The small-team ops stack: the six checklists that prevent most outages

We help small teams run production systems without a dedicated ops hire. Across the incident reviews we've studied, the same six failure shapes keep showing up — and each one has a checklist that fits on one page. Here's the stack, in the order we'd install it, with links to every checklist. Steal the whole thing.

1. Monitoring: five signals, one alert rule

Small teams don't need a metrics platform; they need five signals watched from outside: HTTPS from another network, the 80% disk line, cron heartbeats, cert/domain expiry, and a login-path test — plus one alert rule that doesn't get the phone muted.

Full checklist → https://hive80-lab.github.io/ops-notes/server-monitoring-checklist-small-teams.html

2. Incident response: the first 30 minutes, in order

The first 30 minutes decide whether the incident stays one page long. The order matters more than the tools: stabilize, decide severity, open the bridge, assign comms, protect the backups before touching anything.

Free one-pager → https://hive80-lab.github.io/ops-notes/first-30-minutes-incident-response.html

3. Hardening: the first ten servers

Ten controls, one afternoon, no security engineer: key-only SSH, default-deny firewall, automatic security patches, 2FA on the control plane, tested off-box backups — plus the honest skip-list.

Full checklist → https://hive80-lab.github.io/ops-notes/server-hardening-checklist-small-teams.html

4. Secrets: rotate what leaks, not everything

Inventory where credentials live, rotate on real triggers (departures, leaks, vendor incidents) instead of a dead calendar, replace long-lived keys with short-lived tokens, and pre-stage the dual-credential cutover.

Full checklist → https://hive80-lab.github.io/ops-notes/secrets-rotation-checklist.html

5. When DNS is the outage

The outage that never appears in your logs: watch the domain itself (expiry, NS set, cross-resolver answers), keep a tested zone copy at a second provider, lower TTLs before changes — and know the 10-minute restore path by heart.

Full runbook → https://hive80-lab.github.io/ops-notes/dns-outage-runbook.html

6. When the vendor is down (and your status page goes silent anyway)

Classify yours-vs-theirs in 10 minutes, degrade deliberately (wait / feature-flag / failover), communicate on a clock with the vendor named, and harvest the dependency list.

Full runbook → https://hive80-lab.github.io/ops-notes/vendor-outage-runbook.html

The two bonuses that pay for themselves

Cloud cost spikes — triage by top movers before touching anything; the spike lives in egress, NAT, log retention, retry storms, and forgotten dev monsters → https://hive80-lab.github.io/ops-notes/cloud-cost-spike-runbook.html

Status-page updates people trust — first update inside 15 minutes, named vendor, next-update time promised and kept → https://hive80-lab.github.io/ops-notes/status-page-communication-template.html

If you want it packaged

Everything above exists as fillable templates in the HIVE80lab kits — built from real incident reviews, not theory:

• Ops Starter Kit ($14) — incident response for small teams: first-30-minutes card, severity matrix, comms templates, IR plan.
• Ops Starter Kit Vol. 2 ($27) — the advanced layer: DR plan, evidence log, post-incident review.
• Automation Starter Pack ($19) — pick-first workflows so the checks above run by themselves: cost review, retention sweep, dependency canaries, ephemeral shutdowns.
• Agent Ops 24/7 ($19) — if part of your stack is autonomous agents, this is the operator's playbook for keeping them alive.
• The First 30 Minutes (free) — start with the one-pager.

Launch-week pricing: 30% off any paid kit with code HIVE-LAUNCH30 at https://hive80lab.gumroad.com

All six checklists (plus ~40 more) are free forever at https://hive80-lab.github.io/ops-notes/ — the kits are for teams that want them pre-assembled, with the review templates included.