Until this week the site was served by somebody else’s network. It worked. It was free. I moved it anyway, onto a machine sitting in my house, and I want to be precise about why, because "self-hosted" is the kind of phrase people use to mean "I enjoy suffering".
The house has no inbound connection worth speaking of, so the origin does not listen for anyone. It dials out through a tunnel and the edge hands it requests down that same connection. Nothing is exposed. The interesting consequence is that the machine can be anything: it has no public address to defend.
A release is a dated directory and a symlink. Deploying flips the symlink and reloads; rolling back flips it to the previous one. That is the whole mechanism, and it is deliberately dumber than anything a platform would give me, because at three in the morning I want a mechanism I can explain to myself in one sentence.
What it buys is that I now have to answer questions I could previously ignore. What happens when the box reboots. How I find out the tunnel dropped. Whether the thing I deployed is actually the thing that is being served, which is now a script that compares the origin against the edge and refuses to call a release shipped until they agree. None of that is glamorous. All of it is the part I did not understand before.
The managed copy is still there, one command away, and I intend to keep it there. Owning the hardware is only appealing while you also own a way out.