My Server Sleeps at Night. That Turned Out to Be a Security Feature.
I gave my side project a sleep schedule on Krova Cloud to save money — power off at 1 AM, wake at 7. The surprise side effect: zero attack surface while asleep. Here's the setup, the cron, and the trade-offs. At 3 a.m., my production server is off. Not down — off. On purpose. It started as a money thing. The project has human hours: traffic ~8:00 to midnight, dead until morning. The old VPS ran…
The author gave their side project a sleep schedule on Krova Cloud to save money. The project's production server goes off at 3 a.m. and wakes up at 7 a.m. The server, a Firecracker microVM with its own kernel and a private NAT, has a cron job that powers it off and on. This schedule removes a third of the compute time from the bill and costs only pocket change.
While the server is asleep, it has zero attack surface as no SSH daemon or web server process runs and there's no public address. The author verified this by checking the server's state and waking it up, then checking the system uptime. The sleep schedule also forced the architecture to be stateless, with all state on disk, preventing lazy state management.
The author set up a health check to ensure the server boots correctly after waking up. They recommend this approach for side projects, internal tools, and staging with quiet hours, but not for 24/7 global SaaS. The sleep schedule does not replace the security walls of a server but shrinks the window of vulnerability. The author encourages readers to reframe the "always on" mindset as an expensive, attackable assumption.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
