tl;dr — A Ghost vulnerability sent me back to my DigitalOcean droplet. I patched Ghost, moved the blog to Publii and Cloudflare Pages, and dropped the droplet. I also scheduled an agent to check for security updates across my home lab every week.
I turned off the droplet when I learned my Ghost version was vulnerable. An agent took a snapshot, upgraded Ghost while public web traffic was blocked, and checked the site before I opened the firewall again.
I didn’t want to keep a server around just to publish blog posts. I moved the site to Publii, which builds the pages on my Mac, and Cloudflare Pages, which serves them. The new site kept the old look and URLs. An agent checked 77 routes and the 404 page. Once the new site was up, I dropped the droplet.
The home lab security work was bigger than one blog. I had agents review findings across the systems I run, then built an agent on my own agent platform to check for updates every week. It looks for fixes, works through the ones it can safely apply, and reports what needs review.
I still want to know what an update will do before it touches a service. Some fixes are simple; others can restart something I care about. The agent can do the checking and maintenance, but I keep the review step for changes that could cause trouble.
My blog no longer needs a server, and I have a weekly process for keeping an eye on the servers that remain.
All of this was started and finished today, costing ~15 minutes of my attention.