Masuit.MyBlogs: a .NET 9 blog CMS built to run on one small server

A working site, published as its own source

Masuit.MyBlogs is the source of a personal blog and CMS, and the project is described in the repository description as the source code for masuit.org, offered for reference, study, citation and non-commercial deployment.

Three demo sites are listed, masuit.org, masuit.com and ldqk.xyz, and the repository is mirrored on Gitee as well as GitHub, with badges for both. The top level of the repository is three directories, `src/` for the server, `front/` for the frontend and `database/` for the schema, which tells you the shape of the thing before you read a line of it.

The performance claims are the author's own and are stated with unusual specificity. The project claims a code size of only 3MB, an average of 800,000 to 6,000,000 requests handled per day, 60 to 600 concurrently active users, and cumulative data reaching millions of records, with the database, Redis and the main site program all running on a single 4 core 8GB machine, browser page requests responding in seconds, average CPU usage held around 10% and memory usage around 400MB.

The current runtime section is more specific still: Windows Server 2019, PostgreSQL 18.x, Redis 8.x,.NET 9 with HTTP/3 over QUIC, on a 4 core, 8GB and 6Gbps server, carrying an average of around 6 million requests and about 1TB of bandwidth per day.

That last figure is the one that makes the case, because 1TB a day on 6Gbps is not a small blog by any measure, and it is what justifies the architecture choices rather than the other way round.

The releases are dated rather than numbered by semver, with 2026.10.1 on 2026-09-30, 2025.11.24 and 2025.10.18 before it, and the last push was on 2026-10-15 with the repository not archived.

The stack, and why each piece is there

The technology list is where a project of this kind shows its design, and every entry has a job.

On the server side there is .NET 9, ASP.NET Core MVC together with Vue 3 and Blazor Server, Entity Framework Core 9 with the Npgsql provider, Masuit.Tools, Masuit.LuceneEFCore.SearchEngine, Hangfire, FreeRedis with EFCoreSecondLevelCacheInterceptor, and YARP as a reverse proxy. On the client there is Vue 3 with Quasar, Pinia and Vue Router 4.

Several of those are worth explaining because they are not defaults.

Lucene through Entity Framework Core is a full text index over the database, which is how a blog gets a search that understands words rather than patterns. The companion `Masuit.LuceneEFCore.SearchEngine` package suggests the search indexing is kept in step with the data automatically rather than by a manual reindex step.

The second level cache interceptor, paired with FreeRedis, is a cache that sits between the application and the database at the ORM layer, so a repeated query for the same entity is answered from Redis without a round trip. The naming says the implementation is FreeRedis rather than the official StackExchange.Redis client.

Hangfire is the background job scheduler, and it has its own visual management page in the project, which means scheduled work is not a crontab and a log file but a UI you can inspect.

YARP is Microsoft's reverse proxy, and its presence suggests the site fronts other services, or that the same application serves multiple hostnames, with the proxy handling the routing.

Blazor Server next to Vue 3 is an unusual pairing, and it suggests that some interactive parts of the site are rendered server side, where a live connection is easier than shipping a JavaScript bundle.

The development environment requirements are listed too: Windows 11 24H2, Visual Studio 2022 version 17.14 or higher, PostgreSQL 16.x, Redis 8.x, Node.js 20.x LTS for the frontend build, and .NET 9 as the required runtime.

Editorial workflow, moderation, and the App_Data directory

The feature set is what separates this from a blog engine that renders Markdown.

Article management covers review, merging, and full CRUD on the article list, plus category and topic management. The review flow: when a user submits a post on the front end, it enters a pending state, and only after approval does it appear in the public article list. The merge flow is the more interesting one: when a user edits an article on the front end, a merge request is created, and the user's changes only take effect once an administrator performs the merge. There are three ways to resolve it, merge directly, edit and then merge, and reject, and on rejection the person who made the edit receives an email notification.

Articles also support editing, adding, pinning, temporary deletion, restoration, permanent deletion and comment disabling, and an edited article generates historical versions. Categories relate to articles one to many, and topics relate many to many.

Comments and messages are moderated too. Content submitted on the front end that may contain sensitive words goes into manual review and only appears publicly after it passes. In-site notifications cover comments, messages, submissions and article merges, and announcements support scheduled publication and takedown.

The system settings area holds global configuration and SEO settings, a firewall, run logs, friend links and email templates. The firewall intercepts all requests globally and supports blacklist and whitelist rules, IP address ranges, country or region, and keyword review.

The `App_Data` directory shows how much of this is file-driven rather than database-driven, and it is a good map of the features. It holds a `cert` folder for HTTPS certificates, a `ban.txt` sensitive word list, a `CustomKeywords.txt` search segmentation dictionary, a `denyip.txt` IP address blacklist, a `DenyIPRange.txt` IP range blacklist, a `GeoLite2-City.mmdb` MaxMind address database, an `ip2region.db` ip2region address database and a `mod.txt` review word list.

So the sensitive word list, the search segmentation dictionary, the IP blacklist and the IP range blacklist are plain text files you can edit, and the two address databases are MaxMind GeoLite2 and ip2region, which is a Chinese IP address database, both used for the country and region targeting that the firewall and the advertising features rely on.

The advertising module is more than a banner slot, with bidding ranking, weighted probability of appearing, placement in banner, sidebar, in-article and list positions, and targeting by region. Sponsorship management is described as automatically masked.

Search statistics record the keywords each front end user searches within a session, deduplicate them, and keep only the most recent month, which feeds hot word counts for the month, the last seven days and the day.

The infrastructure table, and the oversold server warning

There is a requirements table with four tiers, and it is more useful than most project documentation of this kind.

The minimum configuration is 1 core, 1GB of memory, 1Mbps of bandwidth, PostgreSQL 9 and Redis 3.2 or newer, with the note that this is for playing with. The recommended configuration is 2 cores, 2GB, 1Mbps, PostgreSQL 14 and Redis 5.0 or newer, described as a few simultaneous visitors. The luxury configuration is 2 cores, 4GB, 5Mbps, PostgreSQL 15 or newer and Redis 5.0 or newer, described as a few hundred simultaneous visitors and a daily request volume below 6 million. The supreme configuration is 4 cores, 8GB, 1000Mbps or more, PostgreSQL 16 or newer and Redis 7.0 or newer, for a daily request volume above 6 million.

Note what the table reveals. The CPU count barely moves between the recommended and luxury tiers, while memory and bandwidth do, which is a claim about where the bottleneck is. A blog is bound by its database round trips and its egress, not by parallel compute, which is exactly what a caching layer and a reverse proxy are for.

Then there is the warning, and it is the most unusual thing in the documentation. The project asks readers not to run the program on oversold machines from cloud providers such as Alibaba Cloud and Baidu Cloud, warning that the program will crawl. It then explains how to check whether a provider is overselling: run a benchmark on the server you are given, and if the score is close to the published score for that processor then it is not oversold, with the formula being total score divided by core count for comparison, and notes that a single core comparison is not meaningful on a virtual machine.

That is a genuinely useful piece of advice for anyone deploying on cheap cloud instances, and it comes from someone who has run into the problem. What the project asks for instead is the total score divided by core count, because on a virtual machine a single core score has no reference value.

The same reasoning applies to the requirement for HTTP/3 over QUIC and 6Gbps of bandwidth for 1TB a day, which is a site that is serving media rather than text.

A monolith, and a licence with a clause in it

The architecture is described plainly: the project uses a monolithic architecture for easy deployment and configuration, a traditional MVC pattern, and a simple ASP.NET Core MVC with EF Core architecture, with the layering being Controller to Service to Repository to DbContext.

That is a sensible choice for this kind of application, and the reasoning is implicit in it. A blog with comments, articles, moderation, ads, sponsorships, file management, search and scheduled jobs has a lot of shared state, and a monolith puts that state in one process with one transaction boundary, which avoids a whole class of distributed consistency problems. The cost is that the same process must be scaled as a unit, which for a read-heavy blog with a cache in front is not the binding constraint.

The server performance monitoring feature is worth a note because of its constraint. It can monitor the server's running state online and in real time, including CPU, network bandwidth, disk usage and memory, with percentile and chart statistics, can record the last day of server health, and pushes the data over websocket. It only supports Windows, and it needs the latest Windows updates installed.

The licence is the part that needs care, and the project is unusually direct about it. The repository is MIT licensed, and there is an Anti-996 licence badge in the header. The notice in the documentation says that if a company that uses this open source project, or that references it or includes its code, is found to have lost any legal action for violating labour law, including illegal layoffs, excessive working hours and employing child labour, then the author of the project has the right to claim a usage fee, set at two to five times the company's registered capital as the authorisation fee, or to disallow the use of any source code containing the project. Any outsourcing company or 996 company that needs to use the library is asked to contact the author for commercial authorisation, and other enterprises or individuals may use it freely without restriction.

I am not going to tell you what that means legally, because it is a question for a lawyer in your jurisdiction, and an MIT grant and an additional fee claim are in tension with each other in ways that depend on the contract and the law. What is factual is that the project states both, that the badge and the notice are visible in the repository, and that the author has asked for contact in the commercial case. If a company might use this, that conversation should happen before the code is deployed, not after.

Editorial conclusion

Masuit.MyBlogs fits someone who wants to self host a content site with real editorial workflow, search, scheduled jobs and moderation, and who is comfortable running PostgreSQL, Redis and a Node build step alongside a .NET service. Skip it if you need a static site or a hosted blog, because this is a database-backed application with a substantial dependency list, and read the licensing note carefully if a company might use it, because the project states that a company found to have lost a labour law case owes an authorisation fee of two to five times its registered capital, on top of the MIT terms. Before you deploy, note the stack requirements of .NET 9, PostgreSQL, Redis 8.x and Node 20.x, and read the section on oversold servers, because the author warns that running on some cheap cloud instances is not viable.

Frequently asked questions

Official sources

1. ldqk/Masuit.MyBlogs on GitHub
2. License: MIT
3. Project website
4. README
5. Releases