They don't go away on their own, every installed snap is mounted as its own loop device and snapd keeps an older revision or two so it can roll back, so the number moves around after updates. snap list --all shows which snaps they are, if one says disabled that's the old revision and you can remove it with sudo snap remove <name> --revision=<rev>. about libation, if it's installed as a snap itself that could be the actual problem, snaps are confined and can't read folders outside your home or on other drives unless you connect the removable-media interface, so I'd check that before worrying about the loop devices.
ultimaluz
Good to hear it's been smooth, the caddy plugin was the main reason I looked at it in the first place.
oh, didn't know that, thanks for the heads up. deSEC still hosts dns for free if you bring your own domain I think, so a cheap one plus deSEC for the acme dns challenge still works, just not the free subdomain part
that's actually a nice idea, updating with people around makes it way less of a chore, and someone always knows the weird fix. I'd probably steal it if I had more than one box to look after.
same here on the reboots, I never let it reboot on its own either. for me the reboot wasn't the problem, it was needrestart bouncing nginx and postgres right after the upgrade, which you only notice if something long lived is running at that moment, like a stream lol
512mb and getting killed every morning at the same time sounds like a fun one to track down lol. a fixed weekly slot like your tuesday evening is probably the sanest setup honestly, I just know I'd forget.
yeah exactly, no reboot, it was needrestart restarting nginx and postgres after the systemd update. you're right that the timer is kind of the blunt fix, the cleaner one is probably telling needrestart to only list instead of restart ($nrconf{restart} = 'l' in needrestart.conf), or excluding nginx from it. I went with the timer because I still want things restarted, just not while I'm live
it's a single cheap VPS that only I look after, so I'd rather get security patches the same day than remember to log in and do it, I guess that's the tradeoff. and yeah you're right about scheduling, that was the whole fix, the default timer runs around 6 UTC plus up to an hour of random delay and that happened to land on top of the stream. moved it to the afternoon and it's been quiet since
nobody said desec.io yet, it's a non profit from berlin and they give free subdomains under dedyn.io, with a proper API, so you can do the DNS challenge for let's encrypt (there's a caddy plugin for it too). I haven't run a domain there myself so can't say how it is long term, but for a "try some things" domain it looks like the least shady of the free ones I guess.
Same conclusion here from the other side, I have a small multiplayer browser game where everyone paints cells on one shared grid (node, postgres, SSE), the client applies the paint right away and the server either confirms it or answers with a 409/429 and the client puts the old cell back. the rejection part is the one that took me longest honestly, a mutation that is valid locally but the server says no (out of charges, same color already there, world paused) and you need a different message for each, otherwise people think it's lag. conflicts are just last write wins per cell, but that works because every write is a row in an append only events table, so nothing is really lost and you can replay or undo. and on reconnect I don't try to merge anything, the client asks for the whole state again, at that size it's cheaper than being clever.
yeah thats the nice part, every app in its own box and if one breaks you just throw it away and start it again. for subdomains I ended up with caddy in front, it does the certs by itself so adding one is like 2 lines

on the fear part, in a healthy team the author still owns the change, the reviewer is a second pair of eyes not an insurance policy. what helped my people a lot was asking the author how they tested it and what happens if it goes wrong, if they can't answer that's your review comment right there. and if something breaks after you approved it, you fix it together and add a check so it doesn't happen again, nobody serious blames the reviewer for that