What Happens On Your Server While You Sleep

You open your inbox at 07:30 GMT and see a client email: "My shop went offline at 02:15 and the checkout stopped working." All you did yesterday was schedule a product launch and go to bed. The problem disappeared before you even logged in, but you wonder what actually ran on the server while you were asleep.

Nightly Backups Protect the Most Recent Changes

Every plan on our platform runs a backup job that matches the frequency you pay for. Flameling customers get a snapshot every 24 hours, Ember every 12 hours, Blaze every 6 hours, and Inferno every 30 minutes. The process is identical across the board:

# Example command run by the backup daemon
restic -r b2:mybucket:/backups/spark backup /srv/www/example.com \
    --exclude=/srv/www/example.com/cache \
    --tag daily

1. restic creates a compressed archive of your web root, your SQLite file or PostgreSQL 16 dump, and mailbox data if you use our email service.
2. The archive is encrypted with AES-256 before it ever leaves the node.
3. An encrypted object is uploaded to a Backblaze B2 bucket that lives on a different continent.

Because the backup interval is tied to the plan, an Inferno site can lose at most 30 minutes of data. A Flameling site can lose up to a full day. The encrypted offsite copy survives hardware failure, ransomware, or a fire that destroys the rack in Nuremberg. When you ask for a restore, we pull the appropriate snapshot, decrypt it on our node, and rebuild the site in under 20 minutes.

The backup chain is the same one we described in our April 17 post about offsite storage, so you already know the pieces. What you don't see is the staggered schedule that spreads I/O across the fleet, keeping each node responsive even during a backup window.

Health Checks Run Every Five Minutes

Our custom Watchman daemon runs on the Ember node every five minutes. It tests TCP connectivity, HTTP response codes, SMTP handshakes and DNS resolution for every service you use. A single line in the Watchman journal looks like this:

2026-07-24T02:07:00Z nginx-http 200 ok

If a check fails, the incident is posted to our Discord #alerts channel and the flame-guardian firewall automatically bans the offending IP. The ban escalates through ten tiers, with the highest tier enforced by Guardian-X at the XDP kernel layer - the fastest point of packet rejection we have.

The Sentinel service adds another safety net. Every 60 seconds it posts a simple "alive" message to our Discord #health channel. If the Sentinel stops sending, the absence of a signal tells us the primary node has vanished, prompting an immediate fail-over to the spare node.

Both Watchman and Sentinel were built in-house, as we explained in the April 22 platform-monitoring post. They run on the same hardware that serves your site, so there is no external polling delay.

Security Scans and Package Updates Happen While You Rest

When you're not logged in, our nightly job runs an OpenSCAP scan against each container. The scan checks for missing kernel patches, vulnerable PHP-8.3 extensions, and outdated system packages. Results are stored in a per-customer report that you can view in the control panel.

If the scan finds a critical vulnerability, flame-guardian automatically blocks any traffic to the affected service until we apply a security fix. The fix is pulled from the Alpine 3.23.4 repository and applied with apk upgrade. Because the upgrade runs inside the flame-bubble sandbox, a misbehaving update cannot corrupt the host.

Package updates are deferred on Ember and Blaze plans until the next maintenance window, typically on a Wednesday evening. Inferno customers receive updates on a rolling basis as soon as the new package passes our internal CI tests. This approach balances stability (you don't get a surprise breakage on a busy Friday) with security (critical patches land quickly).

Log Rotation Keeps Disk Space Predictable

Your site generates nginx access logs, PHP-FPM error logs and mail logs every day. Left unchecked, those files can fill a 60 GB volume on the Inferno plan in a matter of weeks. Our nightly logrotate configuration compresses logs older than one day and removes files older than 30 days. A sample rotation rule looks like this:

/var/log/nginx/*.log {
    daily
    rotate 30
    compress
    missingok
    notifempty
    sharedscripts
    postrotate
        systemctl reload nginx > /dev/null
    endscript
}

Because the rotation runs after the backup job, the most recent uncompressed logs are always included in the snapshot. This guarantees you can trace a problem that occurred at 02:15 GMT using the backup's log archive.

Why Managed Hosting Means You Don't Have to Watch the Night

If you run your own server, you would need to stitch together cron jobs, third-party monitoring services and manual patching. Any gap in that chain creates a window where data can be lost or an attacker can linger.

With our managed UK hosting, a single engineer sets up the Watchman, Sentinel, backup daemon and security scanner. The engineer isn't on call 24 hours a day, but the automated tools raise alerts to a shared Discord channel that we monitor during business hours. Critical incidents - for example a Sentinel silence or a Guardian-X permanent ban - trigger an out-of-hours pager that alerts the on-call engineer.

The result is a predictable, documented set of background tasks that run every night, every hour, or every five minutes. You wake up to a site that is still up, a backup you can roll back to, and logs that show exactly what happened at 02:15 GMT.

Summary

• Backups: encrypted, offsite, interval tied to plan (30 min-to-24 h).
• Health checks: Watchman runs every five minutes, Sentinel posts every 60 seconds.
• Security: nightly OpenSCAP scan, automatic package upgrades inside flame-bubble.
• Log rotation: daily compression, 30-day retention, included in backups.
• Human oversight: alerts sent to Discord, out-of-hours paging for critical failures.

When you choose our managed UK hosting, you trade the anxiety of "what if something breaks while I'm asleep?" for a set of transparent, open-source tools that keep your site alive. The work happens while you sleep, and the result is a site that's ready when you wake.