homestream
A private media server for family, hardened until a non-technical user could not break it.
In daily use by people who did not build it, which is the only test that counts. Invite-only, deployed on a rented box.
Deploying without cutting the film
Releases go out to slots rather than over the top of the running server: the new version starts alongside the old one, gets checked, and only then takes over. The reason is specific rather than architectural fashion — somebody is usually watching something, and a restart mid-stream ends their evening.
That is not a theoretical hazard. A deploy can and did cut a live stream, which is why the deploy script has a status check to run before pushing, and why two releases back to back are a bad idea.
Hardening for someone who will not read an error
A crash that only appears in a log is a crash nobody will report; the family member watching just sees a spinner and gives up. So failures were made loud where they matter and impossible where they could be: a reaper cleans up processes that would otherwise pile up, crashes take the process down rather than leaving it half-alive, and the failure modes that produced a bare server error now produce something a person can act on.