I Run a $1M SaaS Portfolio on This Box (Self-Hosted)

Key Concepts

• Bare Metal Servers: Physical servers rented from a provider (Hetzner) rather than using virtualized cloud instances.
• K3S: A lightweight, certified Kubernetes distribution designed for resource-constrained environments.
• Docker/Containerization: Packaging applications and their dependencies into isolated units.
• Helm: A package manager for Kubernetes used to define, install, and upgrade complex applications.
• CloudNativePG: A Kubernetes operator that automates the lifecycle management of PostgreSQL databases.
• WireGuard: A communication protocol used to create secure, private tunnels between servers.
• Origin Isolation: A security strategy where the main application servers are hidden behind a disposable "edge" node.
• PG Vector: A PostgreSQL extension for vector similarity search, used for RAG (Retrieval-Augmented Generation) and AI applications.

---

1. Infrastructure Architecture

The speaker transitioned from AWS to a self-hosted "cloudless" architecture to avoid unpredictable billing and vendor lock-in.

• Hardware: Three Hetzner servers (one dedicated, two auction servers).
• Orchestration: Uses K3S to manage containerized workloads. Every component (API, frontend, background workers) is a Docker container.
• Deployment Pipeline: Replaced GitHub Actions with a self-hosted Git service (Gitea). Pushing code triggers a pipeline that builds a Docker image, pushes it to a registry, and uses Helm to perform a rolling update in Kubernetes, ensuring zero-downtime deployments.

2. Data Management

• PostgreSQL: Replaced DynamoDB with PostgreSQL. The speaker argues that relational databases are better suited for standard SaaS data models (users, workspaces, subscriptions).
• Automation: Uses CloudNativePG to handle database operations, including automated failover, backups, and restores.
• Backups: Configured via simple YAML files, pushing data to object storage (Hetzner storage box + an external provider) for redundancy.
• Caching & Search: Uses Redis for caching/queues and PG Vector for vector search, noting that PG Vector is highly performant and eliminates the need for specialized third-party vector databases.

3. File Storage

• MinIO: An S3-compatible object store used for user-uploaded media and assets.
• Risk Assessment: The speaker identifies MinIO as a "yellow flag" due to the project moving to maintenance mode and focusing on enterprise-only features. While acceptable for non-sensitive social media assets, the speaker advises caution for businesses handling critical legal or financial documents.

4. Security and Traffic Management

To avoid exposing servers directly to the internet, the speaker employs Origin Isolation:

• Public Edge: A small, disposable VPS acts as the entry point for web traffic.
• WireGuard Tunneling: The public VPS connects to the internal cluster via a WireGuard tunnel. The internal servers do not accept incoming connections from the public internet, only from the tunnel.
• Firewalling: Hetzner’s interface is used to block all traffic to the main cluster except from the public VPS IP.

5. The Role of AI in DevOps

The speaker argues that the "brutality" of self-hosting is mitigated by AI:

• Methodology: Granting an AI agent read-only access to the Kubernetes cluster allows it to analyze logs, inspect ingress configurations, and diagnose deployment failures in seconds.
• Learning Curve: AI transforms infrastructure management from "reading documentation" to "learning while building," making it accessible for non-DevOps engineers.

6. Key Arguments and Philosophy

• Ownership: The speaker contends that relying entirely on managed cloud platforms makes a business "fragile" and essentially owned by the provider.
• Practicality over Scale: Kubernetes is used not for "hyperscale," but for standardization. It allows multiple products to be deployed using the same clean, repeatable framework.
• Strategic Independence: Self-hosting provides the ability to move, rebuild, or replace providers without needing to rewrite the entire application architecture.

Synthesis

The transition to self-hosting is presented as a strategic move to regain control and reduce costs. By leveraging modern tools like K3S, CloudNativePG, and WireGuard, and utilizing AI as a diagnostic partner, founders can manage complex infrastructure without needing a dedicated DevOps team. The core takeaway is that infrastructure management is a foundational skill that provides long-term business autonomy, and the barrier to entry is significantly lower in 2026 than in previous years.