Self-hosting it reliably

Self-hosting is cheap to start and the running costs are paid in surprises. Almost all of them come from a mismatch between what you believe is true and what the machine is actually doing.

Restarting is not deploying. Whether a restart picks up your change depends entirely on how the code got into the image, and the same command is correct in one setup and useless in another. The symptom is a fix that works locally and not on the server, with no errors anywhere.

The firewall you configured may not be the one deciding. Cloud hosts put a network filter in front of the machine, so a port you opened can be unreachable and a port you closed can be exposed. Only a connection attempt from another network tells you the truth.

Growth crosses limits you did not know existed. A structure that scales with the square of something will be unremarkable for months and then hit a hard runtime ceiling. Combine that with a restart policy and one failed save becomes an infinite crash loop that no alert catches, because the service is technically always about to be running.

Alerting decays. A notification that was interesting at three events a week is noise at thirty a day, and the value of the channel is entirely in your willingness to look at it.

And the backup you have never restored is a hypothesis. Rehearse it, and you will find the gap every time.

The 19 notes in this area

Alerting that people actually read

Push notifications for a small operation: what deserves an alert, what does not, and how to stop a useful channel becoming noise.

Backups you have actually tested

What to back up when everything runs in containers, why the volume snapshot is not enough, and the restore rehearsal that finds the gap.

The credential cache you cleared is on another device

An old sign-in kept coming back after we cleared the app, the credential store and the browser, and after a full reinstall. Half the tokens lived in the cloud-synced keychain and were being restored from the phone.

Mounting keys and certificates into containers

Permission errors on mounted secrets are usually ownership mismatches between the host user and the container user, not permission bits.

Two modules from the same vendor, and load order decides which one breaks

Both modules work alone. Loaded together, the second fails with a missing-method error. Nothing is misconfigured; whichever loaded first won a version argument you never saw.

PowerShell modules break when Documents is synced to the cloud

Installing a module for the current user puts it in Documents. If Documents is redirected into a sync client, the module installs successfully and then fails to load.

Quadratic growth, a string limit, and a week long crash loop

A per-pair data structure grew as the square of the population, crossed a runtime string limit, and turned one failed save into 26,000 restarts.

Read the page before you pay a model to read it

Pages that matter to Google already publish their content as structured data. Extracting that costs nothing, returns exact values, and beats sending the prose to a model.

Remote disable does not survive a factory reset

Software controls on hardware you have posted to a stranger are a deterrent, not a control. What actually works is at the network layer.

Restarting a container is not deploying your code

Whether a restart picks up your changes depends entirely on how the code got into the image. Getting this wrong makes a fix look like it did not work.

Some permissions take 24 hours, so assign them on day one

Most role assignments apply within minutes. A few take up to a day, and you will discover which at the exact moment you need them.

Security defaults block device code sign-in, and the error does not say so

A tenant with no conditional access policies can still refuse a sign-in. Device code flow is blocked by the default baseline, and the failure looks like a permissions problem.

Your AI session dies with the laptop, and the transcript will not bring it back

You want to close the laptop and keep working from your phone. The fix is not syncing your history, it is moving the process onto hardware that never sleeps, and reaching it over an outbound channel.

The sign-in page ignores what you typed and offers a different address

A user types their correct address and the sign-in page redirects them to an old one. It looks like the device is caching credentials. It is not the device, and clearing the device will not fix it.

Publishing a test site without touching DNS

A wildcard DNS service plus a reverse proxy gives you a real HTTPS URL for a staging site, with no records to add and nothing to clean up.

The backup said OK and there was no offsite copy

The nightly job dumped every database, failed to upload any of them, reported one error, and then deleted the oldest copy that was still offsite. It ran that way for five nights.

The model number is not the specification

Hardware sold under one model name can ship with materially different internals depending on the batch or region variant.

Your build output is not your live site

A statically deployed site collects production-only edits that no build reproduces. Deploying a fresh build then silently removes them, and nothing warns you.

Your host firewall is probably not the one deciding

On cloud hosting, a provider level firewall sits in front of the machine. Rules you set on the host can be irrelevant in both directions.

Other guides

• Running n8n in production
• Running an AI support desk
• Automating orders, payments and returns
• Knowing where your traffic actually comes from
• Being cited by AI search
• Email that actually arrives