Two days is enough to go from nothing to a server you own, running a real site over HTTPS, with automated deploys and backups. Here is the plan, with the commands that matter and the parts that reliably eat time.
Rent the smallest useful instance — a shared-vCPU 2 GB machine runs a few euros a month at Hetzner, or $6 at DigitalOcean or Vultr. Choose the current Debian or Ubuntu LTS. Before anything else: create a non-root user, copy your SSH key with ssh-copy-id, then in /etc/ssh/sshd_config set PermitRootLogin no and PasswordAuthentication no and reload sshd. Open only what you need:
sudo ufw default deny incoming
sudo ufw allow OpenSSH
sudo ufw allow 80,443/tcp
sudo ufw enable
sudo apt install -y unattended-upgrades fail2banBudget 45 minutes. The common time sink is locking yourself out — keep the provider's web console open in a second tab until key-only login is confirmed working.
Use Caddy rather than nginx for this. Automatic certificate issue and renewal is the default behaviour, not an add-on, and the config is four lines:
example.com {
root * /srv/www
file_server
encode zstd gzip
}Point the domain's A record at the server first — certificate issuance fails until DNS resolves, and propagation can take anywhere from a minute to an hour. Once it resolves, sudo systemctl reload caddy and you have a valid certificate that renews itself.
Do not overbuild this. A single rsync command is a complete deployment system for a static site:
rsync -avz --delete --exclude '.git' ./public/ deploy@example.com:/srv/www/Add --dry-run the first time. If you want it in CI, generate a dedicated SSH key for the deploy user, restrict it with a command= prefix in authorized_keys, and store the private key as a repository secret.
Use restic against object storage. restic init, then a daily cron running restic backup /srv /etc with restic forget --keep-daily 7 --keep-weekly 4 --prune. Storage for a small site is well under a gigabyte, which costs cents. The step people skip: run a real restic restore latest --target /tmp/verify once. An untested backup is a hypothesis.
Point a free external uptime monitor at the homepage on a 5-minute interval — external, because a monitor on the same box tells you nothing when the box dies. Add a certificate expiry check as a second alert. Then journalctl -u caddy -f to see live logs, and set log rotation so you do not fill the disk in six months.
Server around €4-6 a month, domain roughly €10-15 a year, backup storage under a euro. Total time, if DNS behaves, is six to eight hours of real work spread over two days. The part that overruns is always DNS propagation and the first certificate issue — start the DNS change on Saturday morning so it has settled by the time you need it.