1732 posts tagged with "Self-Hosting"
Running your own PaaS and infrastructure on machines you own
Your Base Image Is Six Months Stale: Making Renovate's FROM-Line Patching a Self-Hosted PaaS Default
A git-push PaaS rebuilds your app on every push — and never touches the FROM line between pushes. How a platform-run Renovate loop with digest pinning and health-gated automerge bounds base-image staleness from unbounded to about a day, the exact renovate.json to do it, and where the loop still falls short of buildpack rebase.
Webhook Signature Verification for Git-Push Deploys: What a Self-Hosted PaaS Has to Get Right That GitHub's Own Docs Gloss Over
On a git-push PaaS, the webhook endpoint is a remote build trigger — and HMAC verification is its entire security boundary. A 10-point audit checklist covering the raw-body trap, the === timing leak, the timingSafeEqual length-throw, the SHA-1 header ghost, and the replay gap GitHub's docs never assemble into one place.
Cilium Becomes the Default Kubernetes CNI Everywhere but AWS: What eBPF Networking Buys a Self-Hosted PaaS on Hetzner
GKE and AKS now run Cilium by default while EKS holds out — here's what eBPF service routing, Hubble flow observability, and identity-based network policy actually buy a self-hosted PaaS on Hetzner bare metal, with the benchmarks, memory costs, and a decision table.
Nine Seconds, Zero Backups: What the PocketOS Wipe Demands From a PaaS That Doesn't Manage Your Database
A Cursor agent deleted PocketOS's production database and every backup in nine seconds. The real failures were architectural: co-located backups and an omnipotent API token. Here is the backup design that survives a rogue agent — and what a PaaS that doesn't manage your database still owes you.
Gateway API v1.5 Moves Gateway Merging to Stable: One Load Balancer, Many Tenant Apps, No Ingress Controller Sprawl
Gateway API v1.5 graduates ListenerSet, letting one platform-owned Gateway and a single load balancer carry every tenant's HTTPS listeners with tenant-owned certificates. The before/after topology, a working YAML example, the Hetzner LB cost math, and the admission work the merged model shifts onto your control plane.
IPv6-Only Worker Nodes on Hetzner: What Dropping the €0.50 IPv4 Line Item Saves a 10–50 Node Fleet, and What Breaks First
Hetzner bills every primary IPv4 at €0.50/month while IPv6 is free. The real savings math for a 10-50 node CAPH fleet after the June 2026 repricing, why GitHub and ghcr.io break first on IPv6-only nodes, and the four bridges — public NAT64, Jool, a NAT gateway, or a registry cache.
Kubernetes Just Buried Its Own Dashboard: Why Headlamp Is Now the Default Operator UI for a CAPI-Managed Fleet
The Kubernetes Dashboard is archived and the project's own blog now points operators to Headlamp. What the June 2026 migration guide and the new Cluster API plugin mean for a CAPI-managed fleet: which plugin features cover which operator surfaces, and when embedding Headlamp beats building a bespoke dashboard.
Why Self-Hosted PaaS Secrets Managers Still Default to Plaintext Env Vars: A Survey of Coolify, Dokploy, and CapRover
Coolify, Dokploy, and CapRover all hand your production credentials to anyone with dashboard access — a feature-by-feature survey of how each stores secrets, why plaintext env vars are an architectural default, and what a Sealed Secrets or External Secrets Operator pattern on Kubernetes buys instead.
The Tailscale Kubernetes Operator Exposes kube-apiserver Without Touching the Public Internet
84% of internet-observable Kubernetes API servers answer to the public internet. The Tailscale operator's API server proxy replaces the IP allowlist with identity-authenticated tailnet access — here is what changes for a self-hosted fleet, what it costs, and what Headscale users shouldn't assume.