Cost drove the architecture of this blog
Implementing industrial strength solutions at home can be complex, but at least it's expensive! Scale your cost and complexity to your project.
published_at:
I took on the project of creating my own dev blog from scratch as a test bed for new architectures, different technologies, and a bit of a distraction from my day-to-day.
Initial architecture
How hard could it be? I'd imagined a few Single Page Applications (SPAs) hosted via basic S3, for running API calls against AWS API Gateways accessing DynamoDB either directly or via Lambdas. I'd keep everything under the free-tier and I'd be getting basically free hosting!
AWS CloudFront: good
Easier said than done. It turns out that the simplest S3 hosting isn't compatible with https, which is a bit of a requirement for a modern website, especially if you're considering doing any kind of Auth (which I was). So that kicked me over to using CloudFront, which it turns out is very understandable and easy to use. With this low hanging fruit out of the way, I figured I'd tackle the most difficult problem: Auth.
Auth woes, AWS Cognito: mid
My initial attempt was at using AWS Cognito. While still hoping to use API Gateways, I found out about the wild world of Lambda@Edge and Authorization@Edge. After a good amount of tinkering with these, I finally gave up on going for the extra credit solution and sought the easier, tried and true method: a container running via ECS task.
It's the networking that'll get ya
Pushing a Docker image to ECR and running it via ECS Fargate task is kind of my bread and butter. I opted for the extra learning experience and set all the networking up by hand! But eventually I got the terraform/OpenTofu to work! I even hit my estimated $25/mo. bill.
Sure, with a little autoscaling I could trade a little inconvenience for money here and there, maybe saving up to $5/mo., but the VPC, ALB, and attached networking turned out to be the real cost centers. Even after all that sunk cost, I finally decided that the cost (and frankly, the complexity) was too high for the ROI: $0/mo.
Hybrid homelab
Many DIY home-tech-tinkerers host their home labs using TailScale and a bookshelf full of Single Board Computers, taking a page from that book, I settled on TailScale for both hosting and Auth (in a way). For the cost of the smallest EC2 instance, I can run Nginx and TailScale on the same little machine to proxy traffic to TailNet connected servers anywhere! One could even skip an ALB in routing directly to an ECS task.
The TailNet solution is not perfect. It feels cludgey and hand-rolled. Network and power issues can cause intermittent outages across services running anywhere. But this all comes with fun up-sides as mitigations, too. I made my blog admin generate this blog as a flat file in S3, so it can't go down for network or power issues at home and the hosting is extremely fast.
What next?
I love using Docker containers to encapsulate and run services, as I've been doing for years. My mental model of containers was always focused on the idea of the container as a self-contained server, but this project has opened my eyes to Docker containers as off the shelf components to be composed. I want to design and use containers more like Legos than small servers. There are all sorts of directions I see this going, but the one I'm most keen to explore is the idea of an OAuth/Nginx-proxy as an Auth side-car (like a middle-ware, but worn on the outside?).