This has worked for years with practically zero maintenance.
I'm guessing you're OK with the tradeoff of your machine going down sometimes?
Sure, there's downtime when the VPS provider is down. That's no different than "managed" services.
Do you have some kind of monitoring? What about logging?
Crashes are logged but I don't think anybody has ever looked at the logs. I'm not sure a crash has ever happened (the app is written in Haskell). Unexpected errors are saved to the database and can be viewed using the web. If we needed logs people could tail them from the VPS (ssh -t $WEB_HOST 'tail -f webserver.error.log'). I know, I know, that's crazy. I'm told real software companies are supposed to ship them to someone else, and then pay them to view the logs using a crappy web interface.
No monitoring. If the site is down customers will let us know, which has happened a few times. Monitoring wouldn't help much with shipping bugs anyway.
> This has worked for years with zero maintenance.
Do you apply security updates, e.g. for Caddy, the OS, db, etc.?
And that's when things are working as expected. All it takes is for one of your non-DB services to be compromised, and an attacker can now connect to the DB on localhost. That's why it's best practice to put a secure password on your DB even if you only expect connections from local services. And yes, you should upgrade it too... or at least apply security patches.