Infrastructure
Public services (this site) run on a small EU-based VPS: SSH keys only, firewall, automatic security updates, HTTPS. Hosting the public part outside my home network keeps the home network closed and costs less than running a server 24/7 at home.
Host
| Component | Choice | Why |
|---|---|---|
| Provider | Hetzner Cloud (Falkenstein, DE) | EU-based, cheap, well documented |
| OS | Debian 13 (stable) | Predictable, matches the lab |
| Access | SSH keys, no root login, no password auth | Removes password brute force entirely |
| Firewall | ufw + fail2ban | Only 22, 80, 443 open to the internet |
| Updates | unattended-upgrades | Security patches without manual work |
Web server
Caddy serves the site and handles HTTPS automatically. It runs inside a Docker container rather than installed directly on the host — the host stays free for lab experiments (new services, Docker networking tests, anything that might misbehave) without risking the live site. The container restarts on its own if it crashes. Redeploying the site means copying files into a folder the container reads from: no restart, no system-wide change.
| Component | Choice | Why |
|---|---|---|
| Runtime | Docker | Isolates the web server from host-level experiments |
| Web server | Caddy (official image) | Automatic HTTPS, short config, well-maintained image |
| Domain | Own domain, A records | nikitchenko.com and www both point straight at the VPS |
| TLS | Let's Encrypt, issued by Caddy | Renews on its own; certificates live in a Docker volume, so they survive container rebuilds |
How the move into Docker went, including the certificate that wouldn't issue: Caddy in Docker.
Why not just run it at home?
The lab machine used to run WireGuard directly, with the home router forwarding a port to it. That setup worked but kept the home network reachable from the internet and cost real money to keep on 24/7. Moving the public-facing part to a cheap VPS closes that exposure and the lab now connects out to the VPS instead of being reached from the internet.