Skip to main content

Migrating to Alibaba Cloud

· 5 min read
tanzhuo

I used to run everything on a Hong Kong server—4 cores, 4G RAM, 90G disk, 5M bandwidth—at 150 yuan a month, which felt a bit steep. With the Singles' Day sale on at Alibaba Cloud, I moved the whole blog to a mainland server and automated SSL certificate renewal while I was at it.

Background​

My blog used to run on a Hong Kong server with 4 cores, 4G RAM, a 90G disk, and 5M bandwidth, for 150 yuan a month. For a personal blog that's hardly a good deal—traffic is low, the 4 cores sit mostly idle, and the money was really buying the convenience of "no ICP filing required."

The Singles' Day sale came at just the right time: I picked up a mainland cloud server with 2 cores, 8G RAM, a 40G disk, and 5M bandwidth for 1,399 yuan over 3 years—about 38 yuan a month. Fewer cores, but double the memory, which suits my "blog plus a handful of homegrown services" usage much better. 5M bandwidth is plenty for static pages and small applications; plenty of small business sites run on no more than that.

The Migration​

The blog was already deployed with Docker, which made this migration much easier. One direct benefit of containerized deployment: no environment to reinstall—move the images and the data over, start the containers, done.

The overall plan had three steps:

  1. Install Docker on the new server and pull (or import) the original images;

  2. Archive the data volume directories on the old server, transfer them to the matching paths on the new machine, and keep the mount points identical;

  3. Once the containers are confirmed running on the new machine, switch the DNS records to the new IP.

Moving the data volumes can be done crudely but effectively with tar and scp:

# Old server: archive the data volume directory
tar czf blog-data.tar.gz /data/blog

# Transfer to the new server
scp blog-data.tar.gz root@new-server:/data/

As long as the directory structure and mount configuration stay the same, the containers come up on the new machine exactly as they were. This is why I insist on Docker for deploying my personal services: migration cost is close to zero.

Domain ICP Filing​

Here lies the biggest difference between mainland and Hong Kong servers: pointing a domain at a mainland IP and serving web traffic requires completing ICP filing first—otherwise requests on ports 80/443 get blocked.

Filing is submitted through the Alibaba Cloud console: fill in the entity and website details, upload your documents, and wait for the regulator's review. Mine took about 6 days. During the review the domain can't point at the new server, but the server itself is fully usable—you can finish setting up and debugging the environment over IP or SSH, then flip the DNS as soon as the filing clears, with almost no downtime in between.

Automated SSL Renewal​

This migration was also a chance to sort out SSL certificates once and for all. I'm still using free Let's Encrypt certificates, which are valid for only 90 days each—that's deliberate on their part, to push you toward automated renewal instead of swapping certificates by hand.

I use the Docker version of certbot for this. The certbot container handles issuance and renewal, with the certificate and challenge directories mounted out as data volumes; nginx mounts the same certificate files. The renewal command looks roughly like this:

# Check and renew any certificates nearing expiry
docker run --rm \
  -v /data/certbot/conf:/etc/letsencrypt \
  -v /data/certbot/www:/var/www/certbot \
  certbot/certbot renew

The renew command only renews certificates that are close to expiring, so running it daily from crontab has no side effects—just have nginx reload its configuration after a successful renewal. With this in place, SSL is effectively "free forever" and can be left alone.

What's Next​

With 8G of RAM, running only a blog on this machine would be a waste. I'll gradually deploy more of my own services onto it to provide backends for my demo apps. And with HTTPS and ICP filing both squared away—WeChat Mini Program backends happen to require a filed domain served over HTTPS—both prerequisites are met, so building some personal mini programs is now on the table.

Pitfalls and Caveats​

  1. Deploying Docker on the Hong Kong server produced all sorts of strange behavior. The most memorable: the host didn't support Docker's newer storage driver format, and I had to reformat the disk and change the filesystem's storage format to get it working. Docker's storage drivers have requirements on kernel versions and filesystem parameters, and old or unusual host environments trip over this easily. None of these problems ever appeared on Alibaba Cloud—smooth sailing throughout.

  2. The domain can't point at the new server while the filing is under review, so finish all the migration and debugging work in advance to compress the cutover window to a minimum.

  3. Alibaba Cloud isn't perfect either—the network sometimes feels noticeably jittery. It doesn't matter for a personal blog, but keep an eye on it for latency-sensitive services.

Wrapping Up​

Most of the time this migration took was spent waiting on the ICP filing; the technical part cost almost nothing thanks to Docker. With certificate renewal automated on top, this server has basically entered "set it and forget it" mode. For an individual developer, a cheap mainland server plus a filed domain actually opens up more possibilities, not fewer.

COMMENTS