Crafting a Maintainable DigitalOcean VM for Your Agency

Running an agency means juggling multiple client projects. You need an infrastructure that is cost-effective, easy to manage, and robust enough to handle production workloads.

While PaaS solutions like Vercel or Heroku are great, the costs can skyrocket as you scale. Managing your own VPS on DigitalOcean offers the best balance of price and performance—if you set it up correctly.

In this guide, we'll walk through building a maintainable "Agency Box" using DigitalOcean and Dokploy, an open-source alternative to Vercel/Heroku.

1. Provisioning the Droplet

Start by creating a Droplet on DigitalOcean. For most agency workloads, a Basic Droplet with Premium Intel/AMD NVMe SSDs is the sweet spot.

OS: Ubuntu 24.04 LTS (Always choose the latest LTS for long-term support)
Size: 2GB RAM / 1 CPU is a good starting point (~$12/mo). You can resize later.
Authentication: SSH Keys are mandatory. Do not use password authentication.

Pro Tip

Enable Backups immediately during creation. It costs 20% extra but saves you hours of panic when things go wrong.

2. Setting up Dokploy

Dokploy simplifies the deployment process, giving you a nice UI to manage applications, databases, and traefik (reverse proxy).

SSH into your new server:

Loading code...

Install Docker and Dokploy with their installation script:

Loading code...

Once installed, navigate to http://your-server-ip:3000 to create your admin account.

Why Dokploy?

Git Integration: Push to GitHub/GitLab, and it auto-deploys.
Built-in Databases: Spin up Postgres, MySQL, or Redis with one click.
Traefik: Automatic SSL certificates via Let's Encrypt.

3. Security Essentials

A "maintainable" server is a secure one. You don't want to wake up to a crypto-miner hijacking your CPU.

Hardening SSH

Edit your SSH config:

Loading code...

Make these changes to disable password login and root login (create a sudo user first!):

Loading code...

Firewall (UFW)

Ubuntu comes with UFW (Uncomplicated Firewall). Set it up to deny everything by default and only allow what you need.

Loading code...

Warning

Always allow SSH (port 22) before enabling UFW, or you will lock yourself out of the server.

Fail2Ban

Fail2Ban bans IPs that show malicious signs (too many password failures, etc.).

Loading code...

4. Observability

You can't fix what you can't see. For a single VM, you don't need a complex K8s observability stack.

Netdata

Netdata provides real-time monitoring with zero configuration.

Loading code...

It gives you a dashboard at http://your-server-ip:19999 showing CPU, RAM, Disk I/O, and network traffic.

Log Management

For application logs, Dokploy handles the basics. For system logs, ensure journald is configured to not eat up all your disk space.

Loading code...

5. Backup Strategy

We already enabled DigitalOcean backups, but that's a full disk snapshot. You also need application-level backups.

Database Backups

Dokploy has built-in backup scheduling for databases. Configure it to dump your Postgres/MySQL databases to an S3-compatible storage (like DigitalOcean Spaces or AWS S3) every night.

Create a Bucket in DO Spaces.
In Dokploy, go to your Database settings -> Backups.
Enter your S3 credentials and set the cron to 0 0 * * * (Daily at midnight).

Diagram: The Agency Box Architecture

Here is how the components fit together:

Loading diagram...

Conclusion

By combining DigitalOcean's reliability with Dokploy's ease of use, you get a powerful, cost-effective platform for your agency. It requires a bit more setup than a managed PaaS, but the control and cost savings are well worth the investment.

Remember: Maintenance is not optional. Schedule a monthly calendar reminder to:

Run apt update && apt upgrade
Check disk usage
Verify backups are actually running

Build it right once, and it will serve your agency for years.