Notes
Short entries about how these machines are kept. Written for whoever has to debug one of them at an inconvenient hour, including a future version of me.
Amsterdam machine moved to a new address
The Netherlands machine now answers on a different IPv4 address. DNS was updated and the certificate was reissued against the new address, so both the plain HTTP redirect and HTTPS work the same way as before. If you cached the old address, clear it.
Certificates renew on their own
Each certificate is checked and renewed automatically by a scheduled job once a day. If this page ever shows a browser warning, the renewal failed rather than the site being down — mail the address in the footer and I will fix it.
Why the site is static
One HTML file per page and one stylesheet. Nothing to patch weekly, nothing to inject, no visitor analytics to store. A page that cannot be hacked is a page that does not need babysitting.
Backups are only real after a restore
Snapshots live off-site, on a different provider from the machine they came from. The interesting part is not taking them but proving they come back, so a restore is run against a throwaway machine whenever the backup tooling changes.