Hardening The Drew Archive

A funny thing happens once you publish something on the internet. At first you’re just excited to have a website online. Then people start reading it. Then someone leaves a comment. Then someone emails you. And eventually you realize you’ve quietly become responsible for keeping the whole thing alive.

That realization is basically what shaped the last few days of work on The Drew Archive. None of it changes how the site looks — almost all of it happened behind the scenes — but I think it’s some of the most important work I’ve done on this project so far.

Starting with an Audit

#

Before I changed anything, I had OpenClaw run a full audit of the server. The goal wasn’t just to hunt for security problems; I wanted an actual inventory. What version of Debian was I running? Which services were active? What had quietly drifted over the past several years, and what needed attention before it turned into a real problem?

Turns out the server had fallen behind. Nothing was broken — it was just overdue.

A Safety Net First

#

Before touching the operating system, I took a complete snapshot of the VPS through Vultr. If the upgrade went sideways, I wanted one-click recovery. Watching a snapshot sit in “Pending” for what felt like forever wasn’t exactly thrilling, but it was worth the wait. Only once I had a rollback plan did I actually move forward.

Upgrading Debian

#

The server had been running Debian 11 for years. OpenClaw handled the upgrade to Debian 12, carefully verifying every service afterward:

• Nginx
• HTTPS certificates
• SSH
• Remark42
• Website availability
• Configuration validation
• Package updates

Everything survived without incident — exactly the kind of maintenance you hope nobody ever notices.

Finding a Small Problem

#

The audit did turn up one real issue: Remark42 comments were working perfectly, but the administrative backup job had quietly stopped authenticating. The comments themselves were safe. The backups weren’t. I fixed that before moving on — a backup that silently died months ago is worse than no backup at all, because you don’t find out until the moment you actually need it.

Thinking Beyond One Server

#

Until now, my disaster recovery plan was basically “hopefully the VPS survives.” That’s not really a plan, so the next project was building one for real. The architecture ended up looking like this:

• Local VPS
• Vultr snapshots
• Nightly encrypted off-site backups
• Automated integrity verification
• Automated restore testing
• Failure notifications

Everything important now lives in more than one place.

Off-Site Encrypted Backups

#

For off-site storage I went with Restic backed by Backblaze B2. Restic encrypts everything before it ever leaves my server, so Backblaze never sees my configuration files, comments, or secrets — just encrypted data that’s meaningless without the repository password.

That balance fits my philosophy well. I don’t mind paying someone to specialize in reliable storage. I just don’t want to hand over my data to do it.

Proving It Actually Works

#

Backups don’t count until you’ve restored them. So after the first encrypted snapshot finished, OpenClaw restored it into an isolated directory. Hundreds of files came back exactly as expected, configuration files matched, and the Remark42 exports passed integrity checks.

I also updated the recovery documentation with the exact steps needed to rebuild the server from scratch. Hopefully I never need it — but if I do, the plan already exists.

Failure Should Be Loud

#

One more small improvement: notifications. I don’t want an email every night telling me everything worked — nobody reads those. Now I only hear from the server when something’s actually wrong. If backups stop working, I know. If integrity checks fail, I know. Silence means everything’s healthy.

Building Something Meant to Last

#

None of this makes the Archive more interesting to read. Visitors won’t notice Debian 12. They won’t know about Restic, encrypted backups, or recovery documentation. And that’s fine — the goal was never to impress anyone with infrastructure. It’s to build a place that’s still here years from now.

That’s really the thread connecting all of these recent changes: comments instead of social media, a custom email domain, privacy-respecting infrastructure, off-site backups. Owning as much of the stack as makes sense, while recognizing that specialists sometimes do a better job than I ever could.

The Drew Archive is still a small website. But I’m trying to build it as though I plan to keep it around for the rest of my life.