The whole stack is a folder
Static files, one small server, and a certificate that renews itself. I wrote it down mostly to see how little there is.
Someone asked what this site runs on and I realised the honest answer is “not much”, so here it is written out.
The pages are generated on my laptop and handed to nginx as files. There’s no application server, no database, no queue, nothing that can crash at three in the morning. If the build breaks it breaks while I’m looking at it. What ends up on the server is a directory.
The full list:
- A small VPS.
- nginx, serving a folder.
- A Let’s Encrypt certificate on a renewal timer.
- Gzip, some cache headers, a handful of security headers.
That’s it. It has no interesting failure modes because there’s almost nothing in it to fail.
It’s fast because it’s lazy
A static file is the least work a web server can do. Nothing to render per request, no query, no cache to warm or invalidate. nginx reads from the page cache and writes to a socket. Response times are fractions of a millisecond and they don’t move much under load, because there’s nothing that gets slower when more people show up.
It’s also the easiest thing to keep secure, mostly by not having features. No upload handler, no comment form, no admin login, no session to steal. The attack surface is more or less “does nginx have a bug this month”, which is a much smaller question than the one a typical site has to answer.
When this stops working
The obvious caveat: this works because the site is small and one person writes it. Add search, or comments, or accounts, and you’re back to running an application. At that point the boring option is a different boring option rather than none at all.
But a lot of sites are, functionally, a folder of documents that someone has wrapped in a CMS out of habit. Worth checking whether yours is one of them before reaching for anything bigger.