SKU · audit + retainer
Legacy Pipeline Patches
Security patches for the provision and deploy path on legacy servers. We do not build you a new platform.
One week to inventory how a legacy server is provisioned and deployed, then a monthly watch that patches that path: Ansible, shell, Capistrano, old CI, Dokku, or systemd. €3,000 for the audit, then €2,000/mo with a three-month minimum. Kernel and package updates include the reboot, not only apt.
The wound
What this is for
The server is a droplet, a VM, or a bare host. Deploy is Capistrano, a shell script, or a GitLab job from 2019. apt ran last year. The kernel package is installed and the running kernel is older, because nobody rebooted. A Kubernetes rebuild is the DevOps SKU. Patching the path you already have is this one.
- A team still shipping to Ubuntu 20.04 or 22.04, Debian, or a single VM with SSH and a script
- A founder whose provision lives in Ansible, Chef, shell, Capistrano, Jenkins, or an old GitLab CI file
- Someone who will grant user access to the host and the provision repo and will agree a reboot window
Pipeline audit (1 week)
€3,000
100% to start. One named host or one named fleet that shares a provision repo. Written note of OS, kernel, and deploy path.
Pipeline retainer
€2,000/mo
Monthly in advance, three-month minimum. Security updates to that path, including the reboot when the kernel changes.
Cap: two concurrent retainers studio-wide. Written SOW. No handshake starts.
Audit, then a monthly watch
What the weeks look like
Week 1
Inventory the path
Name the host, the OS, the running kernel versus the installed image, and the repo that provisions and deploys it. If there is no repo — only SSH folklore — we stop or we write the path down as the first deliverable. You pay for the week you received.
Each month
Patch the pipeline and the host
Apply the distro security updates the notice actually names. Put the change in the provision or deploy repo. Reboot inside the window you agreed when the kernel changed. Confirm uname matches the package. Rebuild out-of-tree modules when the notice says the ABI moved.
Deploy path
Make the next patch a reviewed change
The script, Ansible role, Capistrano task, Dokku config, or CI job is the product. A one-off SSH session that nobody can repeat is not a patch.
Handover
You keep the account
You own the cloud bill and the SSH keys. We are a user. Cancel after month 3. A new cluster is a different SKU.
In
Included
- One provision and deploy path (Ansible, shell, Capistrano, Chef, Jenkins, GitLab CI, Dokku, or systemd)
- Distro security updates for that host, applied from the repo
- Kernel update plus a reboot in an agreed window, then proof of the running version
- A short note each month: what changed, what rebooted, what is still unsupported
- Slack, one business-day response on that path
1 business day on the pipeline channel
Out
Not included
- A new Kubernetes platform, multi-region, or a CI redesign (that is DevOps)
- Application code patches (that is Legacy Security Patches)
- 24/7 on-call or an incident retainer
- Owning your cloud account or rotating every secret in the company
- Hardware, colo hands, or a vendor contract we cannot patch from a repo
Questions
Before you book
No. This SKU patches the path you have. A new cluster, rollback, and Prometheus is the DevOps offer.
No. Ubuntu’s own notices say you reboot after the update, and an ABI change means third-party kernel modules have to be rebuilt. We check the kernel that booted, not the package that was downloaded.
We say so in week 1. Extended support is your vendor contract. We do not pretend an EOL release is patched because apt still runs.
Named SKUs. Pick one. Do not invent a new one on the call.
Pipeline audit (1 week) €3,000 · Pipeline retainer €2,000/mo. Written SOW. 100% up front unless the offer says otherwise.