1732 posts tagged with "Self-Hosting"
Running your own PaaS and infrastructure on machines you own
Vercel's April Breach Was a Defaults Bug, Not Just a Hack: The Case for Sensitive-by-Default Secrets
Vercel's April 2026 breach exposed every customer environment variable not explicitly marked sensitive. Why the opt-in flag was the real vulnerability, how write-only secrets already solve it in production, and a five-property checklist for secrets handling that stays safe when developers forget.
Vercel's Migration Tax Isn't the Hosting Bill — It's Edge Config, ISR, and the AI Gateway
Leaving Vercel means rebuilding three primitives with no drop-in equivalent: Edge Config's no-redeploy flag reads, ISR's shared-cache invalidation, and the AI Gateway's routing and budgets. A primitive-by-primitive inventory of what each rebuild actually costs on infrastructure you own.
Vercel Sandbox's $0.128 Active-CPU Hour vs E2B's $0.0504: Where Idle-Free Billing Wins — and Where Hetzner Wins by 28x
Vercel meters sandbox CPU only while active; E2B meters wall-clock at less than half the rate. A normalized 2 vCPU/4 GB cost comparison finds the crossover at about 32% utilization — and shows owned Hetzner hardware beating both by 14–28x for always-on fleets.
Where Post-Railway Workloads Land: Six Destinations and the Hetzner Math
Six completed 2026 migrations off Railway landed on Render, DigitalOcean, AWS, Azure, Hetzner, and Coolify. A destination-by-destination account of what each exit buys and re-buys, plus the missing cost math: a $128/month metered footprint fits many times over on a €44 dedicated box.
Your Agent Knows Your API Keys: Credential Brokering With Infisical's Agent Vault
AI agents that can read API keys can be prompt-injected into repeating them. Infisical's open-source Agent Vault brokers credentials at an egress proxy so secrets never enter the context window — here is the mechanism, the alternatives, and the build checklist.
Authorizer Puts Agents on the Org Chart: A2A Token Exchange, OAuth-2.1 MCP, and Secretless Kubernetes Identity
Authorizer 2.4 gives AI agents first-class identities: RFC 8693 delegation with nested actor chains, an MCP server behind OAuth 2.1 with audience-bound tokens, and secretless Kubernetes workload auth — a credential model where agents hold scoped delegations instead of god-keys.
bex Is in Public Alpha: What Ships Today, What It Costs, and What 'Alpha' Means for the Open-Source, Agent-Operable Render Alternative
bex is open for signup as a public alpha: git push to HTTPS on machines you own, a Render-compatible API and CLI, 179 MCP tools for agents, and prices 30% under Render. Here is the ledger of what ships, what is missing, what it costs, and what must be true before 1.0.
Contabo vs Hetzner, September 2026: Where Should a Self-Hosted Fleet Rent Its Boxes?
After Hetzner's June 2026 price hike, Contabo ships double the RAM per euro while Hetzner keeps hourly billing and steadier cores. A role-by-role fleet placement with worked monthly totals for control planes, elastic workers, and APAC edge nodes.
Your AI Agent Can Now Restart Prod Postgres From Chat: What the Coolify–AnythingLLM MCP Bridge Costs in Audit and Rollback
An open-source MCP server lets an AI agent deploy, restart, and roll back Coolify apps from an AnythingLLM chat window. A threat-model teardown of what agent-driven deploys cost in scope, attribution, and reversibility — and the five-item checklist any agent-facing deploy server must pass.