is not included, and shall not be requested.
The Engineer may inspect the supplied build and its observable behaviour in order to determine and implement the compatible backend and infrastructure requirements.
Any requirement that cannot reasonably be determined from the build, its documentation, available credentials, or information provided by the Client may require further clarification or separately agreed work.
Domain registration, hosting charges, external APIs, licences, paid services, and provider-side costs remain separate, unless explicitly included in the scope above.
The Client authorises the Engineer to access and configure the relevant infrastructure and confirms the right to grant such access.
The Client retains ownership and control of all third-party credentials and should rotate privileged credentials when appropriate, once the engagement has concluded.
Unless separately agreed, independent backups of important production data, application materials, and account information remain the responsibility of the Client.
Material changes to requirements, additional features, unrelated systems administration, and substantial redevelopment are outside the defined scope, and may be agreed separately.
The engagement reaches substantial completion when the agreed infrastructure components are configured and the supplied builds are deployed — subject to external dependencies and technical compatibility.
Non-public credentials, infrastructure information, application data, databases, and commercial terms exchanged for this engagement are treated as confidential — indefinitely.
In signing below, both parties accept every term set out in Worlds I through VI of this deed. The work commences the moment the builds arrive.