SAM’s back catalog is online today, running on a Zao VPS we already had, so the marginal cost of keeping it there is about $0 a month. Cloudflare Tunnel is $0 too. The alternative was $540 a year for a managed cPanel VPS plus €1,068 a year for a third-party care plan on a content management system that had reached its end of life, and that is the floor, before the €490 upgrade the care plan assumes you will eventually buy. The other alternative, importing 16,568 articles into the new build, was a five-figure project.
When Ski Area Management (SAM) moved to a new WordPress build, the legacy stacks had reached the end of their software life, and keeping them as live CMSes no longer made sense. That stack held the magazine’s entire back catalog, 16,568 articles, plus the whole of its sister publication, the Adventure Park Insider archive.
The only copy of SAM’s history was an 18.6 GB cPanel backup behind a one-time download link set to expire on September 30. Miss that window, or fail to verify the download, and decades of reporting is gone, and every inbound link to a historical article returns a 404.
Keeping the old stack alive was a non-starter. The magazine ran on Joomla 4.4, whose security support ended on October 14, 2025 with release 4.4.14, and there is no paid extended support for Joomla 4 at any price. Joomla’s official eLTS program covered 3.x only and closed on February 17, 2025. The site also leaned on a long tail of unsupported extensions, and both databases held real liabilities: payment and personal data in old form tables, subscriber emails, and mail server credentials.
An archive you cannot safely leave running is a liability, not an asset.
Publishers usually evaluate three options for a legacy catalog this size. We built a fourth.
Time and Money
Option one is to keep paying. A typical managed cPanel VPS with room for the backup and both sites runs about $540 a year. Because the CMS is past security support and no official extended support exists, you also buy a third-party care plan, which starts at €1,068 a year for the business tier. The only genuinely patched route is a forced Joomla 4 to 5 or 6 upgrade, from €490 and realistically more once the extensions are counted. Spend all of it and the old form data is still sitting on a live server.
Option two is the brute-force migration. The tooling is cheap: €49.99 for FG Joomla to WordPress Premium plus €24.99 for the K2 add-on, €74.98 all in. The work is not. MigrateWeb publishes pricing up to 500 items at $299 and quotes anything larger; scale that per-item rate naively across 16,568 articles and you land near $9,900, which is an order of magnitude, not a quote anyone gave us. Seahawk starts at $499 and prices large migrations individually. In-house, our estimate was 40 to 120 hours for data mapping, roughly 16,500 redirects, paywall rules, QA, and broken image paths, which at an assumed $150 an hour is $6,000 to $18,000. None of that covers Adventure Park Insider.
Option three is to let the archive die. You save the hosting bill and lose decades of search equity, thousands of inbound links, and the publication’s historical record.
Option four, the one we built, is to decouple the archive from the public internet, strip the sensitive data out of it, and serve it read-only through a tunnel.
Erasing the Liability
We pulled the 18.6 GB backup the day the link arrived and verified checksums before touching a file. Both sites came up as Docker containers, nginx with PHP 8.4 and 8.2 and MariaDB, on an existing Zao VPS, on an internal network with no outbound routing. The server cannot reach the internet, and the internet cannot reach the server directly.
Firewalling a dirty database is not the same as cleaning it. IBM’s Cost of a Data Breach 2026 puts the US average at $11.5 million, which is an average across every breach in the study and not a forecast for a trade publication. The narrower point is the one that matters: payment and personal data in old form tables is risk that nobody should carry into a new infrastructure cycle, and deleting it is cheap.
So we deleted it. In a throwaway container we dropped the unused and sensitive tables, masked the stored user emails, wiped the payment and personal data in old form tables, blanked the stored secrets, and scrubbed the theme and plugin files of API keys and a circulation-vendor credential. File scans across the served trees came back clean. Only the sanitized copies went into a fresh database, and the raw imports were destroyed.
Preserving the Business Rules
An archive has to keep its business rules, not just its HTML. Articles that were members-only on the old site are still gated on the SAM archive: a paid article returns a strict 404, and category pages, RSS feeds, and site search return nothing for paid items. Free long-tail resources like Back Down to Earth and the Terrain Park Contest 2025 render cleanly, inbound links intact.
Cloudflare Tunnel exposes the rest of it. The daemon runs on the VPS and dials out to Cloudflare’s edge, so the origin has no open inbound ports. We mapped the tunnel to old.saminfo.com and api-old.saminfo.com, blocked the admin interfaces, XML-RPC, and login endpoints at the edge, and rate limited the scrapers. Every response carries x-robots-tag: noindex, nofollow, noarchive, nosnippet, so the archive never competes with the live site in search.
Cloudflare Tunnel costs $0, with 1,000 tunnels included per account. The compute was already paid for. If this ran on its own hardware instead, a Hetzner CX22 would be about €54.12 a year. Set that against $540 plus €1,068 a year to maintain a legacy Joomla stack, or $6,000 to $18,000 of labor to carry obsolete formatting into a clean build, and the tunnel is a rounding error.
SAM keeps the complete back catalog and the links pointing at it. The end-of-life CMS is off the attack surface, and the old form data is deleted rather than firewalled.
Both hostnames returned 200 when we checked on October 20, 2026. The content is online, the databases are clean, and the origin accepts no incoming connections.