The edge of the map

Before the move, the pages were served from a US host’s edge, which was also its CDN, its TLS and, for anyone who let it, its DNS. This is where a static site stops being a pile of files and becomes infrastructure. The files may be European, the registrar Swiss, the forge Swiss or German. None of that says who carries the packets from the visitor to the server, where the server sits, who runs it, which company supplies the network, or which legal system reaches the people holding the keys. “Hosted in Europe” is an unfinished sentence, and the scraps for this layer are the attempt to finish it: who carries the packets, where the machine is, who runs it, who owns them, and what would stop, and for how long, if any one of them dropped out.

Under the host

Purple Lantern’s sites went to statichost, which describes its builder and its edge as separate, with edge servers serving files through standard server software. A builder outage then need not take down published sites, and an edge outage need not touch the source or the build. The production object is static files, so the escape route stays dull: repository, local build, static files, another web server. When that works, the host is a service.

statichost is not the machine serving the site, and finding out what is took only three documents. Its status page names datacentres in Helsinki and Nuremberg. Its data processing agreement names the operator: Hetzner Online GmbH of Gunzenhausen, Germany, listed as the datacentre sub-processor under Swedish law. The address registry agrees; the apex address statichost hands out, 95.217.26.94, sits in a Hetzner block named CLOUD-HEL1, in Finland. So the scrap for any site on statichost reads: country Finland and Germany, operator Hetzner, owner Hetzner, a German company under German law, infrastructure rented cloud, and the site can move to any host that takes a directory.

That is where “European company” and “European infrastructure” come apart. Where the data sits does not say who can reach it or which law applies to the provider. A server in Frankfurt run by a European subsidiary of a US company is not the same dependency as a European provider running its own hardware in Frankfurt. Neither is good or bad in itself. They are different graphs. For Purple Lantern “no US cloud underneath” was the target, because the exercise is about reducing the places where a US company can become the blocking point. statichost’s front page says no AWS and no Cloudflare, and its DPA says what instead: Hetzner, a German company on its own hardware. That is the answer for any site on statichost, as of September 2026, and the DPA is where it will change first if it changes.

No CDN

A CDN puts another layer between domain and origin. A small static site does not need one; it helps with geographic spread, traffic spikes, redundancy and DDoS absorption, and it is another company in a privileged position on the delivery path. statichost’s worldwide CDN is a private beta, its FAQ describes a European replication option through acache.io, whose contact address is statichost’s own founder, and its DPA lists BunnyWay d.o.o. of Slovenia as the CDN sub-processor. Three names for one layer Purple Lantern does not use, and the layer went into the scraps anyway: the day it is switched on, the delivery path gains a Slovenian company and a second venture of the same person. The simplest architecture stays until there is an actual reason to add an edge.

The same goes for DDoS protection and reverse proxies, which usually arrive bundled with a CDN. The provider is then a traffic intermediary, a DNS dependency, a TLS termination point, a source of blocking decisions, and another account to recover. Cloudflare is the example of several layers collapsing into one provider: convenient, and the convenience is what makes a graph hard to leave. An origin serving static files through ordinary HTTP server software is unusually portable, and statichost describes its edge in those terms. There is nothing in front of it.

Three companies

DNS sits above all of this, and the domain, the zone and the site are at three different companies: EURid, Infomaniak DNS, statichost. That is deliberate. If statichost disappears, a record change moves the site; if Infomaniak’s DNS disappears, the zone moves without the domain moving. DNSSEC went into the scraps as one more thing beside the DNS provider, not inside a single box called DNS, and so did the apex. The subdomains are CNAME records to SITENAME.statichost.page and follow the host; purplelantern.eu itself holds the A and AAAA addresses from statichost’s domain docs, for the reasons on the naming page. The two do not land on the same machine: the apex resolves to 95.217.26.94, the subdomains through sites.statichost.eu to 46.225.58.80, and the docs promise nothing about either. If the host renumbers, the apex is the record that breaks.

Beyond Hetzner

The site reaches visitors through an address, an autonomous system, upstream transit, peering and routing. For a site on statichost the addresses are Hetzner’s and the announcing network is Hetzner’s; who carries Hetzner’s traffic out of Helsinki is Hetzner’s business and not visible from a customer account. This is where a European host picks up a non-European dependency without advertising one: the datacentre, the server and the company can all be European while the upstream transit is not. The contract says European hosting; the packets do not read the contract. Two servers in two European cities are not two independent sites if both hang off the same network operator, power supplier or transit. A small site needs no thesis on BGP. Knowing that the answer stops at Hetzner is enough to know where the next question would go.

Certificates

statichost provisions certificates for custom domains automatically, from Let’s Encrypt. Loyalty to a CA is not the property; portability is. A site on ordinary HTTPS with standard certificate automation moves to another host without redesign. The certificate is temporary. The domain, DNS control and the ability to obtain a new certificate are durable, and standard ACME keeps them so where a proprietary arrangement would not.

I aten’t dead

Monitoring from inside the provider is not enough. If the provider says everything is fine while visitors get connection failures, the provider’s monitoring has missed the point. statichost’s FAQ describes continuous HTTP monitoring through Better Uptime, and its status page runs on Better Stack, the same company under its newer name; either way it is one provider’s view of itself. An independent check from a different network asks from the other side: DNS resolution, IPv4, IPv6, TLS validity, HTTP status, expected content, response time. Monitoring from the same provider says whether the provider thinks the provider is working. An outside monitor says whether the Internet agrees. That one is still a scrap and not yet a thing.

The map

   visitor                        domain
      │                              │
   European network            European registry
      │                              │
   European static host        European registrar and DNS
      │                              │
   static files                European static host

European ownership and physical infrastructure, no US cloud beneath the host, no CDN or proxy in front of it, DNS independent of hosting, plain IPv4 and IPv6, TLS through standard ACME, static files kept at home. The one item that got postponed is the second hosting route. It does not mean a second production service kept running. It means the files are built, the DNS records are written down, the domain can be pointed elsewhere, and the procedure has been run once. The escape hatch exists because somebody opened it, and so far nobody has.

statichost’s architecture fits the model: builder separate from edge, repositories from any Git provider, static files, no proprietary runtime. Its status page also records real incidents: builder networking took the dashboard down for 41 minutes on 26 June 2026, Nuremberg degraded for a minute on 3 August and again on 12 August, and the CDN-enabled sites had an outage on 30 August. None of it touched the shared hosting for more than two minutes, and all of it is a reminder that European infrastructure is not a synonym for nothing ever breaking. Not a criticism. It is why the failure path belongs in the architecture.

What could go wrong?

Suppose a US authority designates the owner of a service, an upstream provider, a software company, or another organisation somewhere in the chain. Whether the server is in Europe does not settle it. What settles it is which European company in the chain has a US legal, banking, ownership, licensing or contractual dependency that could make it stop serving the site.

  • A designation reaches a European subsidiary or parent through its bank, insurer or lawyers, and the service is suspended.

  • A designation reaches a US-owned infrastructure provider, and the European host loses its infrastructure.

  • A European company over-complies and closes the account.

The server stays healthy throughout. Jurisdiction, ownership and operational control are separate lines in the scraps for that reason. statichost has gone, what now? The site is built locally, the registrar and DNS are reached independently, the files go to an ordinary European web server, the domain is pointed there, and the result is checked from outside the home network. If that works, the host was a replaceable service. If it does not, the static site has grown a rather elaborate nervous system while nobody was looking.

When Granny Weatherwax goes Borrowing she leaves a card on her chest reading I ATEN'T DEAD, because a witch lying very still looks exactly like a dead one and she does not trust the neighbours to tell the difference.