Fully Booked ran on DigitalOcean droplets it had outgrown: around a thousand people a day on rented infrastructure, every scaling decision priced by the vendor, and a monthly bill that only moved in one direction. The ask was simple to say and hard to do. Move the whole platform onto hardware the business owns, and do it without anyone who uses the app noticing that anything changed.
### Parity first, then trafficThe migration was staged so that trust was earned before traffic moved. A multi-node k3s cluster went up on owned hardware, hardened with UFW and fail2ban, and every service was containerized to run identically on both infrastructures. Certificates, scheduled backups and monitoring were in place before the switch, not bolted on after. Only then did traffic start to move, surface by surface, with instant rollback available at every step.
### The cutover as a proxy flipCloudflare already sat in front of the platform for DNS, caching and TLS, and that is what made the final step calm: the cutover was a proxy flip rather than a DNS gamble. Behind the edge, the cluster runs a control plane and worker nodes carrying the portal, admin, backend and job pods, with monitoring watching and backups on a schedule. The diagram shows no IPs and no hostnames, because the shape of the system is not its secrets.
### Zero downtime, measuredZero downtime was recorded across the cutover, and nobody using the app that week knew anything had happened, which was the entire point. The recurring cloud bill became owned infrastructure, the client controls every layer from DNS to disk, and the same cluster now carries the platform's weekly releases. The platform this move carried is told in the Fully Booked story.