Multi-site hosting

One deployment, certificate, and rollback workflow for 200+ sites

We turned fragmented site launches into a validated, automated, and versioned multi-site hosting platform.

Sector: Multi-site hosting
Period: Ongoing operations
Our role: Cloud architecture, backend engineering, and deployment workflow

The problem

As the number of sites grew, uploading files, configuring domains, and issuing certificates one site at a time became both slow and difficult to audit. A manual overwrite could also make recovery uncertain. New launches and routine updates needed one repeatable workflow with a visible version history.

Constraints

The platform had to serve many independent domains and static sites without maintaining one long-running container per site.
Existing sites had to stay available while domain and certificate changes moved away from manual procedures.
Client identity, traffic, cost, and internal operating data must remain private.

What we did

Share the runtime, separate the site artifacts

Nginx on Cloud Run provides a shared serving layer, while site packages and versions live in Google Cloud Storage so compute can scale independently.

Why not the other path We did not create a permanently running container for every site because that would multiply images, deployments, and operational work together.

Make deployment a validated workflow

Each upload is checked for a valid package structure before extraction, version creation, and the final serving switch.

Why not the other path We did not allow direct overwrites of live files because partial writes and malformed packages leave states that are hard to recover.

Automate domains and TLS

Cloudflare DNS, TLS, and site configuration are handled in the same provisioning flow, with DNS-01 validation reducing disruption to an existing site during migration.

Why not the other path We did not keep certificate issuance as a per-site manual task because omissions and renewal failures become harder to detect at scale.

Keep versions, not only the latest files

Every deployment creates an addressable version and the active site can be switched back without reconstructing an old package.

Why not the other path We did not keep only the latest upload because rollback would then depend on whether a separate backup happened to exist.

Outcomes

More than 200 sites are managed through one platform.
Package upload, validation, and deployment now follow one automated workflow.
Each deployment preserves a version that can be selected for rollback.

Technology

Google Cloud Run
Nginx
Google Cloud Storage
Cloudflare

Looking back

If we started again, we would make failure states, operation audit trails, and tenant boundaries first-class concepts earlier. With a few sites they look like administrative features; beyond a certain scale they are the architecture.