Is it yet possible to securely host a "virtual server" away from your physical control, like this?

What I'm looking for is some way to, on my own computer, run some sort of command which "bakes" my PHP scripts and some sort of configuration file into a black box of a single file, something like My server.abc, which is impossible for anyone to "peek into", and which I simply upload to some company's website and which then goes into their big "cloud computer" or whatever, and then runs as long as I pay the bills, and they don't have any clue what's inside of this encrypted "box"; all they see is that it sends data packets and receives data packets. The configuration file would just be a very abstract list of software I want inside of it, such as: "PHP 8, PostgreSQL 13, nginx 123, sshd", and a simple login/password for me to be able to access it via SFTP/SSH.

I fully recognize that this might be technically impossible, but according to my understanding of computers, it sounds like it would be possible, even if it's not actually available due to other reasons.

I cannot host a server at home. Especially not a webserver which is expected to be available most of the time. (I actually used to do this for many years, but it was a nightmare when the Internet went down or there was a power cut or fire hazard or hardware died or there was a DDoS attack.)

I cannot use a "webhost" where I pay some company to allow me to have a little SFTP login where I put my files and a web control panel. Nearly none of them support PostgreSQL (the database I use) but even if they did, this environment is simply not secure whatsoever.

I cannot pay some company for my own dedicated server which I administer and manage myself. Well, actually, I could do that, but since I did for many years and nearly drove myself insane from stress, I want to avoid this if at all possible. Plus, even though it's "dedicated", it's out of my control and they usually use highly insecure remote management solutions. Also, if for any reason I can't be around and babysit the server and apply patches in the middle of the night, it quickly becomes insecure. Also, I'd very much like to never use FreeBSD, Linux or Windows Server again in my life if I can help it...

(A VM is the same thing as the above, with the additional problems of it being a VM, with drifting clocks and all that crap.)

I cannot pay some company to provide a "managed" dedicated server, where they handle all the stress. Primarily because of the fact that I just don't trust them to be competent, having dealt with IT "professionals" so many times in the past, but also because it of course costs much more money.

I cannot pay some company for a fuzzy "cloud" service, because this is again just not secure. It's very unclear where and how my "server" exists, and it might as well be a VM/webhost account. Also, and maybe I'm just unlucky, but I actually tried to use both AWS, Azure and IBM's cloud solution a few years ago, and I couldn't even register/log in for two of them, and Azure was so ridiculously broken that it wasn't even possible to set up a test "server"!

I am aware of the existence of "Docker" and similar things, but I've never been able to actually figure out how to use it. I really did spend a lot of time on it. It doesn't seem to actually be what I want at all.

Please don't tell me that I'm stuck with doing 100% of the data processing on my desktop computer, generating static HTML files all day which I sync to a webhost account via SFTP. Because that's the desperate "last resort" I'm thinking of if I cannot run my stuff securely. Of course, this will mean that my website will have no interactivity and no way to "login". Everything becomes so much more difficult that way, but I simply cannot trust others with my and my users' data if I can't do it in a truly secure manner.

Solution 1:

The generally accepted simplification is that whatever safeguards and encryption you built into your software, they will not protect you from a determined adversary that has full control over the hardware where your software is running.

If that is case: how and why are even big companies still using cloud solutions, where they don't have control over the physical hardware, even for valuable and sensitive applications and data they need to keep secured?

Do they simply trust the hosting provider to keep the hardware secure and eventually their data and applications?

In essence yes, but there is nothing "simple" about that.

There are cost-benefit and risk analyses as well as risk management processes.

Generally those companies are taking technical measures to control the risks (or at least should doing everything) to ensure that even when an adversary takes control over the hardware it won't be easy or trivial to use that access, for example by implementing the use of (full-disk) encryption for storing data rest, transport encryption for all communication between systems and users, signatures and non-repudiation for transactions etc.

Then they don't rely on software and encryption solutions alone for their risk management; they do their due diligence in selecting trusted parties to manage the hardware and make them sign strict contracts, with SLA's and penalty clauses to keep them honest.

And companies generally audit and verify if their own staff and teams, as well as their providers actually deliver on what they promised and should be doing.