Hosting your vibecoded slop safely

I wanted to easily deploy my vibecoded apps and have links that I can easily share with my friends. Below is a short guide for how I approached this and the reasoning behind it. Think of this post as an inspirational design doc that you can paste into your favorite clanker and adjust to your needs and turn into a step by step implementation that fits your own requirements.

Why not use Cloudflare/AWS/BigCloud (tm)?

I think you can get far already by using Cloudflare or even AWS for such a thing. Coding agents are really good with working with Wrangler and Terraform, so you can ask them to do this for every project and get it done with. This is how I started for example with CF for smaller projects that are a bunch of workers and DO. This however comes with a big tradeoff: you're constantly worrying that your coding agent may nuke your entire project at any of its steps and then gaslight you about it. Then you'd have to rebuild everything from scratch. This gets even uglier when you take into account that you're limited to the cloud provider offerings and you may run into limits for things you need but can't get yet. For example with CF, I wanted to use different programming languages other than TS and even though it's possible, it's not really ideal. And you're also constantly worrying about costs even when using generous free plans.

To be clear, I'm not avoiding the cloud. I'm avoiding depending on it. In my case, I'll keep using CF DNS proxy and Zero Trust: both are free and easy to replace, and losing them wouldn't hurt.

Requirements

• Runs on my own servers where I have root access. This can be anything, but in my case I have a few Hetzner VPS boxes laying around so I'm using them.
• Dockerizing the vibecoded app and using Kubernetes for managing it.
• Kubernetes with stateless workloads + separated VPS for storing states (DB server, Redis, object storage).
• All apps are private by default unless made explicitly public.
• GitOps for everything. This includes things like ArgoCD and Helm charts, but also Terraform for setting up worker servers.
• Preview URLs for pull requests.

Implementation

• At least 3 servers: k3s control plane, k3s worker(s), DB/Redis/storage server.
• Install Tailscale on all servers so they are reachable by you and you can later lock everything. For the k3s worker and state VPS you can set them up on their own private network (VPC).
• Block all inbound traffic on all servers. On k3s worker only allow 443 with CF IPs as inbound everything.
• Install ingress controller (Envoy Gateway + MetalLB), TLS cert manager. Add your domain to CF, make it proxied by CF so that it takes care of TLS termination on your behalf.
• Install ArgoCD + Helm. This is important so that everything is later committed via Git and can be easily recovered.
• Push your app to GHCR + pull from it.
• Setup sealed secrets for environment variables.
• Setup CF Zero Trust: I have a catch-all *.your-domain.com as only admins (whitelisted my own emails). So every new app is private by default. Then on each app, I assign its own policy: public, whitelisted emails (only users) or just me (only admins).

• Coding agent: you can run this locally inside a Docker sandbox or have it deployed into the worker on its own pod. I tried both, found the local approach much more convenient. When the coding agent really needs to verify UI, for example, it can just push a new PR and use the preview URL. You'll also need to setup some skills for the agent on how to deploy (using your ArgoCD repo) and how to debug prod via kubectl.

Conclusion

Congrats, now you can push to prod your vibecoded slop without worrying too much about it. One major tradeoff after implementing all of this is that you have to maintain it. But with coding agents and having all of the setup documented via skills, this is much easier than you think. Additionally, if one of your vibe coded projects takes off and you really want to take it to prod, you now have a much easier setup to port into its own cluster.