/ blog
WODBO Wars: why Vercel doesn't hold a single password

A friend asked me where WODBO Wars was hosted. I said Vercel. He was fine with that for a second, and then came the question I’d been comfortably dodging: “so why do you sometimes have to restart something when it breaks?”
That’s when I realized I’d been answering wrong for months. The game doesn’t live in one place. It never did. And recently that answer changed again.
Vercel has the portal. Only the portal. Astro, static pages, rankings, account creation — that boring layer everyone sees first. No database there. No env var with the MariaDB password. No direct connection to the game server. The portal just calls an API over HTTP, and that’s it. Honestly, it’s the part that keeps me up the least at 3 a.m.
And that didn’t change. Vercel doesn’t hold a single password. Not because I’m a security genius. Because the front doesn’t need secrets to exist. If someone walks off with the portal, they walk off with HTML. Not the world.
The API, on the other hand, started at home. An LXC in the homelab, PHP, HTTPS, MariaDB in the same container. Registration, login, characters, profiles. And Canary, the game server, in another LXC, writing to that same database, because it was the source of truth for everything. It started that way for the same reason I already told when I spun up the server: because I can. Self-host, break things, learn, tweak the map at weird hours. The lab was the natural place.

It made sense.
Until it didn’t.
Somewhere in the middle, Turso showed up — a cloud replica of what happens in MariaDB. Rankings, players online, the kind of stuff that can lag a few seconds without anyone caring. Login, no. If login read a lagging replica, someone could register, walk in right away, and hit an account that “doesn’t exist yet.” A user-facing bug waiting to happen, dressed up as an optimization. So login and registration still go straight to MariaDB. Not out of shyness. Out of common sense.
Today the API and the game no longer live in my room-office. They live on a Hostinger VPS. The lab went back to what it should always have been for this product: experimental. The world, with people inside it, stopped depending on whether the power was on at home.
Why? Because I don’t have a UPS. Period. It sounds un-epic next to architecture talk, but that’s the real reason. I live and move through places where a blackout isn’t a Twitter anecdote — it’s part of the landscape. Networks that flicker. Restarts you didn’t ask for. And when the LXC died because the power went out, it wasn’t a cute homelab incident to retell later with charm. It was a Wednesday night, people wanting to play, messages because the world had vanished. Ranking at zero. Login dead. My “because I can” turned into “because there was power today.”
That’s when I understood something self-hosting doesn’t romanticize enough.
There’s a huge difference between breaking things to learn, and promising someone else their free time.
WODBO crossed that line the day it stopped being only mine. Real users, constant feedback, guilds, people at night — I already told that story. This post is the practical consequence: if you’re going to ask someone for patience, don’t also ask them for your neighborhood to have stable electricity.
Moving the game to Hostinger wasn’t giving up. It was admitting that nostalgia doesn’t replace a UPS I don’t have. The lab is still there to experiment, migrate Canary at dawn, try dumb ideas. Production for the world, no.
What I didn’t see coming at the start is that “because I can” turns, over time, into on-call. If the API goes down, it isn’t aesthetic: it’s people who can’t get into a game they chose for their free time. If Turso stalls, there’s a MariaDB fallback on the rankings so at least something shows. I wrote that fallback one night after half an hour of zeros on the ranking and three people messaging me worried, like the world had emptied out all at once.

Nobody forces me to keep it up. I keep it up because at some point it stopped being only mine.
So in the end I told my friend the full truth: the portal is on Vercel, without a single password. The game and the API are on Hostinger, because my house has no UPS and I’m not going to pretend power is an SLA. And there’s a cloud replica for whatever can lag a bit. Every piece is there for a reason I can explain without inventing anything.
It isn’t the most elegant architecture out there. It’s the one I understand, and the one that survives a blackout in a remote area. In a project that started as nostalgia and now asks for real on-call, that’s enough for me.