> this server is physically held by a long time contributor with a proven track record of securely hosting services. We can control it remotely, we know exactly where it is, and we know who has access.

I can’t be the only one who read this and had flashbacks to projects that fell apart because one person had the physical server in their basement or a rack at their workplace and it became a sticking point when an argument arose.

I know self-hosting is held as a point of pride by many, but in my experience you’re still better off putting lower cost hardware in a cheap colo with the contract going to the business entity which has defined ownership and procedures. Sending it over to a single member to put somewhere puts a lot of control into that one person’s domain.

I hope for the best for this team and I’m leaning toward believing that this person really is trusted and capable, but I would strongly recommend against these arrangements in any form in general.

EDIT: F-Droid received a $400,000 grant from a single source this year ( https://f-droid.org/2025/02/05/f-droid-awarded-otf-grant.htm... ) so now I’m even more confused about how they decided to hand this server to a single team member to host in unspoken conditions instead of paying basic colocation expenses.

>We worked out a special arrangement so that this server is physically held by a long time contributor with a proven track record of securely hosting services.

Not clear if "contributor" is a person or an entity. The "hosting services" part make it sound more like a company rather than a natural person.

The OSU Open Source Lab gives machines to groups in their datacenter: https://osuosl.org/services/hosting/

It has hosted quite a few famous services.

There is nothing wrong with hosting prod at home. A free and open source project needs to be as sustainable and low maintenance as possible. Better to have a service up and running than down when the funds run out.

> I know self-hosting is held as a point of pride by many, but in my experience you’re still better off putting lower cost hardware in a cheap colo with the contract going to the business entity which has defined ownership and procedures. Sending it over to a single member to put somewhere puts a lot of control into that one person’s domain.

If they really want to run it out of a computer in their living room they should at least keep a couple servers on standby at different locations. Trusting a single person to manage the whole thing is fragile, but trusting a few people with boxes that are kept up to date seems pretty safe. What are the odds they'd all die together? Paying a colo or cloud provider is probably better if you care about more 9s of uptime, but do they really need it?

Yup. But the same can happen in shared hosting/colo/aws just as easily if only one person controls the keys to the kingdom. I know of at least a handful of open source projects that had to essentially start over because the leader went AWOL or a big fight happened.

That said, I still think that hosting a server in a member's house is a terrible decision for a project.

Is colocation not considered to be "self-hosting" in the cloud era?

> a $400,000 grant

IDK if they could bag this kind of grant every year, but isn't this the scale where cloud hosting starts to make sense?

It's just a build server no? If that's the case it's not the end of the world.

Or does it also serve the APKs?

400K would go -fast- if they stuck to a traditional colo setup. Donations like this are rare and it may be all they get for a decade.

Personally I would feel better about round robin across multiple maintainer-home-hosted machines.