What I Self Host

> I pay for a cheap droplet at DigitalOcean, about $5 per month, and an additional dollar for backup.

Wait, I thought self hosting meant having your own hardware at like home running all your services. Not DigitalOcean.

I didn't realize, but apparently this is a long-standing argument. I did just a tiny bit of digging because I'm sort of into self-hosting and I ran across the selfhosted Reddit's wiki on the topic.

https://www.reddit.com/r/selfhosted/wiki/selfhosted

TLDR: they don't differentiate on whether you own the hardware or not.

There is always going to be a point of failure. For many of us, self-hosting on a dedicated server, VPS, or some sort of cloud service is much better than keeping the hardware to do it at home.

My stuff is spread out among a dedicated server and 3 VPS's. --I could and should drop one of the VPS's, but if it'll take me a couple of hours, it's just not worth it until I actually have the time to spare.

Basically it sounds like IaaS is fine (even though someone else manages the hardware and restricts OS choices), and even PaaS is fine (even though someone else manages the hardware, the OS, and the configuration of interpreters such as php / node.js / python / etc.), since these let you run your own code (which can include your instance of community code). Only SaaS would be excluded, as these don't let you run your own code.

IaaS VPS's and rented colo VMs are definitely fine. PaaS is... slightly not? it's the grey edge!

SaaS is definitely not you running stuff you control or could move anywhere.

If it's a buck standard linux box, yeah that's self hosting!

It depends of your needs and resources of course but you can keep in some drawer or basement some old or small PC and you basically do not have to spend money on this, but for paid servers you have to spend 20-50$/month for something sensible. 1tb of backup in some s3 service costs like 120$ per year, and 1TB is not that much. In reality paid servers will be close to 1k$/year and in that price you can have sensible machine.

That's true, but this still gives OP some level of control

No, it just means running the software on a server you control. That can be a physical server at home, or it can be something like DigitalOcean.

Sure, I could get a server at home, but then I have to figure out how to make it quiet enough that I don't notice it while keeping it from overheating - something that's hard enough to do with the equipment I already have. And then I have to worry about what happens if somebody decides to have fun trying to DDOS something on my home connection. Again, easier to rent a dedicated server so I don't have to worry about it.

I guess it depends on your country climate, here, where I live in the basement I have steady 22-23 degrees C, so not a problem really. Also I do not have even GPU there which is the most problematic part usually.

About DDOS, you should not your server directly connected to the internet. Use some router or managed switch first. Usually it have already some kind of protection on whatever device is connected to your internet provider infrastructure.

Another question is why would anybody DDOS you? You are not important enough. When I bought domain and connected it to my VPS - I got almost instantly visitors (probably bots looking for new domains being registered) trying bruteforce an access. And I almost instantly blocked Root login and Password auth. They were still trying to login. So I moved the port to higher one. It was calm for few months and then they found new port and again tried to ram it down. So I blocked IPs only to predefined set.

It was exactly the same when I opened my server to the internet with new domain. From that point of view it does not matter if this is your machine, VPS or dedicated server on some rack somewhere. You are responsible for its security.

You can always "do more" yourself. I think we all can agree that it would not be reasonable to build your own server (including) from first principles so it's always a question of where you want to draw the line. IMO what matters is how much you influence the end result and how well you are equipped to deal with bs from those your solution depends on. A VPS just means you let someone else deal with hardware issues but are still fully controlling the software - and the interface between the two is a relatively standard virtual machine which makes it easy to migrate elsewhere when the provider decides to sequeeze you.

When I read that someone disable password login (rightfully so), then they take additional steps to stop some bots to randomly brute force them with a password…