Back in June, I wrote a two-part series about my technology choices in retirement. The first part, “Overengineering: A Case Study,” described how I left IONOS after twenty years and rebuilt my web hosting on a cheap private server, Docker, Cloudflare, and Vercel. The second part, “Eight Years In and Still Figuring It Out,” looked at the rest of my subscriptions and the value of leaving well enough alone, including why I chose to keep an old Dropbox subscription rather than spend a weekend sorting through it.
In that first part about overengineering, I wrote that I had traded a system where IONOS handled the server updates, security patches, and backups for one where I have to do all of that myself. Recently, three problems arrived in less than two weeks that I actually had to deal with.
The maintenance I expected
On October 21st, the news broke about a PHP flaw called PHP2Shell. A CBS News headline described it as a bug affecting 70 percent of the world’s websites, and that included mine. Researchers had already built working attacks against WordPress, which runs most of my sites and the ones I host for Marsha and our older daughter.
I started reading the news about the flaw just before going to bed. After Marsha went to sleep, I stayed up, logged into my Docker host, and updated each container by hand. Nothing broke, and afterward I let Marsha and our daughter know their sites were patched.
Five days later, Cloudflare emailed to say that some certificates from a certificate authority could no longer be trusted and asked customers to upgrade the software that runs Cloudflare Tunnels. I run only one tunnel for the container that runs my 1Password Connect server. (For the geeks out there, the Connect server allows apps to fetch secrets in 1Password through a REST API without requiring a CLI or local client APIs.) The upgrade was pretty easy. I took care of it while reading my email in the morning, and the only cost was a later start on my consulting work.
Security updates are nothing new. We all got used to Windows updates years ago, and on our iPhones and Macs the updates mostly happen automatically. On my own servers, nothing happens automatically. When I took over my own hosting, I understood that I would be the one doing these updates, so these tasks were annoying but somewhat expected.
The one I didn’t expect
On October 29th, I got the dreaded email from Vercel stating that my free account had used up its included computing time and would be paused within 24 hours unless I upgraded to the $20-a-month Pro plan. I knew my account had been running close to the compute limit for a while, and something, perhaps more traffic, pushed it over the edge. Unfortunately, I didn’t get to the email within that 24-hour period.
Three of my rebuilt websites lived under that one account, so the pause took them all down at once. Back in June, I wrote that if a rogue nation-state flooded my family’s Christmas letter site with traffic, the Vercel frontend would shrug it off. As it turned out, no nation-state was needed, because a free-tier meter did the job instead.
Once I got the email, I paid the $20 to bring the sites back online and started moving everything to Cloudflare, which I’m told has a free tier that fits my use case better. I started on Saturday with hillwork.us, which is basically a two-page website with a contact form. The migration took me a ridiculously long time for such a simple site, and I suspect I spent more time migrating hillwork.us than all of its visitors have spent reading it.
On Sunday, I blew the entire day on the other two sites (time-restricted.com and paos.us). Boo. I sat in front of the AI vibe coding the solution, manually tweaking settings in the Vercel and Cloudflare consoles, and testing the sites. Because I let the AI do the work, I still don’t really understand how Vercel runs my sites differently from the way Cloudflare does. I’m like someone who drives a car and can use all of its features but doesn’t know how to fix it. When the check-engine light came on, I handed the keys right back to the AI.
Once all three sites were running on Cloudflare’s free tier, I canceled Vercel Pro. While I expected it would run me until the end of the month, they ended up refunding me $18.67 of the $20. So, in the end, I only spent $1.33 on the Pro upgrade. I guess that was a pretty minimal hard dollar cost.
However, the real cost was just another blown Sunday that I’ll never get back. I thought I had escaped most of those lost Sundays when moving from a suburban home into an urban condo with no old fixtures, building exterior, or landscaping to maintain.
Letting sleeping dogs lie
The last two weeks just provided more proof of the value of letting sleeping dogs lie. I do have to recognize the legitimacy of problems I had to address. PHP2Shell was a global event, certificate maintenance is a real thing, and Vercel has to make money. (Vercel is also just total magic, and I’m glad I got some experience with it!)
Saving money was part of why I left IONOS, but my main reason was that my plan made anything beyond old-school PHP awkward. I wanted to use modern languages and frameworks. However, to be honest here, I haven’t really used much modern stuff yet. The only new things I built since moving to the new setup were front-end migrations of three websites that were already running on IONOS. The desire to modernize didn’t produce much of the geek satisfaction of building new things, but it did create a bunch of low-level admin work.
Looking back, I would have left all the old historical stuff on IONOS where it was and used Vercel and Cloudflare only when I wanted to attack new, modern projects. So far, I haven’t really done any. These two weeks just made me further question why I did any of this modernization at all. And, of course, I still kept my Dropbox subscription intact.
AI disclosure: I used AI tools during the drafting and editing process to help clarify structure and language. All ideas, judgments, and final wording are my own.