1732 posts tagged with "Self-Hosting"
Running your own PaaS and infrastructure on machines you own
OpenID Certified at 30 MB: What Pocket ID and Tinyauth's Formal OIDC Conformance Actually Proves for Your PaaS Admin Login
Pocket ID and Tinyauth both passed the OpenID Foundation's conformance suite in 2026. What the certification actually tests, what it doesn't prove, and when a 30 MB IdP is enough to gate a self-hosted PaaS admin surface.
Your PaaS Bill Grew a New Line Item: Fly.io's Snapshot Charges, Cross-Region Transfer Fees, and What a Multi-Region Indie SaaS Actually Pays Now
Fly.io began billing volume snapshots on January 1, 2026 — a meter attached to a default. A line-by-line accounting of what a multi-region indie SaaS (web, worker, cross-region Postgres replica) now pays on Fly.io and Railway, the cross-region transfer rates most users never priced, and why self-hosted costs can't grow lines you didn't write.
Railway's Five Postmortems in Six Months: What an 8-Hour Blackout From a GCP Account Suspension Reveals About Renting Your Platform's Platform
Railway's May 2026 blackout was caused by Google suspending the account the whole platform runs on — a failure mode no SLA or multi-AZ diagram covers. A close read of five postmortems, the hidden dependency chain of renting a PaaS, and an honest tally of what self-hosting removes from the failure tree versus what it adds to your pager.
Spend Caps Are a Feature Hosted PaaS Has to Build — and Owned Hardware Gets for Free
Railway's July 2026 CLI usage limits let you cap spend by taking your own app offline. A fixed-price Hetzner box makes the same guarantee for free — but owned hardware still owes its tenants quotas. The full economics of bill anxiety, with the numbers.
Static Outbound IPs Are a Paid PaaS Add-On — and a Rounding Error on a Server You Own
Railway's July 2026 release put static outbound IPs behind its Pro plan — the same allowlist-friendly egress identity that costs €0.50/month on a Hetzner box. A platform-by-platform accounting of the egress tax on Railway, Render, Heroku, and Fly.io versus servers you own.
Sprites Speak MCP: When the Agent Sandbox Becomes a Tool the Agent Calls Itself
Fly.io's Sprites now expose their full lifecycle over MCP, so agents provision disposable machines from inside their own loop. Here is the six-tool sandbox contract — create, exec, checkpoint, restore, destroy, list — and the quotas, TTLs, and per-tenant budgets a self-hosted platform needs before the agent becomes the capacity planner.
step-ca vs Let's Encrypt: What an Internal-Only ACME CA Buys Your Fleet's Service-to-Service TLS
Let's Encrypt logs every certificate publicly and refuses private hostnames by design. step-ca gives a Cluster API fleet automated internal TLS with 24-hour certs and no CT-log exposure — here's the full setup, plus the honest cost of running your own CA.
Six Traefik Gateway API Advisories in Six Months: The Namespace-Boundary Probes Your Shared Ingress Owes Every Tenant
Traefik shipped six Gateway API isolation advisories between March and August 2026 — including a 9.9 CRITICAL REST-provider exposure and a route-key collision with no workaround. Seven concrete namespace-boundary probes, each with the manifest and the exact assertion, for any platform routing many tenants through one shared ingress.
Appwrite Sites and the BaaS Land Grab: When Your Backend Vendor Wants to Host Your App Too
Appwrite Sites turns an open-source BaaS into a git-push app host, and the 1.9.5 release adds branch/path deploy filters, a Rust runtime, and Bun/Deno builds. Here's what backend vendors climbing the stack means for who owns your deploy pipeline — and where a single-box Compose stack ends and a scheduled fleet begins.