Linux server administration and infrastructure consulting

Senior engineers in Bucharest · we run your Linux servers, dedicated servers, virtual machines and containers, and we consult on the harder questions

DreamServer has been running Linux infrastructure for our own customers since 2009. We extend that team to your organisation as a managed-services and consulting provider: from a one-off hardening project to a full 24/7 on-call rotation, on hardware you already own or in our Bucharest datacenter.

15+ years operating production Linux EU-based, GDPR aligned We run our own datacenter, LIR & ISP
Get a quote See pricing
What we offer

Four ways to work with our engineering team

Mix and match: many customers start with a one-off audit, move into a monthly retainer for steady operations and call us for a project when something big lands on the roadmap.

Linux server administration

Day-to-day care for your Linux fleet. Patches, hardening, configuration management, backup, monitoring, on-call.

  • Debian, Ubuntu LTS, RHEL/Alma/Rocky
  • SSH, firewall, SELinux/AppArmor
  • Ansible, Puppet, Salt
  • Patching cycles & CVE response

Dedicated server management

End-to-end care for bare-metal servers, in our datacenter or yours: hardware, OS, services and monitoring.

  • Hardware sizing & commissioning
  • iLO / iDRAC / IPMI access
  • RAID / ZFS / LVM design
  • Remote-hands coordination

Virtual server administration

Operations for VMs and containers. Proxmox VE, KVM, LXC, Docker and Kubernetes, on any provider.

  • Proxmox VE, KVM, libvirt
  • LXC, Docker, Podman
  • Kubernetes (k3s, k8s)
  • Live migration & snapshots

Infrastructure consulting

Architecture review, capacity planning, security audits, migration plans, cost optimisation, vendor selection.

  • Architecture & capacity reviews
  • Security audits & remediation
  • Cloud-to-bare-metal repatriation
  • Disaster-recovery planning
Engagement models

Hourly, prepaid, retainer or project

Pick the shape that fits the work. The first 30 minutes of a discovery call are free; the quote that follows is fixed and written.

Hourly

Pay-as-you-go

€60/hour

Best for occasional one-off tasks and quick consultations.

  • 15-minute billing increments
  • Time-tracked report each invoice
  • Mon-Fri 09:00-18:00 EET
  • NDA included
Start hourly
Prepaid block

10 hours, 6 months

€550block

EUR 55/h effective, used at any pace over 6 months.

  • 15-minute billing increments
  • Priority over pay-as-you-go
  • Hours dashboard in your client area
  • NDA + standard MSA
Order block
Project

Fixed scope & price

Custom quote

Migrations, audits, full builds. One discovery call, one written SOW.

  • Written runbook + acceptance test
  • Single fixed price, no surprises
  • Optional handover to retainer
  • NDA + DPA + project SOW
Brief us

Prices exclude VAT. Out-of-hours work and 24/7 on-call carry a multiplier disclosed up front. We invoice in EUR; RON invoices on request at the BNR exchange rate of the day.

Free 30-minute consultation, on the phone

Schedule a free 30-minute call with one of our senior engineers. Tell us what you run, what hurts and where you want to go; we share initial advice and direction on the call itself, with no obligation.

Book the 30-minute call contact@dreamserver.ro
Concretely

What we actually do, day to day

A practical, non-exhaustive list of the technical work covered by every standard engagement. Anything missing is usually a quick add to the scope.

OS & security

  • OS install, kernel and package upgrades
  • SSH hardening, key management, MFA
  • Firewall (nftables, ufw), fail2ban
  • SELinux / AppArmor policies
  • CVE triage and emergency patching
  • Audit logging (auditd, journald)

Networking

  • IPv4 + IPv6 dual-stack, BGP if needed
  • VPN: WireGuard, OpenVPN, IPsec
  • Load balancing: HAProxy, Nginx, Traefik
  • DNS: BIND, NSD, Knot, PowerDNS
  • DDoS mitigation, rate limiting
  • TLS / Let's Encrypt automation

Databases

  • PostgreSQL: tuning, replication, PITR
  • MySQL / MariaDB / Percona
  • Connection pooling (PgBouncer, ProxySQL)
  • Redis, Memcached, Valkey
  • OpenSearch, ClickHouse, MongoDB
  • Schema reviews, slow-query analysis

Web stack

  • nginx, Apache, Caddy, OpenLiteSpeed
  • PHP-FPM, Node.js, Python (uWSGI/gunicorn)
  • HTTP/2, HTTP/3, QUIC, Brotli
  • WAF (ModSecurity / Coraza)
  • WordPress, Magento, Drupal hardening
  • CDN integration (Cloudflare, Fastly)

Monitoring & logs

  • Prometheus + Grafana (alerting too)
  • Zabbix, Nagios for legacy stacks
  • Loki, ELK, Graylog log aggregation
  • Synthetic checks, blackbox probes
  • Custom dashboards per team
  • Anomaly detection & SLO tracking

Backup & DR

  • Restic, Borg, rsnapshot, rclone
  • Proxmox Backup Server (we run one)
  • DB-aware backups (PITR, WAL shipping)
  • Off-site replication, 3-2-1 plans
  • Restore drills, RPO/RTO sign-off
  • Disaster-recovery runbooks

Containers & orchestration

  • Docker / Podman / containerd
  • Kubernetes, k3s, OpenShift
  • Helm charts, Kustomize, ArgoCD
  • Container registries (Harbor, ECR)
  • Network plugins (Cilium, Calico)
  • Image hardening & SBOM

DevOps / IaC / CI

  • Terraform, OpenTofu, Pulumi
  • Ansible, Puppet, Salt, Chef
  • GitLab CI, GitHub Actions, Drone
  • Build pipelines, blue/green deploys
  • Secrets (Vault, sealed-secrets, SOPS)
  • SBOM, image signing (cosign)

Email infrastructure

  • Postfix, Dovecot, Rspamd
  • SPF, DKIM, DMARC, BIMI
  • Deliverability audits, IP-warmup
  • Mailserver hardening, anti-relay
  • SMTP relay, transactional providers
  • Mailman / mlmmj for mailing lists
Why DreamServer

Senior engineers, running their own production

Six concrete reasons our customers stay for years. The short version: we run our own production stack, so we know what good operations actually look like.

01

We run our own infrastructure

DreamServer is a Bucharest datacenter, an ISP, an Internet exchange (DSIX) and a RIPE NCC LIR. The team you hire runs production for us first. No advice we give you is theoretical.

02

Senior engineers, on payroll

No subcontracting, no rotating juniors. The engineer who onboards your account is the engineer answering your tickets six months later. If we add a person we tell you, in writing, before they touch anything.

03

EU based, GDPR aligned

Romanian SRL, EU data jurisdiction, GDPR-compliant by design. We sign DPAs as a matter of course. Customer data we touch on your behalf stays in the EU unless you direct us otherwise.

04

Vendor-neutral and provider-agnostic

We work on your servers wherever they live: Hetzner, OVH, AWS, Azure, GCP, your rack, our datacenter. We will tell you when we think you should move and when you should stay.

05

Written SLAs, transparent SLOs

Response targets are documented in your MSA. Monthly status reports show what we did, how many hours it took, what is queued and what failed. No mystery invoices.

06

Hand-off ready any time

Everything we deploy is documented in a runbook in your repo. If you decide to take it back in-house, the keys, the runbook and the contact list are already yours. We do not lock anyone in.

How we work

From first message to ongoing operations

A predictable five-step engagement. The first two steps are free; you only commit on step three.

Discovery call

30 to 60 minutes on Jitsi or your choice of meeting tool. We map what you have, what hurts and what success looks like. No pressure, no surprises.

Written quote

Within 2 working days you receive a written quote: scope, deliverables, time estimate, price and assumptions. Either model (hourly, retainer, project) or a hybrid.

MSA + access

We sign an MSA, NDA, and DPA where relevant. You grant access through dedicated service keys (read-only first when feasible) and we set up a shared issue tracker.

Onboarding audit

For ongoing engagements we spend 4 to 8 hours documenting what is in place, listing risks and quick wins. The audit is a deliverable even if you stop here.

Recurring work

From there it is normal day-to-day operations: tickets, scheduled work, monthly review. Every change is in version control; everything we do is reviewable.

Frequently asked questions

Server administration FAQ

If yours is not here, ask us on the contact page.

What exactly do you do under server administration?

We take care of the day-to-day life of your Linux servers: installing the OS, applying security patches, hardening SSH and the firewall, managing the web stack (nginx, Apache), databases (PostgreSQL, MySQL/MariaDB), email, backups, monitoring with Prometheus or Zabbix, and on-call response when something breaks. We work either on servers in our own datacenter or on hardware you already own elsewhere.

Do I need to host with you to use these services?

No. We administer servers wherever they live: bare metal in your own rack, VPS at any cloud provider (Hetzner, OVH, AWS, Azure, GCP, Linode, DigitalOcean, etc.), or in our Bucharest datacenter. The tooling and processes are the same. Hosting with us simply removes one bill and one vendor from the chain, and gives you natural integration with our other managed services like Proxmox Backup Server, Nextcloud Hub and .ro domain registration.

What Linux distributions and Unix-likes do you support?

All the mainstream production-grade Linux distributions: Debian, Ubuntu LTS, Red Hat Enterprise Linux, AlmaLinux, Rocky Linux, openSUSE / SLES, plus FreeBSD on request. We also support Proxmox VE (Debian-based) for virtualization hosts and standalone containers (Docker, Podman, LXC).

How do you charge?

Three standard models: hourly at EUR 60/hour, prepaid blocks (10 hours for EUR 550) used over 6 months and monthly retainers (20 hours for EUR 950/month) with unused hours rolling over one cycle. Multi-server or 24/7 on-call setups are quoted per scope. Project-based engagements (a migration, a security audit, a stack rebuild) are quoted as a single fixed price after a discovery call.

Do you offer 24/7 on-call?

Yes, as an add-on to the monthly retainer. We integrate with your alerting (Prometheus Alertmanager, Grafana OnCall, Opsgenie, PagerDuty) and an engineer responds within 15 minutes for critical incidents and 1 hour for non-critical ones. Response SLA is set in writing; please request the standard MSA when you order.

How does a typical engagement start?

We open with a 30 to 60 minute discovery call: what you have, what hurts, what you want to achieve. Within 2 working days we send a written quote (scope, time estimate, deliverables, price). On acceptance we sign an MSA + NDA, you grant access (typically a service SSH key + read-only credentials at first), and we start. Most engagements finish onboarding in under a week.

Will you sign an NDA and a Data Processing Agreement?

Yes. NDA is standard practice and we sign one before any access is granted. For workloads that touch personal data we sign a GDPR-aligned DPA. We are an EU-based company; data we touch on your behalf stays in the EU unless you explicitly direct us otherwise.

Can you migrate me from one provider or stack to another?

Yes. Common projects: cloud-to-bare-metal repatriation (cost cuts), CentOS to AlmaLinux/Rocky migrations, Debian/Ubuntu major-version upgrades, MySQL to PostgreSQL, monolith to containers, on-prem to Proxmox VE. Every migration is run as a project with a written runbook, a maintenance window, a rollback plan and a written acceptance test.

What about security audits and compliance?

We run pragmatic security audits aligned with CIS Benchmarks and OpenSCAP profiles. The deliverable is a prioritised report (critical / high / medium / low) plus a remediation plan with effort estimates. For GDPR, ISO 27001 prep or PCI-DSS scoping we work alongside your DPO/auditor on the technical side and deliver the artefacts (logs, configs, hardening proofs).

Who actually does the work?

DreamServer engineers, on payroll. We do not subcontract. The same engineer handles your account through onboarding and ongoing work, with a backup engineer briefed for vacations and on-call. We also run our own datacenter, our own LIR (RIPE NCC member) and our own ISP, so the team you talk to is the team that runs production infrastructure every day. Read more about us.

Do you do DevOps / IaC / CI-CD?

Yes. Infrastructure-as-code with Terraform, OpenTofu, Pulumi or Ansible. CI/CD on GitLab CI, GitHub Actions, Drone, Woodpecker, Jenkins. Container registries, Helm charts, Kubernetes (k3s, k8s, OpenShift). We can either build the pipeline from scratch or take over an existing one and clean it up.

Can you keep working on a server you did not build?

Yes, this is the most common starting point. We do an onboarding audit on the existing setup (typically 4 to 8 hours), document what we found, list the risks and the quick wins, and then either pick up day-to-day operations or run a remediation project first. The audit alone is a useful deliverable even if you decide not to engage further.

Trusted By & Member Of

We are proud members of leading internet infrastructure organizations.

RIPE NCC MANRS PeeringDB RoTLD DSIX SBIX 4IXP LOCIX Euro-IX RIPE NCC MANRS PeeringDB RoTLD DSIX SBIX 4IXP LOCIX Euro-IX