Self-Hosted Azure Deployment
Context and motivation
I could have pushed this site to Vercel and forgotten about it, but a systems administrator who outsources his own server doesn't say much about himself. So I served it from an Azure VM that I administer, and the deployment ended up being one more portfolio project.
Behind the domain there's an AlmaLinux machine with Nginx serving the static Next export, Let's Encrypt HTTPS that renews itself and Cloudflare proxying in front. The rest, DNS, firewall, SELinux, access, I configured piece by piece, so when something breaks I know where to look.
There were bumps along the way. The new account had the cheap VM family restricted in almost every region, I diagnosed it with `az vm list-skus` and ended up in Spain Central because of it. And with 1 GB of RAM the installs kept dying out of memory, so I added 2 GB of swap.
Technologies
Main features
- AlmaLinux 9 VM (RHEL family) provisioned in Azure within the free tier
- SSH-only access with key auth and port 22 restricted to a single IP, with fail2ban and firewalld as a second layer
- Nginx serving the static Next export, with SELinux enforcing and the contexts adjusted
- Own domain with DNS delegated to Cloudflare, the site behind the proxy and mail on DNS only
- HTTPS with Let's Encrypt and automatic renewal, verified through the proxy
- SSL Full (strict), HTTP/3 and a hidden origin, the VM only accepts web traffic coming from Cloudflare
- Budget and spending alert in Azure, the only thing I actually pay for is the public IP
Gallery
Conclusion
The result is a production site on a machine I control end to end. SSH only admits my IP, the origin answers to no one but Cloudflare, and the bill is around 4 euros a month.
If tomorrow it needs a bigger machine, it's a matter of resizing the VM in the portal. For a portfolio's traffic, the free tier has headroom to spare.