A Self-Hosting Manifesto

The manifesto is universal. The application is not. Use the lists below as a quick filter before the technical chapters.

The pattern we see working: self-hosted for the steady core, cloud for the experimental edge. Most of the bill, most of the data, and most of the operational pain lives on the steady core. Owning it is where the leverage is.

AI does not run on a clever model alone. It runs on your data, and it needs that data continuously, not once. Every assistant, every agent, every retrieval pipeline is only as good as the corpus it can reach: your tickets, your wiki, your logs, your code, your history.

If that data lives in someone else's SaaS, your AI future is rented too. You get whatever API, rate limit, and export format the vendor decides, and you help train their model on the way. When you host the data, you have privileged and durable access to it. You point a model at it on your terms, build the integrations you need, and keep doing it as models change. The data stays; the model is swappable.

A concrete example. Because we self-host Redmine, we built a Redmine MCP server. Our internal assistants read and update projects, issues, and time entries directly, behind our own authentication and audit, with nothing leaving the building. That integration exists because we own the system on both ends. On a hosted tracker we would be waiting for a vendor to ship it, or doing without.

This is the compounding edge inside the strategy pillar. Owning your data today is what makes the AI you build on it tomorrow yours, not a feature someone else can price, throttle, or deprecate.

Deep dive: the Redmine MCP server we built.

Enterprise hardware is a trap: redundant power supplies, hot-swap drives, five-year warranties, approved hardware lists maintained by people who have never logged into a server. We split hardware by the job it does, and each side is cheap, understood, and replaceable.

Replaceability over reliability. Enterprise hardware promises five nines, then makes you wait six weeks for an RMA. We take the opposite bet: assume everything fails, make replacement trivial, and let architecture (failover, ZFS, fast reimage) provide the uptime instead of a warranty card.

The mini PCs draw less power than one 1U enterprise box: about $15/month in electricity, under two square feet, negligible heat. An equivalent always-on AWS deployment runs $500+/month with no hardware to show for it after three years.

We run exactly two operating systems in production: Alpine Linux for stateless workloads, FreeBSD for anything stateful. Everything else is excluded by default.

Alpine Linux is under 100MB, boots in under three seconds, uses musl libc, and refuses systemd. The killer feature is diskless mode: the OS runs from RAM with only the bits you choose persisted via lbu, so any rogue change or accidental rm is gone on reboot. A fully operational Docker host fits in 175 to 350MB of RAM. Use it for CI runners, container hosts, edge networking, cache proxies: cattle, not pets.

FreeBSD is what we reach for when data integrity or networking matter. ZFS gives copy-on-write, snapshots, and compression without a hardware controller. PF is a firewall a human can read. pkg with poudriere covers binary and custom builds. sysrc keeps configuration in one place that survives upgrades. Use it for storage nodes, load balancers, edge routers.

What we do not run: Debian and Ubuntu (backported into incoherence, plus auto-starting services we never asked for), RHEL and CentOS-likes (outdated packages, subscriptions, RPM), NixOS (learning curve costs more than it saves at our scale), anything with systemd by default, anything that ships snap or flatpak.

Measured outcomes from our migration:

• Storage footprint down 25 percent (ZFS compression, no useless packages)
• Known vulnerabilities down 50 percent (no systemd, minimal install)
• Maintenance time roughly halved (less magic, better tooling)

Deep dives: declarative Linux, our Linux/Unix journey.

Security is a never-ending process, not a validation step. Not a form for an insurer once a year, not an ISO certificate on the wall, not a WAF you bought because PCI 6.6 told you to. It is the boring, repetitive work of reading changelogs, patching servers, killing dead services, rotating credentials, and refusing the shortcuts everybody wants to take.

WAFs are mostly theater. They are either in log-only mode (useless), in blocking mode permissive enough to wave through a forged user agent (useless), or blocking legitimate traffic and generating support tickets (worse than useless). Every dollar on a WAF is a dollar not spent on code review, dependency scanning, SAST, DAST, or a good pentester. PCI 6.6 lets you choose. Code review is cheaper, more effective, and makes the product better.

Alert on what matters, log everything else. We only page on a successful attack or a credible indicator of one. Failed logins, denied packets, and scanner noise flow into OpenObserve, all queryable, none of it waking anyone. Train the team to read pages by making pages worth reading.

Deep dive: Security is a never-ending process.

Most teams treat compliance like a sacred text, citing ISO 27001, PCI DSS, and SOC 2 as if carved in stone, then refusing reasonable changes because "the auditor would never accept that". Read the standards instead. They contain risk-based logic and emergency clauses. They are frameworks, not laws.

The right answer to "show us your asset inventory" is a query against Jinn, not a spreadsheet last accurate in 2023. To "show us your patch SLA," a chart from OpenObserve. To "who has admin access," the output of a PyInfra script. When you own the inventory, the deploy pipeline, and the logs, every audit artifact is one query away. The team that automates compliance ships fast and passes audits. The team that types it into Word twice a year does neither.

Deep dive: Compliance standards are not carved in stone.