Nowadays, if you really don't need a server, then don't spin up one. In this case, the author does not need a server. If you think you might need to do some backend processing, see if you can use 'serverless' functions and offload the admin work to someone else. If that doesn't suffice, maybe something like App Engine. Still not enough? Ok, so maybe a AWS batch job (or equivalent). Does it have to run all the time? Then maybe a container managed by ECS or similar. None of this works and you need an actual VM? Fine, spin up one. But now you have to care for it and keep it monitored, patched and secured.

You can just use Cloudflare Workers to do whatever serverless things you need.

I think it's customary to declare any product affiliations on HN if your post is promoting a product.

I was previously using Cloudflare in conjunction with a Linode server. The disadvantage of this, however, is that you need to ensure that one server never goes down otherwise anyone hitting a cold cache would see the site down.

Also, why do you need a server at all? If you are doing nothing but serving static files then why incur the overhead of maintaining LetsEncrypt certificates and writing Nginx config files? AWS provides a simple interface in which you can view and manage your static files without having to ssh into a server.

On the point of price, I'm predicting my total cost of hosting for a site serving roughly 40-45k users per month will be roughly $7/month. All whilst minimizing the amount of administration time required and monitoring of a more traditional system.

Hope this clarifies this, would be keen to hear any counter thoughts!

We use Azure and we have multiple sites we're getting that visitor count (or more, for PPC campaigns) for way less than $7/mo using Cloudflare/Azure Edge/Web Apps. This might not work for a single site, but multiple sites on a service plan we can handle way more visits per site (especially if it were static) for $2-$3/site/mo and we could auto scale if needed though that would raise that number, it would not exceed your number. Unless I'm missing something, I don't see how $7 isn't viewed as rather expensive for that visitor count.

Sure! here are my counter thoughts: What if your site changes every 5 minutes, and is about 100Mb?

12x24x100= lots of mb per day

S3 costs (if only for the bandwidth) will be greater than a server with a fair share unlimited connection

Also, cloudfront non free plans will kill you - again because of the bandwith.

> What if your site changes every 5 minutes, and is about 100Mb?

This is probably an exceptional rate of change for the _vast_ majority of static sites.

> This is probably an exceptional rate of change for the _vast_ majority of static sites.

I also doubt that many static sites have much "overhead" related to maintaining nginx config files and Let's Encrypt certificates.

Sure, but then there's the whole overhead of maintaining a server.

Clarify this: "The difference between zero servers and one server is much larger than the difference between 100 servers and 101 servers"

The person you're talking to is likely thinking of the "100=>101" case, not the "0=>1" case.

Maintaining a server is not complicated nowadays, with ansible. I have a few dozens, some of them don't need any admin for years (like linode), the others have debian testing and ansible to deploy matching configurations and keep up with the updates

S3 is going to be more reliable than anything you can reasonably be expected to administrate yourself, and it's cheaper as well. It's also supported by all CI tools, so you just script the deployment based on git commits.

My linode hasn't been updated for years, still runs nginx just fine. port knocking means little risks of intrusion, as ssh is on a non standard port too.

My deployment is shell scripts launched by systemd timers

Instead of downvoting, can someone please explain why this setup that is stable is not up to whatever standards?

Most likely your "hasn't been updated for years". Given all the security vulnerabilities that have been disclosed, including things like Heartbleed, I hope you meant your "setup hasn't been changed in years".

No, I run nothing like apt update. Why would I fix something not broken? And no, I do not run ssl. I like to limit the number of moving parts.

Anyway, if someone can manage to access my servers with only nginx serving static files, they deserve to 0wn it :-)

You're exposing your users to MITM attacks by not deploying SSL.

While your setup stays the same, major security flaws are found in different parts of the stacks.

Security is a process, by neglecting it you're paying for resources that are abused by attackers in order to harm other users.

If you want to mitm my static site with no login and mostly PDFs, you are welcome to.

Security is a state of mind, not a bunch of recipes. Some things must be protected, some for some others it doesn't make sense

How do you know your users are seeing "a static site with no login and mostly PDFs"?

Security is a state of mind, indeed.

I know because I make the site and use it too

I know, but now anyone can:

* Inject a cryptocurrency miner JavaScript into your page during the transmission of your static HTML page to your clients, without you or your users knowing it [1]

* Injecting explicit, illegal image material that would get your clients immediately in legal trouble for possession of such material, without you knowing

* Injecting a JS snippet that, instead of your site's contents, shows a fake antivirus page, telling the clients that your site is malicious and that a threat was eliminated by Fake Antivirus 10.0 and that they should immediately call Microsoft Support (Phone number in Bangladesh) for further "assistance". There they're told they need to get a full cleaning of the hard drive for only 99$ and are asked for their CC number

The point is: If you don't have end-to-end-encryption, you can never be sure what your users see. They might see your site - or some slightly modified version of your site, with a login box, phishing passwords from your users, abusing their trust in your brand.

A MITM has nothing to do with someone gaining access to your server. It's someone gaining access to infrastructure - a vulnerable public wifi, for instance.

[1] https://www.hacking.reviews/2018/01/coffeeminer-collaborativ...

Fair enough. I will enable https on cloudflare.

You have a single point of failure and a linux box (and CMS?) that needs to be constantly patched - how is that in any way comparable to the simplicity and scalability of dropping files onto an S3 bucket?

No cms. Nginx serving static files. Not patched or upgraded for years. Still running fine.

Doing anything else than putting cloudflare in front of my nginx is needlessly overhead- because cloudflare scales quite well!

I would say because using S3 for static sites costs pennies instead of $20 :-)