
Spent the night moving Statbate internal infra from "services talking to each other over public IPs" to private WireGuard network.
5 servers, docker compose, k8s, clickhouse, redis, meilisearch, collectors, observability, github actions, configs, docs.
Tried to do it without hero big bang migration: compat layer first, extract hardcoded IPs, deploy safe configs, restart in batches, check everything after each step.
Took ~4h20m, looks healthy now.
Still feels crazy how much infra can slowly grow into public-ip spaghetti when you are just trying to ship product.
English














