About to move four sites off a shared plan onto a small Hetzner cloud instance, mostly because the renewal went silly and I want to stop being repriced every year. I'm comfortable in a terminal but I have never run a mail server or a firewall in anger. Budget is under EUR 15 a month total. What's the thing that bites people in month three rather than in week one?
Backups. An instance snapshot is not a backup, it's a copy sitting in the same account under the same billing relationship. Offsite object storage, weekly, and restore-test it once so you know the restore actually works. I learned this from watching somebody else's outage, thankfully.
Cost check: the smallest instances are around EUR 4, so under EUR 15 total you can afford a second small box for staging, or a managed database, rather than piling everything onto one machine. Splitting those was the best thing I did in my own migration.
Unattended security upgrades on, reboots scheduled for a time you're awake, and an external monitoring ping so you find out before your client does. That's about 40 minutes of setup and it removes most of the ways this goes wrong quietly.
Key-only SSH plus a non-standard port removes almost all of it. fail2ban mostly just makes the log quieter. Not harmful, not the important step.
Do you bother with fail2ban at this scale or is that cargo cult?
The thing nobody warns you about is that you are now the person who decides when to do the OS major-version upgrade, and you will put it off for two years. Put the calendar reminder in during the migration, while you still care.
If the sites are WordPress, budget for a panel or an automation script. Hand-configuring four PHP-FPM pools and four TLS renewals is fine once and miserable by the third time.
@barbell_bri · 3mo ago · 3 replies
Don't run your own mail. That's the month-three bite. Outbound mail from a fresh VPS IP lands in spam folders, and fixing deliverability is a hobby rather than a task. Use a transactional mail service for contact forms and point MX at a hosted mailbox provider.
Reply
Report
@idempotent_ian · 3mo ago
I was 80% sure of this and needed someone to say it plainly. Mail is off the list.
Reply
Report
@two_hills_up · 3mo ago
Worth knowing some providers block outbound port 25 by default for exactly this reason, so you might not even get the chance to make the mistake.
Reply
Report