Hosting and support
A maintenance retainer for a Django or Wagtail site: hosting, dependency updates, backups and someone who answers.
A website is not finished when it launches. It is finished when you stop paying for it — and between those two dates somebody has to apply the security patches, renew the certificates, watch the backups and answer the phone when something breaks.
What a retainer covers
- Hosting. On a server I manage, configured and provisioned as code so it can be rebuilt rather than repaired from memory.
- Updates. Django, Wagtail, the Python dependencies and the operating system — applied on a schedule, not when a scanner finds something.
- Backups that have been restored from. A backup job reporting success is not evidence of anything. The test is a real restore, and it is worth doing before you need it.
- Monitoring. Uptime, certificates and scheduled jobs. Especially scheduled jobs: a cron task that fails silently can do so for years, and usually has.
- A staging site that matches production. Same configuration, a copy of the real content. Changes get seen there before anyone else sees them, which is the difference between testing and hoping.
- Small changes. The ten-minute jobs that otherwise sit in a backlog for a quarter because nobody wants to raise a purchase order for them.
What it actually runs on
Servers in German or other EU data centres, which for most of my clients is not a preference but a requirement — a university, a museum and a research network all have to be able to say where personal data is processed, and "a US hyperscaler's European region" is a more complicated answer than it sounds.
The setup itself is deliberately ordinary: provisioned with Ansible so the server is described in a repository rather than in somebody's memory, a reverse proxy handling TLS and renewals, PostgreSQL with off-site encrypted backups, and each application isolated as its own service. Nothing here is clever, and that is the point — at three in the morning you want a boring system you can reason about.
You also keep the keys. The code is in your repository, the domain is in your account, and the backups are restorable by someone who is not me. A hosting arrangement you cannot leave is not a service, it is a hostage situation.
What it does not cover
Worth being clear, because retainers go wrong when this is vague. A retainer is maintenance and small changes. A new feature, a redesign or a version jump across several releases is a project, quoted separately — I would rather tell you that up front than quietly stretch a support arrangement until neither of us knows what it includes.
Where this has been done
Museum Wilhelm Busch came over from a small agency in Hanover in 2018 and I have looked after it ever since — including building a pretix-based ticket shop for entry, exhibitions and vouchers. Still running, still mine.
Bakeup, since 2022. Hosting and ongoing development for live SaaS rather than for a website, which is a higher bar: bakeries take orders through it every morning.
Lifelessons, an online course platform, and Duesenberg, a guitar maker — both launched years ago and both still active engagements. That is the normal shape of this work when it goes well: the build is the short part.
Earlier, and no longer running: ISIMIP for a climate-impact research network, and Safety.io, a subsidiary of MSA The Safety Company, where I ran every Django and Wagtail update for the duration of the engagement.
The pattern is the point. These are engagements measured in years rather than months, with the same person throughout — which is the actual argument for working with one developer instead of an agency account team.
Talk it through
Get in touch and say where the site is hosted now, what it runs on and what currently happens when something breaks. If the honest answer to the last one is "nobody knows", that is a normal place to start from.