mecasasu.casa

mecasasu.casa answers one question end to end: what does it actually take for someone who has never touched a server to own one, secure it, and put their own software on the internet from it? The answer it argues for is a $44.88-a-year VPS, a cheap domain, and a coding agent with a terminal on the box — and the guide is written on the premise that the reader will not be typing most of the commands themselves.

The argument

The opening section is the thesis: people stall out not for lack of talent but because they are supervising an agent through a file explorer on their own laptop, terrified of every suggested change. Rent a machine that isn't your laptop, give the agent real permission on it, and the hesitation goes away — because the blast radius is a box you can rebuild in ten minutes.

What it covers

• Buying the parts — which VPS tier is a false economy, where domains are sold at cost versus where the renewal price doubles, and what a year really totals.
• Locking it down before anything else: stop being root, keys instead of passwords, passwords off entirely, every port closed but three, automatic banning of scanners, unattended security upgrades — with a section on the things that actually go wrong when you do this.
• Working the agent — mounting the server as a drive so there is no editor in the loop, planning with one model and building with another, clearing context early and leaving a note, and auditing what the agent remembers.
• Shipping: project layout and the boilerplate nobody remembers, just recipes worth having everywhere, GitHub without committing a secret, pointing DNS, nginx + systemd + TLS, infinite wildcard subdomains, a database per project, cross-compiling in Actions, code signing and what the warning screen costs to remove.
• Backups that hold — 3–2–1, grandfather–father–son rotation, the four things worth backing up, and the line the whole section exists for: a backup you have never restored is a rumour.

The live box

The claim "this page is being served by one of them right now" is checkable. A second page streams the host's real telemetry — processor and load, memory and swap, disk and inode pressure, per-interface network rates, the actual process table, and steal time, so a reader can see for themselves what a shared core does under a noisy neighbour. It is read directly from /proc by a Go binary and pushed over a single open connection every two seconds: no monitoring agent, no polling daemon, no time-series database. The page reports how many people are watching it, which is itself part of the demo.

Delivery

nginx in front of the Go service, static assets stamped with a build version, and the same hardening the guide preaches turned on for its own domain — a strict content-security policy that allows exactly one third-party origin, HSTS, framing denied, referrer and permissions policies set, MIME sniffing off. The guide would be less convincing served from anything softer.